From e7b88cd65241dff9b13f822d024825e7714b395d Mon Sep 17 00:00:00 2001
From: Phantasm <phantasm@centrum.cz>
Date: Wed, 21 Oct 2026 11:24:36 +0200
Subject: [PATCH] Sec: Update mint to version 1.11.0

Fixes:
  mint 1.10.0 - EEF-CVE-2026-92103 (MEDIUM)
    aka: CVE-2026-92103, GHSA-q95c-ccq6-j5j6
    Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
    https://osv.dev/vulnerability/EEF-CVE-2026-92103

  mint 1.10.0 - EEF-CVE-2026-82672 (MEDIUM)
    aka: CVE-2026-82672, GHSA-rj5m-69wp-cxq9
    Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
    https://osv.dev/vulnerability/EEF-CVE-2026-82672

  mint 1.10.0 - EEF-CVE-2026-91043 (HIGH)
    aka: CVE-2026-91043, GHSA-9x8p-qrf4-jq7g
    HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
    https://osv.dev/vulnerability/EEF-CVE-2026-91043

  mint 1.10.0 - EEF-CVE-2026-94194 (MEDIUM)
    aka: CVE-2026-94194, GHSA-gvrc-75rc-7gj9
    Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
    https://osv.dev/vulnerability/EEF-CVE-2026-94194
---
 changelog.d/mint-1.11.0.security | 1 +
 mix.lock                         | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/mint-1.11.0.security

diff --git a/changelog.d/mint-1.11.0.security b/changelog.d/mint-1.11.0.security
new file mode 100644
index 000000000..78098c0e3
--- /dev/null
+++ b/changelog.d/mint-1.11.0.security
@@ -0,0 +1 @@
+Update mint to version 1.11.0 resolving multiple vulnerabilities
diff --git a/mix.lock b/mix.lock
index f8c0d48ac..3552eb8cd 100644
--- a/mix.lock
+++ b/mix.lock
@@ -81,7 +81,7 @@
   "metrics": {:hex, :metrics, "1.0.1", "25f094dea2cda98213cecc3aeff09e940299d950904393b2a29d191c346a8486", [:rebar3], [], "hexpm", "69b09adddc4f74a40716ae54d140f93beb0fb8978d8636eaded0c31b6f099f16"},
   "mime": {:hex, :mime, "1.6.0", "dabde576a497cef4bbdd60aceee8160e02a6c89250d6c0b29e56c0dfb00db3d2", [:mix], [], "hexpm", "31a1a8613f8321143dde1dafc36006a17d28d02bdfecb9e95a880fa7aabd19a7"},
   "mimerl": {:hex, :mimerl, "1.5.0", "f35aca6f23242339b3666e0ac0702379e362b469d0aea167f6cc713547e777ed", [:rebar3], [], "hexpm", "db648ce065bae14ea84ca8b5dd123f42f49417cef693541110bf6f9e9be9ecc4"},
-  "mint": {:hex, :mint, "1.10.0", "85af3353bfc504f5bdfe494bd92b8490f87a306dc659ee1ad0af435107e898dc", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "8b16fb72aaa7531d206a1f05e4cc85509ba531ccec7a17a22736c9c95cbb24d1"},
+  "mint": {:hex, :mint, "1.11.0", "a713551624815c0435237b93d90ea8b9b14254690c66f732d0ef8930f76ff1d9", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 1.1", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "c6279ba2d6aa3a383a1d4cfbe7b59f42e6efd400f58d8e2acfeac48a438693ab"},
   "mix_audit": {:hex, :mix_audit, "2.1.5", "c0f77cee6b4ef9d97e37772359a187a166c7a1e0e08b50edf5bf6959dfe5a016", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "87f9298e21da32f697af535475860dc1d3617a010e0b418d2ec6142bc8b42d69"},
   "mochiweb": {:hex, :mochiweb, "2.18.0", "eb55f1db3e6e960fac4e6db4e2db9ec3602cc9f30b86cd1481d56545c3145d2e", [:rebar3], [], "hexpm"},
   "mock": {:hex, :mock, "0.3.9", "10e44ad1f5962480c5c9b9fa779c6c63de9bd31997c8e04a853ec990a9d841af", [:mix], [{:meck, "~> 0.9.2", [hex: :meck, repo: "hexpm", optional: false]}], "hexpm", "9e1b244c4ca2551bb17bb8415eed89e40ee1308e0fbaed0a4fdfe3ec8a4adbd3"},