chore: make ci happy - #4913
Merged
Merged
Conversation
doc-han
force-pushed
the
fix-hackney-vuln-audit
branch
from
July 13, 2026 08:06
1626477 to
de81828
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4913 +/- ##
=====================================
Coverage 90.5% 90.5%
=====================================
Files 425 425
Lines 20237 20237
=====================================
+ Hits 18311 18312 +1
+ Misses 1926 1925 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
doc-han
marked this pull request as ready for review
July 13, 2026 12:10
Security Review ✅
|
Contributor
|
Looks like we might get a new version of |
Contributor
|
|
Contributor
|
|
Contributor
|
I'm merging this in. A follow up pr is coming in which will update the ignore list: #4907 |
This was referenced Aug 6, 2026
midigofrank
added a commit
that referenced
this pull request
Aug 6, 2026
* Replace google_api_storage with direct GCS JSON API calls Uploads to GCS have been broken since Tesla 1.18.3 (#4913). Tesla now requires multipart part names to be binaries, and google_gax labels its metadata part with an atom, so storage_objects_insert_simple raises before sending anything. Versions offer no way out: google_gax last shipped in 2021, googleapis/elixir-google-api is archived, and 1.18.2 reintroduces the CVEs 1.18.3 closed. store/2 now POSTs with uploadType=media, avoiding multipart entirely — the object name is the only metadata we set and it travels in the query string. The body is wrapped in Stream.map/2 so Tesla's adapters see a %Stream{} and send it chunked; a bare %File.Stream{} falls through. delete/1 becomes a plain DELETE. Both check the status explicitly, since Tesla returns {:ok, env} for a 403 or 500 and callers rely on non-2xx being an error tuple. delete/1 also applies prefix_storage_path/1, which it never did. On deployments with STORAGE_PATH set, every delete asked for a key that was never written, got a 404, and left the object in the bucket while Projects dropped its project_files row. bucket!/0 reads Lightning.Config.storage(:bucket) rather than the application env, making Config the single source of truth for storage config. A TokenSource behaviour stands in for Goth, which only starts when STORAGE_BACKEND=gcs and so never runs under test. Drops google_api_storage, taking google_gax and poison with it. * Return an error instead of raising on an unsafe storage path delete/1 now prefixes the object path with STORAGE_PATH, so it goes through Path.safe_relative/1 and can fail where it never could before. Matching that with {:ok, _} = raised a MatchError, and delete/1 runs inside the data retention job's Enum.each over every expired file, so a single unusable path would abort the cleanup for every project behind it. prefix_storage_path/1 now returns {:error, {:unsafe_storage_path, path}} and store/2 and delete/1 route through with/1. An absolute STORAGE_PATH is the realistic way in: Path.safe_relative/1 rejects the joined path outright.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR makes CI happy by committing a sin. ignoring an important audit
Closes #__
Validation steps
Additional notes for the reviewer
AI Usage
Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):
You can read more details in our
Responsible AI Policy
Pre-submission checklist
/reviewwith Claude Code)
(e.g.,
:owner,:admin,:editor,:viewer)