Skip to content

Fix Elixir 1.20 warnings, upgrade decimal to 3.x, update CI#230

Open
gilbertwong96 wants to merge 1 commit into
devinus:masterfrom
gilbertwong96:fix-warnings-upgrade-decimal-ci
Open

Fix Elixir 1.20 warnings, upgrade decimal to 3.x, update CI#230
gilbertwong96 wants to merge 1 commit into
devinus:masterfrom
gilbertwong96:fix-warnings-upgrade-decimal-ci

Conversation

@gilbertwong96

Copy link
Copy Markdown

Bug Fixes:

  • Add pin operator (^) to bitstring size() patterns — required since Elixir 1.20
  • Remove redundant number_exp_digits(<<>>, skip) clause
  • Move preferred_cli_env to def cli with preferred_envs (deprecated in 1.19)
  • Replace xref: [exclude: ...] with elixirc_options: [no_warn_undefined: ...]

Security:

  • Upgrade decimal from 2.x to 3.x (fixes CVE-2026-32686 — unbounded exponent DoS)

Breaking Changes:

  • Minimum supported Elixir version is now 1.16 (last security-patched release)
  • Minimum supported OTP is now 25

CI:

  • Update runners to ubuntu-24.04 and windows-2025
  • Test all 5 security-patched Elixir versions (1.16–1.20)
  • Update OTP matrix to 25, 26, 27 with compatibility excludes

Fix compilation warnings introduced in Elixir 1.20:
- Add pin operator (^) to bitstring size() patterns in parser and encoder
- Remove redundant number_exp_digits(<<>>, skip) clause
- Move preferred_cli_env to def cli with preferred_envs (deprecated in 1.19)
- Replace xref: [exclude: ...] with elixirc_options: [no_warn_undefined: ...]

Upgrade decimal from 2.x to 3.x (fixes CVE-2026-32686):
- Bump decimal dependency to ~> 3.0
- Update test to use Decimal.parse/2 with unbounded limits for large exponents
- Downgrade jason from 1.5.0-alpha to 1.4 (supports decimal 3.x)

Update CI and minimum supported versions:
- Bump minimum Elixir from 1.12 to 1.16 (last security-patched release)
- Update runners to ubuntu-24.04 and windows-2025
- Test all 5 security-patched Elixir versions (1.16-1.20)
- Update OTP matrix to 25, 26, 27 with compatibility excludes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant