gleam-lang/gleam
Warn when a vulnerable package version is added as a dependency
开放
#5,725 创建于 2026年5月18日
help wanted
仓库指标
- 星标
- (21,417 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
Hex now contains information on CVEs that we can use to display warnings when used. Let's use this information to display a warning when a newly resolved version of a dependency is vulnerable.
We could also have a command for showing vulnerabilities for the current package versions.
Reference implementation for Elixir: https://github.com/hexpm/hex/pull/1150