I am using mix hex.audit to make my CI pipeline red when I am using packages that are retired or have CVEs.
Today I encoutered an issue where cowlib package in its newest version 2.17.1 has low severity CVEs Security Advisories for cowlib | Hex
I don’t really want to make this check optional. If it is red for longer period of time, I will stop noticing new reports. What I would like is an allowlist mechanism where I can have an .hex_audit_ignore file where I can comment that I am aware of this low severity stuff and I am choosing to wait for the new version.
I know there is mix_audit. This one has a config. However, to run a mix task from a dependency, I need to compile that dep first. If a package was compromised, it is too late. mix hex.audit docs say to run it before any compilation.
I can also run mix_audit as an escript, but then it doesn’t read the config.
How do you deal with audits in CI? Do you work around it? Would you like to have an allowlist/ignorelist for mix hex.audit task?
