MixAudit relies on the GitHub Advisory DB. It is unfortunately often a few days out of date. In this case as well.
We’re however working on integrating this directly as warnings in deps.get and hex.audit. (Currently only checks for retirement status; You can already see the vulnerabilities on hex.pm package pages).
The data there relies on OSV.dev and therefore directly contains EEF CNA, GHSA and other reporters, see OSV - Open Source Vulnerabilities
