`mix deps.get` when violating policy but already installed.
Open
Nobody has claimed this yet.
- Dominant language
- Elixir
- Stars
- 1.1k
- Forks
- 211
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 7
Description
- Add
{:cowlib, "~> 2.17"}dependency HEX_POLICY="" mix deps.get- Installs, warning, exit 0HEX_POLICY="hexpm:erlefsecuritywg/strict" mix deps.get- Shows Policy Breakdown, Warning, exit 0
I believe we should have an exit 1 no matter if a dependency is locked already if it violates a policy.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with the cowlib dependency using both HEX_POLICY values and mix deps.get. Trace the policy-checking path used by the command, then verify that a locked dependency violating the policy exits with status 1 while the policy breakdown and warning remain available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elixir
- Domain
- cli, devtools
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100