Bump toolchain to Elixir 1.18.5-otp-27, fix critical grpc RCE and other pre-existing CVEs

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: elixir:1.13.3-slim
+      image: elixir:1.18.4-otp-27-slim
 
     services:
       redis: redis:alpine
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: elixir:1.13.3-slim
+      image: elixir:1.18.4-otp-27-slim
 
     steps:
       - name: Checkout
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: elixir:1.13.3-slim
+      image: elixir:1.18.4-otp-27-slim
 
     steps:
       - name: Checkout

.tool-versions

@@ -1,3 +1,3 @@
-elixir 1.14.3-otp-25
-erlang 25.3.2.16
+elixir 1.18.5-otp-27
+erlang 27.3.4.17
 nodejs 14.20.1

Dockerfile

@@ -1,7 +1,7 @@
 # -----------------------------------------------
 # 1) Build Elixir
 # -----------------------------------------------
-FROM elixir:1.13.3-slim as build-elixir
+FROM elixir:1.18.4-otp-27-slim as build-elixir
 
 # ARG is available during the build and not in the final container
 # https://vsupalov.com/docker-arg-vs-env/

config/config.exs

@@ -29,10 +29,6 @@ config :logger, :console,
 
 config :grpc, start_server: true
 
-config :logger_json, :backend,
-  formatter: LoggerJSON.Formatters.DatadogLogger,
-  metadata: :all
-
 config :phoenix, :json_library, Jason
 
 config :recognizer, :message_queues, []

config/prod.exs

@@ -8,8 +8,8 @@ config :recognizer, RecognizerWeb.Endpoint,
   server: true
 
 config :logger,
-  backends: [LoggerJSON],
-  level: :info
+  level: :info,
+  default_handler: [formatter: {LoggerJSON.Formatters.Datadog, metadata: :all}]
 
 config :recognizer, Recognizer.Repo, log: false
 

config/test.exs

@@ -20,7 +20,7 @@ config :recognizer, RecognizerWeb.Endpoint,
   http: [port: 4002],
   server: false
 
-config :logger, level: :warn
+config :logger, level: :warning
 
 config :hammer,
   backend:

lib/recognizer/bigcommerce/client.ex

@@ -206,7 +206,7 @@ defmodule Recognizer.BigCommerce.Client do
         {_, retry_value} -> String.to_integer(retry_value)
       end
 
-    Logger.warn("Rate limited, sleeping for ms: #{inspect(retry_ms)}")
+    Logger.warning("Rate limited, sleeping for ms: #{inspect(retry_ms)}")
     Process.sleep(retry_ms)
   end
 end

lib/recognizer/caster.ex

@@ -6,7 +6,7 @@ defmodule Recognizer.Caster do
   alias Bottle.Account.V1, as: Account
 
   def cast(user) do
-    Account.User.new(
+    struct!(Account.User,
       account_type: convert_user_type(user.type),
       company_name: user.company_name,
       email: user.email,

lib/recognizer/hal.ex

@@ -63,7 +63,7 @@ defmodule Recognizer.Hal do
         {:ok, body}
 
       {:error, _reason} when retry_count > 0 ->
-        Logger.warn("Retrying fetch for #{context_msg}, attempts left: #{retry_count - 1}")
+        Logger.warning("Retrying fetch for #{context_msg}, attempts left: #{retry_count - 1}")
         Process.sleep(retry_delay)
         fetch_data_with_retry(url, context_msg, email_for_log, retry_count - 1, retry_delay * 2)
 
@@ -163,7 +163,10 @@ defmodule Recognizer.Hal do
 
       {:ok, %HTTPoison.Response{status_code: status_code, body: _error_body}}
       when retry_count > 0 and status_code >= 500 ->
-        Logger.warn("Newsletter update failed with status #{status_code}, retrying. Attempts left: #{retry_count - 1}")
+        Logger.warning(
+          "Newsletter update failed with status #{status_code}, retrying. Attempts left: #{retry_count - 1}"
+        )
+
         Process.sleep(retry_delay)
         post_newsletter_with_retry(post_url, payload, email_address, retry_count - 1, retry_delay * 2)
 
@@ -175,7 +178,7 @@ defmodule Recognizer.Hal do
         {:error, {:http_post_error, status_code}}
 
       {:error, %HTTPoison.Error{reason: _reason}} when retry_count > 0 ->
-        Logger.warn("HTTP error while posting newsletter update, retrying. Attempts left: #{retry_count - 1}")
+        Logger.warning("HTTP error while posting newsletter update, retrying. Attempts left: #{retry_count - 1}")
         Process.sleep(retry_delay)
         post_newsletter_with_retry(post_url, payload, email_address, retry_count - 1, retry_delay * 2)
 

lib/recognizer/notifications/account.ex

@@ -96,7 +96,7 @@ defmodule Recognizer.Notifications.Account do
   end
 
   defp create_message(user, type, args \\ []) do
-    apply(type, :new, [Keyword.merge([user: user], args)])
+    struct!(type, Keyword.merge([user: user], args))
   end
 
   if Application.compile_env(:ex_aws, :enabled) do

lib/recognizer_web.ex

@@ -19,7 +19,9 @@ defmodule RecognizerWeb do
 
   def controller do
     quote do
-      use Phoenix.Controller, namespace: RecognizerWeb
+      use Phoenix.Controller, formats: [html: "View", json: "View"]
+
+      plug :put_new_layout, {RecognizerWeb.LayoutView, :app}
 
       import Plug.Conn
       import RecognizerWeb.Gettext

lib/recognizer_web/controllers/accounts/api/user_settings_two_factor_controller.ex

@@ -94,11 +94,6 @@ defmodule RecognizerWeb.Accounts.Api.UserSettingsTwoFactorController do
           conn
           |> put_status(202)
           |> render("show.json", settings: settings, user: user)
-
-        {:error, reason} ->
-          conn
-          |> put_status(400)
-          |> json(%{error: reason})
       end
     end
   end

lib/recognizer_web/controllers/fallback_controller.ex

@@ -57,14 +57,6 @@ defmodule RecognizerWeb.FallbackController do
     |> render("500.html")
   end
 
-  defp respond(conn, :not_found, _template) do
-    if Application.get_env(:recognizer, :redirect_url) do
-      redirect(conn, external: Application.get_env(:recognizer, :redirect_url))
-    else
-      redirect(conn, to: Routes.homepage_path(conn, :index))
-    end
-  end
-
   defp respond(conn, type, template) do
     extension = if json?(conn), do: "json", else: "html"
 

lib/recognizer_web/endpoint.ex

@@ -30,9 +30,6 @@ defmodule RecognizerWeb.Endpoint do
   plug Bottle.RequestIdPlug
   plug Plug.Telemetry, event_prefix: [:phoenix, :endpoint]
 
-  plug LoggerJSON.Plug,
-    metadata_formatter: LoggerJSON.Plug.MetadataFormatters.DatadogLogger
-
   plug Plug.Parsers,
     parsers: [:urlencoded, :multipart, :json],
     pass: ["*/*"],

lib/recognizer_web/telemetry.ex

@@ -27,6 +27,14 @@ defmodule RecognizerWeb.Telemetry do
         :debug
       )
 
+    :ok =
+      :telemetry.attach(
+        "logger-json-requests",
+        [:phoenix, :endpoint, :stop],
+        &LoggerJSON.Plug.telemetry_logging_handler/4,
+        :info
+      )
+
     :ok =
       :telemetry.attach(
         "spandex-query-tracer-repo_name",

mix.exs

@@ -11,7 +11,8 @@ defmodule Recognizer.MixProject do
       start_permanent: Mix.env() == :prod,
       aliases: aliases(),
       deps: deps(),
-      releases: releases()
+      releases: releases(),
+      listeners: [Phoenix.CodeReloader]
     ]
   end
 
@@ -34,10 +35,10 @@ defmodule Recognizer.MixProject do
   defp deps do
     [
       {:argon2_elixir, "~> 2.0"},
-      {:bottle, github: "system76/bottle", ref: "1a49e7bc7d8f7bf556c5780b70e9eb60a06a8ca7"},
+      {:bottle, github: "system76/bottle", ref: "f50cfdb59132ffcbf667a818cf2dd5ecef93d746"},
       {:cors_plug, "~> 2.0"},
-      {:cowboy, "~> 2.8", override: true},
-      {:cowlib, "~> 2.9.1", override: true},
+      {:cowboy, "~> 2.19", override: true},
+      {:cowlib, "~> 2.20", override: true},
       {:credo, "~> 1.5", only: [:dev, :test], runtime: false},
       {:decorator, "~> 1.2"},
       {:ecto_enum, "~> 1.4"},
@@ -48,28 +49,31 @@ defmodule Recognizer.MixProject do
       {:ex_aws, "~> 2.0"},
       {:ex_oauth2_provider, "~> 0.5.6"},
       {:gettext, "~> 0.18"},
-      {:guardian, "~> 2.0"},
+      {:guardian, "~> 2.5"},
       {:guardian_db, "~> 2.1"},
+      # ex_aws_sqs's hackney dep is optional and unused (we configure HTTPoison as the ex_aws
+      # http_client); override so its stale ~> 1.9 pin doesn't block httpoison's real ~> 4.0 need
+      {:hackney, "~> 4.0", override: true},
       {:hammer, "~> 6.0"},
       {:hammer_backend_redis, "~> 6.1"},
       {:hammer_plug, "~> 3.0"},
-      {:httpoison, "~> 1.8.2"},
+      {:httpoison, "~> 3.0"},
       {:jason, "~> 1.0"},
-      {:joken, "~> 2.6.0"},
-      {:logger_json, github: "Nebo15/logger_json", ref: "8e4290a"},
+      {:joken, "~> 2.7"},
+      {:logger_json, "~> 7.0"},
       {:myxql, ">= 0.0.0"},
       {:redix, ">= 0.0.0"},
       {:phoenix_ecto, "~> 4.1"},
       {:phoenix_html, "~> 4.1"},
       {:phoenix_live_reload, "~> 1.2", only: :dev},
       {:phoenix_html_helpers, "~> 1.0.1"},
       {:phoenix_view, "~> 2.0.3"},
-      {:phoenix, "~> 1.7.1"},
-      {:plug_cowboy, "~> 2.4"},
+      {:phoenix, "~> 1.8"},
+      {:plug_cowboy, "~> 2.9"},
       {:pot, "~> 1.0.2"},
       {:saxy, "~> 1.1"},
-      {:spandex, "~> 3.0.3"},
-      {:spandex_datadog, "~> 1.1.0"},
+      {:spandex, "~> 3.2"},
+      {:spandex_datadog, "~> 1.4.0"},
       {:spandex_ecto, "~> 0.6.2"},
       {:spandex_phoenix, "~> 1.0.5"},
       {:telemetry_metrics, "~> 0.4"},