Possible fix(deps): 3 vulnerable dependencies in mix.lock

[begininvoke]

This might be a false positive, but mix.lock around line 20 looked worth a second pair of eyes.

CVE-2026-48862 is a HIGH severity resource exhaustion vulnerability in the mint Elixir HTTP/2 client library. Due to missing concurrency validation on incoming PUSH_PROMISE frames, a malicious HTTP/2 server can flood the connection with promised streams while withholding matching HEADERS. This bypasses stream limits, causing unbounded memory allocation in conn.streams and ultimately triggering client-side Out-Of-Memory crashes (Denial of Service). Immediate patching or mitigation is required.

Something like this might fix it:

<<PATCH_START>>
--- a/mix.exs
+++ b/mix.exs
@@ -12,7 +12,7 @@ defp deps do
   [
-    {:mint, ">= 0.2.0 and < 1.9.0"},
+    {:mint, "~> 1.9"},
     # other dependencies...
   ]
 end
<<PATCH_END>>

Apply via CLI: mix deps.get && mix deps.update mint

⚡ Temporary Runtime Mitigation (if upgrade is delayed):
Disable HTTP/2 server push during client initialization to halt PUSH_PROMISE processing:
Mint.HTTP2.connect(host, port, http2: [enable_push: false])

For reference: rule CVE-2026-48862. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.