Problem
tenant 2.0.0 pins {:decimal, "~> 2.0"} (see mix.exs), which prevents downstream apps from upgrading to decimal 3.x.
decimal 2.x is affected by GHSA-rhv4-8758-jx7v / CVE-2026-32686, fixed in decimal 3.0.0. As long as tenant keeps the ~> 2.0 requirement, every application that has tenant in its dependency tree (directly or transitively) must add a manual override: true on :decimal to pull in the patched version.
Repro
# mix.exs
defp deps do
[
{:tenant, "~> 2.0"},
{:decimal, "~> 3.0"}
]
endmix deps.get fails because tenant requires decimal ~> 2.0.
Requested change
Relax the requirement to {:decimal, "~> 2.0 or ~> 3.0"} (or just ~> 3.0 if 2.x support can be dropped) and cut a new release.
Decimal 3.0 is backward-compatible for the API surface tenant uses (I see no direct Decimal calls outside the dep declaration), so no code changes should be required.
Problem
tenant2.0.0 pins{:decimal, "~> 2.0"}(seemix.exs), which prevents downstream apps from upgrading todecimal3.x.decimal2.x is affected by GHSA-rhv4-8758-jx7v / CVE-2026-32686, fixed indecimal3.0.0. As long astenantkeeps the~> 2.0requirement, every application that hastenantin its dependency tree (directly or transitively) must add a manualoverride: trueon:decimalto pull in the patched version.Repro
mix deps.get fails because
tenantrequiresdecimal~> 2.0.Requested change
Relax the requirement to
{:decimal, "~> 2.0 or ~> 3.0"}(or just ~> 3.0 if 2.x support can be dropped) and cut a new release.Decimal 3.0 is backward-compatible for the API surface tenant uses (I see no direct Decimal calls outside the dep declaration), so no code changes should be required.