Provenance Record

Clear, well-structured News piece (661 words, within the 400-1200 range). Overview, one section per CVE, and a What We Don't Know section. Technical detail is precise and appropriate for Elixir and Phoenix operators. Title is 137 characters (under 150) and makes no claim beyond the sources: two DoS CVEs (URI.parse, JSON.decode) fixed in 1.20.5, 1.19.7 and 1.18.6, with a third (Mix deps.partition) fixed only in 1.20.5.

All 7 snapshots read from disk (gunzip, HTML/JSON text extraction), none with suspicious_patterns (all null) and all status 200, no archive fallback. source-0 (GitHub v1.20.5 release): published 29 Oct 19:51, datetime 2026-10-29T19:51:12Z (matches the article); Security section lists exactly three entries: '[URI] Bind port limits during URI.parse (CVE-2026-109821)', '[JSON] Raise when decoding integers in JSON beyond float64 ranges (CVE-2026-115274)', '[mix deps.partition] Validate deps.partition configuration with checksum on multi-user systems (CVE-2026-97209)'. CONFIRMED. source-1 (v1.19.7, 29 Oct 20:20Z) and source-2 (v1.18.6, 29 Oct 20:30Z): Security section lists only the URI and JSON entries; no deps.partition entry. CONFIRMED; the October 29 date holds for all three releases (UTC). source-3 (CVE-2026-109821 JSON): port up to 1,262,592 digits, quadratic rendering on OTP 27/28/29.0, 400,000-digit port about 2.6 s and 1 MB about 18 s, under a second on OTP 29.1+, affected 0.5.0 before 1.18.6 / 1.19.0-rc.0 before 1.19.7 / 1.20.0-rc.0 before 1.20.5, CVSS 4.0 base 6.3 MEDIUM, workaround (reject long URLs, reject port above 65535, URI.new/1 not affected on OTP 27.3.4.17, 28.5.0.6, 29.0.6 and later). All CONFIRMED. source-4 (CVE-2026-115274): binary_to_integer without bound, 1M-digit literal costs 100-300x CPU, about a second per few-MB body, SystemLimitError above about 1.29M digits, phx.new Plug.Parsers statement, ranges from 1.18.0-rc.0/1.19.0-rc.0/1.20.0-rc.0, CVSS 4.0 6.9 MEDIUM, SafeJSON workaround with 1024-byte limit and json_decoder. All CONFIRMED. source-5 (CVE-2026-97209): insecure temp file in fixed-name directory under the shared system temp dir, File.mkdir_p, affects mix from 1.20.0-rc.4 before 1.20.5 only (1.19/1.18 not listed), CVSS 4.0 5.4 MEDIUM with AV:L, off by default / MIX_OS_DEPS_COMPILE_PARTITION_COUNT above one, Linux shared tmp default when TMPDIR unset, macOS/Windows not affected unless TMPDIR shared, workaround TMPDIR mode 0700 or leave partitioning disabled. All CONFIRMED. source-6 (Erlang/OTP GHSA-8qw4-2chm-mvj2): title 'stdlib: Denial-of-Service enabled by Unbounded Integer Conversion', Moderate 6.9, patched OTP 29.0.6, 28.5.0.6, 27.3.4.17, names uri_string:parse/1 (URL port component has no digit bound), and the page contains CVE-2026-59696. CONFIRMED. The CVE-2026-109821 record itself links this GHSA as 'Erlang/OTP advisory for the same issue in uri_string', so the article's 'related advisory' framing is supported. All four CVE ids verified. Minor imprecision: 'three supported branches' (the word supported) is not stated in any source; harmless characterization, not a factual claim from a source, no correction warranted. Source independence: no source is independent of the Elixir project (3 GitHub release pages and 3 CVE records authored by the Erlang Ecosystem Foundation CNA from the project's advisories, plus one Erlang/OTP GHSA, which is a separate project but closely related). The News policy requires 3-5 sources and does not require independence (that requirement applies to Analysis only); primary-source reporting of a security release is acceptable for News, and the article is transparent about it in its What We Don't Know section. Severity ratings are attributed to the CVE records ('the record lists', 'publisher-side assessment').

Every version, date, CVE id, number, CVSS score and workaround traces to a snapshot. Mix deps.partition correctly stated as fixed only in 1.20.5. No direct quotations beyond the OTP advisory title, which is verbatim. No fabricated specifics found. Source URLs in the body all appear in article.sources and vice versa.

Accurate, well-sourced and carefully attributed security-release coverage; every claim verified against the raw snapshots. Featured candidacy: 1 - accurate security-release coverage for Elixir and Phoenix operators, medium-severity fixes, narrow audience