`ash`

Ecosystem:
hex

Package URL:
pkg:hex/ash

Total PRs:
424 Dependabot PRs

Latest PR:
14 days ago

Unique Repositories:
46 repositories

Unique Repos (30 days):
3 repositories

Security Advisories

Before action hooks may execute in certain scenarios despite a request being forbidden

EEF-CVE-2025-48042 GHSA-jj4j-x5ww-cwh9 CVE-2025-48042 HIGH published 9 months ago • updated about 3 hours ago

## Summary Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This ...

Authorization bypass when bypass policy condition evaluates to true

EEF-CVE-2025-48044 GHSA-pcxq-fjp3-r752 CVE-2025-48044 HIGH published 8 months ago • updated about 3 hours ago

## Summary Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program fi...

Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization

EEF-CVE-2025-48043 GHSA-7r7f-9xpj-jmr7 CVE-2025-48043 HIGH published 8 months ago • updated about 3 hours ago

## Summary Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program fi...

Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

GHSA-jjf9-w5vj-r6vp CVE-2026-34593 HIGH published 3 months ago • updated 7 days ago

## Summary `Ash.Type.Module.cast_input/2` unconditionally creates a new Erlang atom via `Module.concat([value])` for any user-supplied binary stri...

Ash has authorization bypass when bypass policy condition evaluates to true

GHSA-pcxq-fjp3-r752 CVE-2025-48044 HIGH published 8 months ago • updated 15 days ago

### Summary Bypass policies incorrectly authorize requests when their condition evaluates to true but their authorization checks fail and no other ...

View all 7 advisories

Recent PRs (filtered by: Closed , Patch PRs )

RSS Feed Clear filter

chore(deps): bump ash from 3.5.8 to 3.5.42

jwstover/groupchat #83

3.5.8 → 3.5.42 Patch PR

Closed 9 months ago 1 comment

Bump ash from 3.5.34 to 3.5.42 in /server

orcasound/orcasite #960

3.5.34 → 3.5.42 Patch PR

Closed 9 months ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 25 updates

zebbra/data_aggregator #918

3.5.21 → 3.5.42 Patch PR

Closed 9 months ago 1 comment

chore(deps): bump ash from 3.5.8 to 3.5.40

jwstover/groupchat #81

3.5.8 → 3.5.40 Patch PR

Closed 9 months ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 24 updates

zebbra/data_aggregator #913

3.5.21 → 3.5.40 Patch PR

Closed 9 months ago 2 comments

chore(deps): bump the patch-updates group across 1 directory with 23 updates

zebbra/data_aggregator #912

3.5.21 → 3.5.39 Patch PR

Closed 9 months ago 1 comment

chore(deps): bump ash from 3.5.8 to 3.5.39

jwstover/groupchat #78

3.5.8 → 3.5.39 Patch PR

Closed 9 months ago 1 comment

Bump ash from 3.5.34 to 3.5.39 in /server

orcasound/orcasite #936

3.5.34 → 3.5.39 Patch PR

Closed 9 months ago 2 comments

chore(deps): bump the production-dependencies group across 1 directory with 2 updates

ash-project/opentelemetry_ash #48

3.5.31 → 3.5.37 Patch PR

Closed 10 months ago 1 comment

chore(deps): Bump the production-dependencies group with 5 updates

team-alembic/ash_authentication #1059

3.5.33 → 3.5.37 Patch PR

Closed 10 months ago 2 comments

chore(deps): bump the production-dependencies group across 1 directory with 2 updates

rtorresware/ash_postgres #3

3.5.35 → 3.5.37 Patch PR

Closed 10 months ago 1 comment

Bump ash from 3.5.34 to 3.5.36 in /server

orcasound/orcasite #913

3.5.34 → 3.5.36 Patch PR

Closed 10 months ago 2 comments

Bump the mix-dependencies group across 1 directory with 10 updates

raffomania/hot #25

3.5.32 → 3.5.36 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump ash from 3.5.26 to 3.5.36

ash-project/ash_mysql #257

3.5.26 → 3.5.36 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 22 updates

ash-project/ash_hq #324

3.5.22 → 3.5.34 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 23 updates

zebbra/data_aggregator #882

3.5.21 → 3.5.34 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 22 updates

zebbra/data_aggregator #881

3.5.21 → 3.5.34 Patch PR

Closed 10 months ago 2 comments

chore(deps): bump ash from 3.5.26 to 3.5.34

ash-project/ash_mysql #253

3.5.26 → 3.5.34 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump ash from 3.5.33 to 3.5.34 in the production-dependencies group

ChristianAlexander/ash_circuit_breaker #1

3.5.33 → 3.5.34 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 4 updates

ash-project/ash_phoenix #404

3.5.31 → 3.5.34 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 4 updates

ash-project/ash_json_api #372

3.5.31 → 3.5.33 Patch PR

Closed 10 months ago 1 comment

chore(deps): bump ash from 3.5.31 to 3.5.33 in the production-dependencies group

ash-project/opentelemetry_ash #46

3.5.31 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 3 updates

ash-project/ash_admin #353

3.5.31 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the production-dependencies group with 2 updates

ash-project/ash_postgres #603

3.5.32 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump ash from 3.5.31 to 3.5.33 in the production-dependencies group

ash-project/ash_double_entry #130

3.5.31 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the production-dependencies group with 2 updates

ash-project/ash_graphql #347

3.5.31 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the production-dependencies group with 2 updates

ash-project/ash_oban #182

3.5.31 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 18 updates

zebbra/data_aggregator #878

3.5.21 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump ash from 3.5.26 to 3.5.33

ash-project/ash_mysql #252

3.5.26 → 3.5.33 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the patch-updates group across 1 directory with 16 updates

zebbra/data_aggregator #877

3.5.21 → 3.5.33 Patch PR

Closed 11 months ago 2 comments

chore(deps): Bump the production-dependencies group across 1 directory with 3 updates

team-alembic/ash_authentication #1050

3.5.27 → 3.5.32 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the patch-updates group with 15 updates

zebbra/data_aggregator #874

3.5.21 → 3.5.32 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump ash from 3.5.26 to 3.5.32

ash-project/ash_mysql #249

3.5.26 → 3.5.32 Patch PR

Closed 11 months ago 1 comment

build(deps): bump ash from 3.5.26 to 3.5.31

ash-project/ash_slug #128

3.5.26 → 3.5.31 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 4 updates

team-alembic/ash_authentication_phoenix #651

3.5.26 → 3.5.31 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump ash from 3.5.26 to 3.5.28 in the production-dependencies group

ash-project/ash_archival #153

3.5.26 → 3.5.28 Patch PR

Closed 11 months ago 2 comments

chore(deps): bump ash from 3.5.26 to 3.5.27 in the production-dependencies group

ash-project/ash_admin #343

3.5.26 → 3.5.27 Patch PR

Closed 11 months ago 1 comment

Bump the mix-dependencies group across 1 directory with 10 updates

raffomania/hot #17

3.5.23 → 3.5.26 Patch PR

Closed 11 months ago 2 comments

chore(deps): bump ash from 3.5.25 to 3.5.26 in the production-dependencies group

ash-project/ash_ops #79

3.5.25 → 3.5.26 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump ash from 3.5.24 to 3.5.26

Thunderblok/thunderold1 #41

3.5.24 → 3.5.26 Patch PR

Closed 11 months ago 1 comment

Bump the mix-dependencies group across 1 directory with 9 updates

raffomania/hot #16

3.5.23 → 3.5.25 Patch PR

Closed 11 months ago 1 comment

chore(deps): bump ash from 3.5.24 to 3.5.25

Thunderblok/thunderold1 #38

3.5.24 → 3.5.25 Patch PR

Closed 12 months ago 1 comment

chore(deps): bump the production-dependencies group with 2 updates

ash-project/ash_admin #333

3.5.24 → 3.5.25 Patch PR

Closed 12 months ago 1 comment

chore(deps): bump the production-dependencies group with 3 updates

ash-project/ash_postgres #581

3.5.24 → 3.5.25 Patch PR

Closed 12 months ago 1 comment

build(deps): bump the production-dependencies group across 1 directory with 3 updates

ash-project/ash_rate_limiter #27

3.5.23 → 3.5.24 Patch PR

Closed 12 months ago 1 comment

Bump ash from 3.5.6 to 3.5.24 in /server

orcasound/orcasite #861

3.5.6 → 3.5.24 Patch PR

Closed 12 months ago 2 comments

chore(deps): bump ash from 3.5.8 to 3.5.24

jwstover/groupchat #54

3.5.8 → 3.5.24 Patch PR

Closed 12 months ago 1 comment

chore(deps): bump the production-dependencies group with 10 updates

ash-project/ash_hq #313

3.5.22 → 3.5.24 Patch PR

Closed 12 months ago 1 comment

build(deps): bump the production-dependencies group with 2 updates

ash-project/ash_rate_limiter #25

3.5.23 → 3.5.24 Patch PR

Closed 12 months ago 1 comment

Bump ash from 3.5.6 to 3.5.23 in /server

orcasound/orcasite #850

3.5.6 → 3.5.23 Patch PR

Closed 12 months ago 2 comments

Package Details

Name:	`ash`
Ecosystem:	hex
PURL Type:	hex
Package URL:	`pkg:hex/ash`
JSON API:	View JSON

Security Advisories

7

Active advisories

HIGH 7

View All hex Advisories

Package Information

Description:

A declarative, extensible framework for building Elixir applications.

Repository:	https://github.com/ash-project/ash
Homepage:	https://github.com/ash-project/ash/blob/main/CHANGELOG.md
Latest Release:	`3.5.15` about 1 year ago
Dependent Repos:	24
Dependent Packages:	36
Downloads:	763,603
Ranking:	Top 3.5882% by dependent repos Top 5.9446% by downloads Top 1.6603% by dependent pkgs

PR Status

Open 124 (29.2%)

Merged 163 (38.4%)

Closed 108 (25.5%)

PR Types

Minor 42 (9.9%)

Patch 353 (83.3%)