[williamthome]

Description

arizona_nova now serves Arizona on Nova's own listener through arizona_cowboy's mounted mode (arizona-framework/arizona_cowboy#3): it mounts the routes in its env on Nova's bootstrap listener when it starts and drains Arizona's sessions when it stops, and arizona_nova:middlewares/0,1 puts arizona_cowboy_middleware in front of Nova's chain. Every Arizona route kind (pages, the live WebSocket, controllers, assets, MCP, dev reload) is served by the conformance-tested adapter, and anything else reaches Nova untouched; the hand-written page, WebSocket, static and reload modules are gone, and CI moves to OTP 29.

• I have performed a self-review of my changes
• I have read and understood the contributing guidelines

[github-actions]

🟢 Code Coverage — 94.1%

16 of 17 lines covered.

---

ℹ️ 46 OTP CVEs auto-ignored (already fixed in running version)

These CVEs are patched in the installed OTP version but NVD data
has not been updated to reflect this. They are excluded from the
scan via an auto-generated .trivyignore.

CVE	Details
CVE-2026-105236	Fixed in 29.1.2, running 29.1.2 — TLS-1.2 Session Resumption May Cross SNI Virtual-Host Certificate Boundaries
CVE-2026-96596	Fixed in 29.1.2, running 29.1.2 — erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
CVE-2026-94200	Fixed in 29.1.2, running 29.1.2 — TLS Client Ticket Store Poisoned by Malicious Server
CVE-2026-89422	Fixed in 29.1.1, running 29.1.2 — TLS 1.3 Client Skips Server Authentication on Unsolicited PSK
CVE-2026-68956	Fixed in 29.1.1, running 29.1.2 — SSH Session Channel Exhaustion — Unbounded Idle Channel Allocation Bypasses max_channels
CVE-2026-70399	Fixed in 29.0.6, running 29.1.2 — Denial of Service via Unenforced Default max_clients Limit in httpd
CVE-2026-74835	Fixed in 29.0.6, running 29.1.2 — Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception in httpd
CVE-2026-69664	Fixed in 29.0.6, running 29.1.2 — Denial of Service via Malformed Chunk Size in httpd
CVE-2026-70405	Fixed in 29.1.2, running 29.1.2 — snmp: Denial-of-Service enabled by Unbounded Integer Conversion
CVE-2026-70409	Fixed in 29.0.6, running 29.1.2 — eldap: Denial-of-Service enabled by Unbounded Integer Conversion
CVE-2026-71562	Fixed in 29.0.6, running 29.1.2 — inets: Denial-of-Service enabled by Unbounded Integer Conversion
CVE-2026-75538	Fixed in 29.0.6, running 29.1.2 — A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
CVE-2026-66835	Fixed in 29.0.6, running 29.1.2 — Possible directory protection bypass in Erlang-OTP inets httpd
CVE-2026-73270	Fixed in 29.0.6, running 29.1.2 — Authentication Bypass via Case-Insensitive Filesystem Path Matching in httpd mod_auth
CVE-2026-71380	Fixed in 29.0.6, running 29.1.2 — Denial of Service via Body-Read Timeout Gap in httpd (Slowloris Variant)
CVE-2026-73276	Fixed in 29.0.6, running 29.1.2 — HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping in httpd
CVE-2026-66357	Fixed in 29.0.6, running 29.1.2 — HTTP Request Smuggling via obs-fold Header Continuation in httpd
CVE-2026-73812	Fixed in 29.0.6, running 29.1.2 — HTTP Request Smuggling via Transfer-Encoding and Content-Length in httpd
CVE-2026-74994	Fixed in 29.0.6, running 29.1.2 — Authentication Bypass via Directory Namespace Collapse in httpd mod_auth (dets/mnesia backends)
CVE-2026-65634	Fixed in 29.1.1, running 29.1.2 — Superlinear CPU Denial-of-Service in OID Decoder via Large Base-128 Arc
CVE-2026-54890	Fixed in 29.0.4, running 29.1.2 — binary_to_term crash on crafted BIT_BINARY_EXT input
CVE-2026-59251	Fixed in 29.0.4, running 29.1.2 — Denial of Service via Exponential Certificate Policy Tree Growth
CVE-2026-58227	Fixed in 29.0.4, running 29.1.2 — TLS Denial-of-Service using Invalid Cert Chains
CVE-2026-59250	Fixed in 29.0.4, running 29.1.2 — Megaco Flex Scanner Buffer Overflow via Oversized Property Parm Name
CVE-2026-55953	Fixed in 29.0.4, running 29.1.2 — (D)TLS-1.2 Server Cert Verification Bypass via Unoffered Anonymous Cipher Suite
CVE-2026-55952	Fixed in 29.0.3, running 29.1.2 — Denial-of-Service for TLS-1.3 server Using Session Tickets
CVE-2026-55951	Fixed in 29.0.6, running 29.1.2 — httpc Memory Exhaustion via Unbounded Header Accumulation
CVE-2026-55950	Fixed in 29.0.3, running 29.1.2 — DTLS Denial of Service
CVE-2026-54891	Fixed in 29.0.3, running 29.1.2 — Plaintext Injection Towards (D)TLS Client During Handshake
CVE-2026-59696	Fixed in 29.0.6, running 29.1.2 — stdlib: Denial-of-Service enabled by Unbounded Integer Conversion
CVE-2026-54886	Fixed in 29.0.3, running 29.1.2 — SSH SFTP server denial of service via extended data infinite loop
CVE-2026-54887	Fixed in 29.0.3, running 29.1.2 — DTLS Cookie Bypass During Startup
CVE-2026-55737	Fixed in 29.0.4, running 29.1.2 — Heap Pointer Corruption via signed/unsigned Mismatch in LARGE_TUPLE_EXT Decoding (binary_to_term/1)
CVE-2026-53422	Fixed in 29.0.3, running 29.1.2 — OTP ssh_sftpd REALPATH Path Existence Oracle ( File system Enumeration )
CVE-2026-49760	Fixed in 29.0.2, running 29.1.2 — Stack Buffer Overflow in ei_s_print_term at Very Large Integer
CVE-2026-49759	Fixed in 29.0.2, running 29.1.2 — Unbounded Stack Buffer Overflow in SCTP Error Cause Parsing in inet_drv
CVE-2026-48858	Fixed in 29.0.2, running 29.1.2 — FTP Client PASV Response IP not Validated Against Control Peer, Enabling SSRF and FTP Bounce Attacks
CVE-2026-48860	Fixed in 29.0.2, running 29.1.2 — Distribution-over-TLS LAN Allowlist is Silently Bypassed
CVE-2026-48856	Fixed in 29.1.2, running 29.1.2 — httpc leaks Authorization header to cross-origin redirect targets
CVE-2026-48855	Fixed in 29.0.2, running 29.1.2 — SFTP READLINK response leaks absolute backend filesystem path when root is configured
CVE-2026-48859	Fixed in 29.0.2, running 29.1.2 — SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration
CVE-2026-47078	Fixed in 29.0.4, running 29.1.2 — Relative path traversal in zip:unzip via check_dir_level depth-counter bypass
CVE-2026-42792	Fixed in 29.0.4, running 29.1.2 — epmd: Denial-of-service via accept(EMFILE)
CVE-2026-42790	Fixed in 29.0.1, running 29.1.2 — Name Constraints and Subject CommonName Fallback in TLS hostname Verification
CVE-2026-42789	Fixed in 29.1.2, running 29.1.2 — public_key Accepts non-CA Certificate as Intermediate Issuer, Enabling Chain Forgery
CVE-2026-42791	Fixed in 29.0.1, running 29.1.2 — OCSP Responder Certificate Accepted After Expiry in public_key