Make Cowboy optional and verify Bandit consumer streams

sean commented

2026-09-11 18:05:52 +00:00

Owner

Based on upstream v1.3.0. Make Plug.Cowboy optional and return a clear error when a standalone Cowboy listener is requested without it. Remove upstream advisory exceptions. Add request-stream keepalives so silent HTTP/1 disconnects stop workers.

Validation: red consumer dependency test before patch; none/Bandit/Cowboy consumer contracts pass; no-server and Bandit releases contain no Cowboy/Cowlib/Ranch and pass audit without exceptions; HTTP/1.1 and TLS HTTP/2 JSON, streaming, subscriptions, disconnect cleanup, and 2025 session calls pass for both servers. Existing unit suite: 3460 passed, 804 excluded. Targeted transport integration: 114 passed. Changed files pass formatting and compilation with warnings as errors.

Known upstream issue: full format check reports unchanged test/ex_mcp/acp/adapters/codex_test.exs under Elixir 1.20.3. The upstream development/test lock retains Cowlib advisories; those are not hidden or used as the deployment consumer audit. Forgejo consumer workflow requires a runner. See FORK.md for maintenance and compatibility limits.

Based on upstream v1.3.0. Make Plug.Cowboy optional and return a clear error when a standalone Cowboy listener is requested without it. Remove upstream advisory exceptions. Add request-stream keepalives so silent HTTP/1 disconnects stop workers. Validation: red consumer dependency test before patch; none/Bandit/Cowboy consumer contracts pass; no-server and Bandit releases contain no Cowboy/Cowlib/Ranch and pass audit without exceptions; HTTP/1.1 and TLS HTTP/2 JSON, streaming, subscriptions, disconnect cleanup, and 2025 session calls pass for both servers. Existing unit suite: 3460 passed, 804 excluded. Targeted transport integration: 114 passed. Changed files pass formatting and compilation with warnings as errors. Known upstream issue: full format check reports unchanged test/ex_mcp/acp/adapters/codex_test.exs under Elixir 1.20.3. The upstream development/test lock retains Cowlib advisories; those are not hidden or used as the deployment consumer audit. Forgejo consumer workflow requires a runner. See FORK.md for maintenance and compatibility limits.

sean added 1 commit

2026-09-11 18:05:52 +00:00

Make Cowboy optional and verify Bandit consumer streams 2bbb22baf3

sean referenced this pull request from sean/binjovi

2026-09-11 18:11:37 +00:00

Pin the tested ExMCP fork without enabling MCP #1599

sean closed this pull request

2026-09-12 22:58:59 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Rows
Columns

Make Cowboy optional and verify Bandit consumer streams #1

Pull request closed