GitHub Advisory Database now supports Erlang and Elixir packages!
We’re excited to announce that the GitHub Advisory Database now includes curated security advisories on Erlang, Elixir, and more.
![](https://github.blog/wp-content/uploads/2022/04/Security-Product@2x-1.png?resize=1600%2C850)
GitHub is on a mission to create a more secure supply chain for all developers and organizations. To do that, we need to empower all developer communities with comprehensive vulnerability information and seamless remediation guidance.
That’s why we’re excited to announce that the GitHub Advisory Database now includes curated security advisories for languages compiled to run on the BEAM virtual machine, including Elixir and Erlang. Elixir is a dynamic, functional language for building scalable and maintainable applications and is great at controlling vast amounts of infrastructure. Erlang is a general-purpose programming language and runtime environment that favors building scalable and concurrent systems. These languages, as well as others compiled to run on the BEAM virtual machine, are managed by the Hex package registry.
The addition of the Erlang ecosystem expands our GitHub Advisory Database coverage to nine supported ecosystems: Composer (PHP), Go, Maven (Java), npm (JavaScript), NuGet (.NET), pip (Python), RubyGems (Ruby), Rust, and now Erlang (Hex). This new coverage ensures that any member of the Erlang and Elixir community can check for security issues in the same place that their code resides—on GitHub.
Advisories
GitHub believes that free and open security data is critical to empowering the industry as a whole to best secure our software supply chains. To support this mission, GitHub’s Advisory Database is an open source database of security advisories focused on high-quality, actionable vulnerability information for developers. It’s licensed under Creative Commons Attribution 4.0, so the data can be used anywhere and is forever free!
Contributing to Erlang advisories
We are also accepting community contributions on Hex packages now that the Advisory Database supports this ecosystem! Security researchers, academics, and enthusiasts can provide additional relevant information to further the community’s understanding and awareness of these security advisories. Contributors can submit their edits following our community guidelines.
Learn more
Jump in, and explore Erlang advisories today, or learn more about our other supply chain security features as follows:
- The GitHub Advisory Database
- GitHub Security Advisories
- Dependency graph
- Dependabot alerts
- Dependabot security updates
Tags:
Written by
Related posts
![](https://github.blog/wp-content/uploads/2024/01/Security-DarkMode-3-1.png?resize=400%2C212)
From object transition to RCE in the Chrome renderer
In this post, I’ll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
![](https://github.blog/wp-content/uploads/2023/11/Security-LightMode-4.png?resize=400%2C212)
Configure GitHub Artifact Attestations for secure cloud-native delivery
Introducing the generally available capability of GitHub Artifact Attestations to secure your cloud-native supply chain packages and images.
![](https://github.blog/wp-content/uploads/2023/12/Security-DarkMode-1-2.png?resize=400%2C212)
3 ways to get Remote Code Execution in Kafka UI
In this blog post, we’ll explain how we discovered three critical vulnerabilities in Kafka UI and how they can be exploited.