Unsafe dependency

[abdelaz3r]

Hi,

One of the dependency is not safe according to mix deps.audit. Here is the full output of the command :

Name: sweet_xml
Version: 0.6.6
Lockfile: /home/runner/work/app/app/mix.lock
CVE: 2019-15160
URL: https://github.com/kbrw/sweet_xml/issues/71
Title: Inline DTD allows XML bomb attack
Patched versions: >= 0.7.0

Vulnerabilities found!

Would it be possible to update that dependency and create a current release ?

[szymon-jez]

The dependency is now in line with Patched versions: >= 0.7.0 on develop.
https://github.com/socialpaymentsbv/ex_phone_number/blob/acf3c36090bb3d07b39b95cc4abf8f6d44e75d30/mix.lock#L23

master still has 0.6 so the solution could be to port 86a253c to master as releasing current develop is not possible because it is in a WIP state (see #43).

Help in doing the port (PR) is welcome.