Jonatan Männchen / EEF

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Ash.Reactor change step fails open, skipping a change when its where guard raises

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Route handler return value echoed into AshTypescript error response

Declared argument constraints not enforced on AshTypescript typed controller routes