CVE-2026-82740: Ash Nested Array Missing Outer Constraints

`apply_constraints` for doubly-nested arrays delegates directly to `map_while_ok` without validating outer array constraints (such as min_length, max_length, or nil_items?) or verifying that the outer term is a list.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Elixir
greprules fetch cve-2026-82740-ash-nested-array-missing-outer-constraints --engine opengrep

Description

`apply_constraints` for doubly-nested arrays delegates directly to `map_while_ok` without validating outer array constraints (such as min_length, max_length, or nil_items?) or verifying that the outer term is a list.