# alex 3.5.1.0

A lexical analyser generator for Haskell

Snapshot of gominimal/pkgs commit `cd4b09dd2f492c47fba70eb1b8a8c724dabdc7e9` (pushed 2026-07-10T23:16:55.000Z).

## Install

```sh
min add alex
```

## Direct advisories

None at this commit.

## Transitive advisories

10 advisories inherited through runtime dependencies:

- OSV-2023-505 (UNKNOWN) via base → file
- CVE-2026-41991 (MEDIUM) via base → gzip
- CVE-2026-41992 (HIGH) via base → gzip
- CVE-2026-4046 (HIGH) via gmp → glibc
- CVE-2026-4437 (HIGH) via gmp → glibc
- CVE-2026-4438 (MEDIUM) via gmp → glibc
- CVE-2026-5450 (CRITICAL) via gmp → glibc
- CVE-2026-5928 (HIGH) via gmp → glibc
- GHSA-q7rw-r7qq-2hx6 (UNKNOWN) via base → grep → pcre2
- OSV-2026-343 (HIGH) via base → grep → pcre2

## Dependencies

- Build (4): base, bash, ghc-bootstrap, toolchain
- Runtime (2): base, gmp

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 40 | low |
| advisories | 10 | low |
| quality | 16 | low |
| maintenance | 33 | low |
| licence | 100 | perfect |

## Links

- Homepage: https://hackage.haskell.org/package/alex
- Package page (HTML): https://minimal.dev/pkgs/alex
- JSON API (floats latest): https://minimal.dev/api/pkgs/alex.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/alex/sbom.json