Regarding SafetyNet: If it's passing or not depends on various factors. I'll write a more detailed post about it in the very near future (maybe this evening). In short: Magisk must be hidden and the manager name obfuscated. EdXposed needs to have "Pass SafetyNet" option on. Several Google services have to be excluded.
Basically it should work an all devices which have a close-to-stock Android system. Heavily altered systems (Samsung, Huawei, etc.) are known to be problematic, but it's not impossible to pass Safetynet.
Also, I'd personally avoid canary builds of Edxposed. They're bleeding-edge, including many "features" and fixes by diffent devs which gets often enough reverted by the main devs later. You'd really have to check the changelogs every day and are on a high risk of bootloops or broken things. Canary builds should only be used for testing things, never on a device which is your daily driver. Just as a reminder.
It's much safer to go with the "alpha" releases, or even the "stable" ones.
Catch you later friends, got to go to work now.