CHANGELOG

View Source

v0.20.0 (2026-10-12)

  • Limit decompressed registry resources to the new registry_max_uncompressed_size config option, 16 MiB by default, and reject compressed Erlang terms in API responses (GHSA-7c4r-cgf9-9jmq, CVE-2026-105274).
  • Return {error, {cacerts_unavailable, Reason}} from hex_http_httpc for HTTPS requests on OTP 24 and when the OS CA certificates can't be loaded, instead of sending them without verifying the server certificate. Also verify the server certificate for URLs with an uppercase HTTPS scheme (GHSA-p26c-h8c2-rwqj, CVE-2026-103502).
  • Add Workload Identity. hex_cli_auth:workload_identity_auth/2 exchanges the OIDC token of a GitHub Actions job for API auth scoped to one package, and repository requests to Hex.pm organizations exchange it for a repository token when the build tool provides the new get_workload_identity_token and persist_workload_identity_token callbacks.
  • Add the hex_oidc module and hex_api_oauth:jwt_bearer_token/3 and hex_api_oauth:oidc_audience/1.
  • Report the organizations whose SSO or 2FA requirements the session has to complete through the optional organization_reauth callback. Add hex_cli_auth:refresh_tokens/1, hex_api_oauth:organization_authorization/2 and hex_api_oauth:organization_reauth_required/1.
  • Return {auth_error, token_refresh_unavailable} when a token refresh gets no usable response, and keep {auth_error, token_refresh_failed} for when the server refuses the refresh token.
  • Only use the global OAuth token for Hex.pm repositories.
  • Add the ADVISORY, RETIREMENT and COOLDOWN policy override actions and the advisory_id, retirement_reason and comment override fields.
  • Create identical package tarballs from identical files and metadata, independent of file order, umask, operating system and Unicode normalization of file names. Files can be given as {Name, ContentsOrPath, #{executable => boolean()}} to set their mode.
  • Compress package and docs tarballs with the new hex_deflate module, so their bytes and checksums don't depend on the zlib library the VM links.
  • Fix PAX record lengths for file names with non-ASCII characters, and file paths that need a 156 byte ustar prefix.
  • Stop serializing concurrent requests on global locks when the credentials need no exchange or refresh, and concurrent unpacks on the file server.
  • Create the unpack temporary directory inside the output directory instead of the current working directory, and build package tarballs in memory.
  • Write UTF-8 file names when unpacking with the latin1 native file name encoding.
  • Decode metadata strings and quoted atoms that end in a backslash.
  • Drop the zero padding from tar member names that end in incomplete UTF-8.
  • Unpack docs tarball binaries and package contents made of several gzip members.
  • Unpack hand-built metadata with nameless legacy requirements or a files field that isn't a list of binaries instead of crashing.
  • Don't follow symlinks when updating the modification time of unpacked files.
  • Update the vendored erl_tar to OTP 29.1.1.

v0.19.0 (2026-07-21)

  • Add hex_cli_auth module with callback-based authentication handling for build tools: with_api/3,4 and with_repo/2,3 request wrappers, credential resolution, OAuth token exchange and automatic refresh, OTP prompt handling, and device authentication.
  • Add hex_api_oauth:device_auth_flow/4,5 handling the complete OAuth device authorization flow.
  • Add trusted, oauth_exchange, oauth_exchange_url, and cli_auth_callbacks config options.
  • Restructure the Policy registry resource into per-repository restrictions and per-package overrides, replacing the ordered rule list.
  • Build the policy URL like other registry resources, so hex_repo:get_policy/2 no longer requires repo_organization.

v0.18.0 (2026-06-02)

v0.17.0 (2026-05-20)

  • Add aliases field to SecurityAdvisory proto for cross-referencing advisories (e.g. GHSA/CVE pairs).
  • Add hex_advisory:group_for_display/1 to deduplicate advisories that share aliases.

v0.16.1 (2026-05-19)

  • Add published_at timestamp field to release registry resource.

v0.16.0 (2026-05-13)

  • Validate tarball file paths and symlink targets when creating package and docs tarballs.
  • Add tarball_files_root config for tarball source paths, defaulting to the current directory and allowing absolute paths only inside that root.
  • Add streaming metadata.config decoding and increase max metadata size to 1024KB.
  • Add metadata_fields config to decode only selected package metadata fields.
  • Add security advisory fields to package and versions registry resources.
  • Add hex_repo:fingerprint/1 and hex_repo:fingerprint_equal/2 for repository public key verification.
  • Return response headers from hex_http_httpc:request_to_file/6.
  • Accept SPDX LicenseRef-* license identifiers.

v0.15.0 (2026-03-09)

  • Add request_to_file callback to hex_http behaviour for streaming HTTP response body directly to a file.
  • Add hex_repo:get_tarball_to_file/4 and hex_repo:get_docs_to_file/4 for downloading tarballs and docs directly to disk.
  • Implement request_to_file in hex_http_httpc using httpc's {stream, Filename} option.

v0.14.1 (2026-03-09)

  • Add max_size extraction limit to package inner tarball and docs tarball unpacking for zip bomb protection.

v0.14.0 (2026-03-09)

  • Stream tar extraction to disk, writing file entries in chunks instead of loading into memory.
  • Add {file, Path} support to hex_tarball:unpack_docs/2,3 to read doc tarballs from disk.
  • Add none output mode to hex_tarball:unpack/2,3 to extract only metadata and checksums, skipping contents.

v0.13.0 (2026-03-08)

  • Add file-based unpack via hex_tarball:unpack({file, Path}, Output) to avoid loading entire tarball into memory.
  • Add size validations for outer tarball entries (VERSION, CHECKSUM, metadata.config) during creation and extraction.

v0.12.2 (2026-02-27)

  • Exclude src/safe_erl_term.erl from package.

v0.12.1 (2026-02-27)

  • Fix unsafe deserialization of Erlang terms in API responses (CVE-2026-21619).

v0.12.0 (2025-10-26)

  • Add short URL API hex_api_short_url:create/2.
  • Add OAuth API:

  • Support 2FA authentication, any API request can now return {error, otp_required | invalid_totp} if 2FA is required. The config option api_otp can be used to provide the TOTP code.

  • Differentiate between registry verification errors. {error, unverified} has been replaced with {error, bad_repo_name | bad_signature}.
  • Support nested maps in extra package metadata field.

v0.11.0 (2024-12-03)

  • Use secure SSL defaults for OTP 25+.
  • Start inets and ssl applications.

v0.10.3 (2024-06-28)

  • Fix hex_api_release:retirement_params/0 type spec.

v0.10.2 (2024-06-12)

v0.10.1 (2024-06-11)

  • Drop support for OTP 20.
  • Update hex_licenses module to reflect most recent list available from SPDX.

v0.10.0 (2023-05-09)

v0.9.0 (2022-11-03)

  • Change hex_registry functions to match protobuf fields

    Before:

    > hex_registry:unpack_names(Payload, <<"test">>, TestPublicKey)
{ok,[#{name => <<"package1">>, ...},
     #{name => <<"package2">>, ...}]}

    After:

    > hex_registry:unpack_names(Payload, <<"test">>, TestPublicKey)
{ok,#{packages => [#{name => <<"package1">>, ...},
                   #{name => <<"package2">>, ...}],
      repository: <<"test">>}}

  • Change hex_repo functions to match protobuf fields

    Before:

    > hex_repo:get_names(Config),
{ok,{200, ...,
     [#{name => <<"pacakge2">>, ...},
      #{name => <<"pacakge2">>, ...},
      ...]}}

    After:

    > hex_repo:get_names(Config),
{ok,{200, ...,
     #{packages => [#{name => <<"pacakge2">>, ...},
                    #{name => <<"pacakge2">>, ...},
                    ...],
       repository => <<"test">>}}}

v0.8.4 (2021-12-20)

  • Add @doc to hex_licenses

v0.8.3 (2021-12-14)

  • Don't warn on non-https URLs
  • Add hex_licenses module

v0.8.2 (2021-05-28)

  • Warn on unsafe httpc default SSL settings

v0.8.1 (2021-05-20)

  • Update gpb to 4.17.6 to avoid dialyzer warnings

v0.8.0 (2021-05-02)

  • Deprecate registry encode/decode API in favour of new high-level build/unpack API
  • Add updated_at to repository names resource

v0.7.1 (2020-10-12)

  • Fix dialyzer warnings on OTP 23

v0.7.0 (2020-10-20)

  • Fix compatibility with OTP 24

  • Change hex_tarball:create/2 error value from {error, too_big} to {tarball, {too_big_compressed | too_big_uncompressed, Size}}.

v0.6.10 (2020-08-25)

  • Add configuration for max tarball size
  • Do not create extraneous "memory" directory when unpacking

v0.6.9 (2020-05-24)

v0.6.8 (2020-02-04)

  • Fix tarball file extraction through symlinks

v0.6.7 (2020-02-03)

  • Fix compatibility with OTP 18 and 17

v0.6.6 (2020-02-03)

  • Do not crash on empty tarballs
  • Fix directory traversal vulnerability for symlinks in tarballs

v0.6.5 (2020-01-14)

  • Transition away from http_uri when using newer OTP releases
  • Ensure Role is given as an atom in hex_api_organization_member:add/3
  • Add http_headers to the hex_core:config() type
  • Add default http_headers to hex_core:default_config/0
  • Fix hex_registry:decode_and_verify_signed/2 spec
  • Fix hex_tarball:files/0 type

v0.6.4 (2019-12-27)

  • Fix setting level and transfer options in organization api

v0.6.3 (2019-12-16)

v0.6.2 (2019-11-11)

  • Gracefully handle HTTP errors

v0.6.1 (2019-07-30)

  • Fix bug when publishing with configuration that does not have repo_organization key set

v0.6.0 (2019-07-27)

  • Backwards-incompatible: Change successful return value of hex_tarball:create/2 from {ok, {Tarball, Checksum}} to {ok, Map}. Currently, Map has tarball, inner_tarball, and outer_tarball keys
  • Rename existing tarball checksum to inner checksum and deprecate it
  • Add tarball outer checksum
  • Do not allow comments in safe_erl_term
  • Forward compatible tarball contents by not failing on unknown files

v0.5.1 (2019-07-30)

  • Fix bug when publishing with configuration that does not have repo_organization key set

v0.5.0 (2019-02-26)

  • Fetch package data from proper repository organization and don't verify origin if configured
  • Backwards-incompatible: Make hex_api module private
  • Backwards-incompatible: organization config key has been replaced with api_organization and api_repository keys
  • Add repo_organization config key
  • vendor.sh: Add missing hex_pb_*.erl files
  • vendor.sh: Fix replacing hex_core

v0.4.0 (2018-12-30)

  • Revert switch from proto2 to proto3
  • Verify authenticity of signed payload
  • Add repo_verify_origin config option

v0.3.0 (2018-12-14)

  • Switch from proto2 to proto3
  • Fix hex_http:body type
  • Fix hex_http:request spec

v0.2.1 (2018-12-13)

  • Always return the whole response tuple from requests
  • Guess rebar3 as build tool over rebar
  • Return compressed tarball from hex_tarball:create_docs/1
  • Add package identity to registry records

v0.2.0 (2018-09-01)

  • Accept {filename(), filename()} in files list for tarballs
  • Support httpc profile through adapter configs
  • Update generated protobuf files with OTP 21 compatibility

v0.1.1 (2018-08-11)

  • Use hex_core project name in user agent string

v0.1.0 (2018-08-08)

  • First release