No dependency carries an advisory (spec/12 §3, #782, D-207).

Runs Hex's own mix hex.audit in the root project and in examples/, one OS process each, so both mix.lock files are held to the security advisories and retirements Hex publishes with its registry. A project fails when its audit exits non-zero.

What a project accepts is the allowlist audit/advisories_allowlist.exs. Each entry names its project (:library or :examples), exactly one of advisory: (an id, primary or alias, as mix hex.audit matches it) and retired: ("name" or "name@version"), and its reason. A project is handed only its own entries, through HEX_IGNORE_ADVISORIES and HEX_IGNORE_RETIREMENTS, which are always set so the caller's environment allows nothing. Once a project's audit is green each of its entries is dropped in turn and the audit run again: an entry whose absence leaves it green is stale, and fails too.