hexpm/hex holds a health index of 70 out of 100, placing it in the Good band. It scores highest on Vitality (87/100) and lowest on AI Readiness (52/100). It was last updated 4 days ago. A single contributor accounts for most of its recent work.
70
overall / 100
Good
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
70
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Could not fetch hex package 'hex' from its registry
More detail
Star and fork history 0 ★ / 207 ⇿
0Stars
207Forks
85Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 2Minor 22Patch 61
Each point covers 12 days.
OpenSSF Scorecard 6.9 / 10
6.9aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-25 22:12 UTC
Full resolved dependency set from the GitHub dependency graph: 0 direct and 0 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
Dependency advisories not assessed
Advisory matching could not run for this report: No resolved dependencies to assess
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"hacktoberfest",
"elixir",
"erlang",
"package-manager"
],
"is_fork": false,
"size_kb": 4910,
"has_wiki": true,
"homepage": "https://hex.pm",
"languages": {
"Shell": 16452,
"Elixir": 919116,
"Erlang": 669353
},
"pushed_at": "2026-07-21T20:18:09Z",
"created_at": "2013-12-23T17:15:00Z",
"owner_type": "Organization",
"updated_at": "2026-07-22T12:20:31Z",
"description": "Package manager for the Erlang ecosystem.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "Elixir",
"significant_languages": [
"Elixir",
"Erlang"
]
},
"owner": {
"blog": "https://hex.pm",
"name": "Hex",
"type": "Organization",
"login": "hexpm",
"company": null,
"location": "In the tubes",
"followers": 129,
"avatar_url": "https://avatars.githubusercontent.com/u/6621265?v=4",
"created_at": "2014-02-08T01:34:53Z",
"is_verified": null,
"public_repos": 16,
"account_age_days": 4550
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2026-07-09T23:17:14Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2026-06-29T02:07:07Z"
},
{
"tag": "v2.4.2",
"kind": "patch",
"published_at": "2026-04-30T18:11:08Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2026-03-24T18:39:53Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2026-03-14T20:29:30Z"
},
{
"tag": "v2.3.2",
"kind": "patch",
"published_at": "2026-02-27T16:06:48Z"
},
{
"tag": "v2.3.1",
"kind": "patch",
"published_at": "2025-10-26T20:11:04Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2025-10-26T17:42:10Z"
},
{
"tag": "v2.2.2",
"kind": "patch",
"published_at": "2025-06-27T09:14:31Z"
},
{
"tag": "v2.2.1",
"kind": "patch",
"published_at": "2025-05-09T13:03:16Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2025-05-09T12:10:46Z"
},
{
"tag": "v2.1.1",
"kind": "patch",
"published_at": "2024-05-22T17:21:29Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2024-05-21T14:31:16Z"
},
{
"tag": "v2.0.6",
"kind": "patch",
"published_at": "2023-02-06T17:59:28Z"
},
{
"tag": "v2.0.5",
"kind": "patch",
"published_at": "2023-02-06T16:36:05Z"
},
{
"tag": "v2.0.4",
"kind": "patch",
"published_at": "2023-02-02T01:41:02Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2023-02-01T23:29:47Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2023-01-30T12:18:19Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2023-01-09T17:28:47Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2022-10-30T15:28:34Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2021-12-14T23:08:28Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2021-12-13T20:31:11Z"
},
{
"tag": "v0.21.3",
"kind": "patch",
"published_at": "2021-09-18T14:51:13Z"
},
{
"tag": "v0.21.2",
"kind": "patch",
"published_at": "2021-04-14T14:29:40Z"
},
{
"tag": "v0.21.1",
"kind": "patch",
"published_at": "2021-01-15T16:21:13Z"
},
{
"tag": "v0.21.0",
"kind": "minor",
"published_at": "2021-01-14T22:55:08Z"
},
{
"tag": "v0.20.6",
"kind": "patch",
"published_at": "2021-01-14T22:54:31Z"
},
{
"tag": "v0.20.5",
"kind": "patch",
"published_at": "2020-02-05T00:16:28Z"
},
{
"tag": "v0.20.4",
"kind": "patch",
"published_at": "2020-02-04T00:36:09Z"
},
{
"tag": "v0.20.3",
"kind": "patch",
"published_at": "2020-02-03T23:06:10Z"
},
{
"tag": "v0.20.2",
"kind": "patch",
"published_at": "2020-02-03T22:03:28Z"
},
{
"tag": "v0.20.1",
"kind": "patch",
"published_at": "2019-06-10T18:17:07Z"
},
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2019-06-09T12:38:15Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2019-01-15T21:14:15Z"
},
{
"tag": "v0.18.2",
"kind": "patch",
"published_at": "2018-11-08T09:00:23Z"
},
{
"tag": "v0.18.1",
"kind": "patch",
"published_at": "2018-07-06T09:15:37Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2018-07-05T19:52:03Z"
},
{
"tag": "v0.17.8",
"kind": "patch",
"published_at": "2018-07-01T14:09:13Z"
},
{
"tag": "v0.17.7",
"kind": "patch",
"published_at": "2018-04-19T22:26:46Z"
},
{
"tag": "v0.17.6",
"kind": "patch",
"published_at": "2018-04-18T17:01:00Z"
},
{
"tag": "v0.17.5",
"kind": "patch",
"published_at": "2018-04-18T16:46:41Z"
},
{
"tag": "v0.17.4",
"kind": "patch",
"published_at": "2018-04-18T16:02:20Z"
},
{
"tag": "v0.17.3",
"kind": "patch",
"published_at": "2018-01-16T23:18:21Z"
},
{
"tag": "v0.17.2",
"kind": "patch",
"published_at": "2018-01-16T14:05:12Z"
},
{
"tag": "v0.17.1",
"kind": "patch",
"published_at": "2018-01-16T14:05:27Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2018-01-16T14:07:23Z"
},
{
"tag": "v0.16.1",
"kind": "patch",
"published_at": "2018-01-16T14:11:18Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2018-01-16T14:11:34Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2018-01-16T14:11:53Z"
},
{
"tag": "v0.14.1",
"kind": "patch",
"published_at": "2018-01-16T14:12:13Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2018-01-16T14:12:30Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2018-01-16T14:12:46Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2018-01-16T14:12:58Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2018-01-16T14:13:21Z"
},
{
"tag": "v0.12.1",
"kind": "patch",
"published_at": "2018-01-16T14:13:36Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2018-01-16T14:13:48Z"
},
{
"tag": "v0.11.5",
"kind": "patch",
"published_at": "2018-01-16T14:14:13Z"
},
{
"tag": "v0.11.4",
"kind": "patch",
"published_at": "2018-01-16T14:14:33Z"
},
{
"tag": "v0.11.3",
"kind": "patch",
"published_at": "2018-01-16T14:14:46Z"
},
{
"tag": "v0.11.2",
"kind": "patch",
"published_at": "2018-01-16T14:14:59Z"
},
{
"tag": "v0.11.1",
"kind": "patch",
"published_at": "2018-01-16T14:15:23Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2018-01-16T14:15:34Z"
},
{
"tag": "v0.10.4",
"kind": "patch",
"published_at": "2018-01-16T14:27:07Z"
},
{
"tag": "v0.10.3",
"kind": "patch",
"published_at": "2018-01-16T14:27:18Z"
},
{
"tag": "v0.10.2",
"kind": "patch",
"published_at": "2018-01-16T14:27:31Z"
},
{
"tag": "v0.10.1",
"kind": "patch",
"published_at": "2018-01-16T14:27:47Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2018-01-16T14:28:00Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2018-01-16T14:28:13Z"
},
{
"tag": "v0.8.3",
"kind": "patch",
"published_at": "2018-01-16T14:28:29Z"
},
{
"tag": "v0.8.2",
"kind": "patch",
"published_at": "2018-01-16T14:28:42Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2018-01-16T14:28:54Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2018-01-16T14:29:06Z"
},
{
"tag": "v0.7.5",
"kind": "patch",
"published_at": "2018-01-16T14:29:19Z"
},
{
"tag": "v0.7.4",
"kind": "patch",
"published_at": "2018-01-16T14:29:29Z"
},
{
"tag": "v0.7.3",
"kind": "patch",
"published_at": "2018-01-16T14:29:39Z"
},
{
"tag": "v0.7.2",
"kind": "patch",
"published_at": "2018-01-16T14:29:52Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2018-01-16T14:31:22Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2018-01-16T14:31:34Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2018-01-16T14:31:45Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2018-01-16T14:31:58Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2018-01-16T14:32:14Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2018-01-16T14:32:31Z"
},
{
"tag": "v0.4.3",
"kind": "patch",
"published_at": "2018-01-16T14:32:38Z"
},
{
"tag": "v0.4.2",
"kind": "patch",
"published_at": "2018-01-16T14:32:53Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2018-01-16T14:33:06Z"
}
],
"recent_commits": [
{
"oid": "0eb1763fa232e8d274c70e99ec3110b55eadd16b",
"body": "The stored-key deprecation warning recommends mix hex.organization auth\nORG --key KEY, but following it did not silence the warning because the\nclient could not tell an organization-owned key from a user-owned key\nonce stored.\n\nExtract the key owner from the GET /api/auth response when verifying the\n[…]\nge, user\nkeys warn that they stop working in Hex 2.6, and keys stored before this\nversion keep warning until the command is re-run. Servers that respond\n204 without owner information behave as before.",
"is_bot": false,
"headline": "Record key ownership when authenticating organizations (#1207)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-21T20:18:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a9d3d7cdf88eba56fecd59d41a7db15f18f20696",
"body": "Bumps the codeql group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.36.3 to 4.37.0\n- [Release notes](https://github.com/github/codeql-acti\n[…]\nype: version-update:semver-minor\n dependency-group: codeql\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump the codeql group with 2 updates (#1206)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T15:50:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f19416264f7f408adb84ea251afd88d634df9ea4",
"body": "Carry the lock repository through to build_diff_link/1 so `mix hex.outdated`\nemits repository-qualified comparisons (ORG/name:from:to) for organization\npackages and skips packages from custom repositories that hex.pm cannot diff.\nRepository-qualified links are never shortened, so organization and package\nnames are not exposed through an unauthenticated short-URL redirect.",
"is_bot": false,
"headline": "Support organization packages in the outdated diffs link (#1205)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-19T16:59:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e36cdf1eccb54ef6439652687d7dc43daaeeeedc",
"body": null,
"is_bot": false,
"headline": "Link to the hex.pm diffs page in mix hex.outdated (#1204)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-19T16:08:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22bb0af948d5f213939dcf8adf4078539f08133f",
"body": "Add a --format sarif option that renders the audit result as a SARIF\nv2.1.0 document, plus an --output PATH option to write it to a file\ninstead of stdout. This allows uploading audit findings to GitHub code\nscanning and other SARIF consumers; the moduledoc documents a complete\nGitHub Actions workfl\n[…]\nincluded with a suppression so they show up as closed alerts.\n\nThe exit code behaves the same as with the human format. SARIF output\nrequires the OTP 27 :json module, matching mix hex.outdated --json.",
"is_bot": false,
"headline": "Add SARIF output format to mix hex.audit (#1203)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-07-18T20:27:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "29b5731c7bace752b87edb8ec16ec100ba6c7a3b",
"body": "Hex.Shell.warn/1 wrote to stdout via Mix.shell().info/1, so warnings\nlike the expired-authentication notice or the stale mix.lock version\nwarning polluted machine-readable stdout output such as\n`mix hex.outdated --json`. Route warn/1 through Mix.shell().error/1,\nwhich prints to stderr, keeping the y\n[…]\nar stdout\noutput (the retirement reason in the `mix deps.get` dependency\nlisting and the retirement notice in `mix hex.info`) stay on stdout\nand are now printed as yellow-formatted info lines instead.",
"is_bot": false,
"headline": "Print warnings to stderr instead of stdout (#1202)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-07-18T20:00:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d61c28a8a9e12ec3f38c06ee31d857361c709d30",
"body": "Dependabot opened separate PRs for the init and analyze sub-actions,\nleaving them on mismatched versions. The analyze step refuses to run\nwhen its version differs from the config written by init, so neither\nPR could pass CI. Grouping the updates keeps both pins in lockstep.",
"is_bot": false,
"headline": "Group codeql-action Dependabot updates and bump to v4.36.3 (#1201)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-10T00:54:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb0a930647d651f25fe1ca9611db649fabb19ef5",
"body": null,
"is_bot": false,
"headline": "Bump to v2.5.2-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-09T23:31:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a43131c26aeca06064959297d737991163f5ac5d",
"body": null,
"is_bot": false,
"headline": "Release v2.5.1",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-09T23:13:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "49155dc0d6b2e4d47861531ea6f4ca97694962b1",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.24.0 to 1.24.1.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/fc68ffb90438ef2936bbb3251622353b3dcb2f93...54075bcc5e249e4758d363f27d099f55d843f124)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.24.0 to 1.24.1 (#1200)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-09T22:58:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ce453a6ad05f0396140386334acee9104f390067",
"body": "* Suppress whole aliased advisory groups when ignoring advisories\n\n* Show config source in stale ignore warnings",
"is_bot": false,
"headline": "Improve advisory ignore matching and stale ignore warnings (#1199)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-02T00:56:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "594ac3d3c4ca727eac6087adc21145eef3435df1",
"body": "* Add Hex.Ignores config parsing\n\n* Add Hex.Ignores advisory and retirement matching\n\n* Add ignore_advisories and ignore_retirements configs\n\n* Support ignoring advisories and retirements in mix hex.audit\n\n* Skip ignored advisories and retirements in mix deps.get output\n\n* Document ignore_advisories and ignore_retirements",
"is_bot": false,
"headline": "Add ignore_advisories and ignore_retirements configs (#1198)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-02T00:36:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f38ba599ee4771b84e4f724e2f8717e19829525",
"body": "List each package override (package, requirement, ALLOW/DENY) in the\nper-repository output of mix hex.policy show instead of only printing a\ncount, and render a (none) placeholder when a repository has no\noverrides. Drop the implicit show default so a bare mix hex.policy now\nraises the usage message\n[…]\n: https://claude.ai/code/session_01MQ7G74DcZPFPEgDJMTEcCR\n\nCo-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: list package overrides in mix hex.policy show (#1193)",
"author_name": "Matt Van Horn",
"author_login": "mvanhorn",
"committed_at": "2026-07-01T23:12:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a3521ea55de50433c644576a8b8798c3213fb440",
"body": "* Replace regex with Integer.parse in cooldown duration parsing\n\nRegex literals are compiled into beam files, and the compiled PCRE\npattern format is not portable across OTP versions. An archive built\non OTP 28.1+ embeds patterns that load via :re.import/1, which does\nnot exist on OTP <= 28.0, crash\n[…]\nerns\nregexes are unaffected; they are built in the user's project at\nruntime and never embedded in Hex's beams.\n\n* Add lint test rejecting regexes in shipped code\n\n* Update CHANGELOG for regex removal",
"is_bot": false,
"headline": "Remove regexes from compiled code (#1197)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-01T23:07:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "90f215ab1c6cca90bf0e0d83e52dc8e3a6d6eb1c",
"body": null,
"is_bot": true,
"headline": "Bump actions/checkout from 6.0.3 to 7.0.0 (#1195)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T02:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68e842f40cd50475734a3e2dbf8890c6f2bd8426",
"body": null,
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#1196)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T02:08:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7ea3bef3f3cb69669c5d9f7c3b8cf193da12ef4",
"body": null,
"is_bot": false,
"headline": "Bump to v2.5.1-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T02:21:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7993e9239b5c9dea91a98042f7786e471e56b6cf",
"body": null,
"is_bot": false,
"headline": "Release v2.5.0",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T02:04:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e550bb6d60fe49a9ffeb451f3fbc50a8e6b3570f",
"body": null,
"is_bot": false,
"headline": "Bump CI to released Elixir 1.20.2 (#1192)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T02:02:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8111a13aa8fe6e5ceb488193ae2187712a02c70",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG for v2.5.0-dev (#1183)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T01:39:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52b0287d65c51708e54d75badf995ab26824f9fd",
"body": "When resolution fails under an active policy, the per-package failure\nnote and the post-solve policy summary both rendered the hidden-version\nlisting, so it printed twice. On the failure path the summary now\ncontributes only the active-policy header; the failure note remains the\nsingle listing.\n\nCloses #1187",
"is_bot": false,
"headline": "Fix duplicated policy version listing on resolution failure (#1191)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-18T11:02:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "101f697f8fa7f5ba368c821df148751d3043add3",
"body": "mix hex.policy show and why now highlight the active policy with ANSI colors: the policy name and rule values, ALLOWED/BLOCKED status, and per-reason colors (advisory, retirement, cooldown). The \"Versions filtered by cooldown\" summary printed during mix deps.get highlights the package, version, and eligible date.\n\nAlso shorten the cooldown summary line to \"PKG VSN — eligible DATE\", dropping the redundant \"published N days ago\" — the eligible date is the actionable part.",
"is_bot": false,
"headline": "Colorize hex.policy and cooldown output (#1189)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T21:26:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0ab6bc5444365798ce89c2f3bf134cafe1728cf",
"body": "An expired global OAuth token whose refresh the server rejects was refreshed once per package during dependency resolution -- dozens of failed POSTs to /oauth/token, serialized by the token-refresh lock -- and the failure was swallowed, so resolution silently continued without credentials. This regr\n[…]\nailure can recover on the next run) and warn once that the session expired and to re-run `mix hex.user auth`. With the token gone, the rest of the run stops retrying the refresh.\n\nRe-vendors hex_core.",
"is_bot": false,
"headline": "Clear the OAuth token and warn when its refresh fails (#1184)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T15:52:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "16809f6be13f77936963a445900196336fc6bf39",
"body": "get_policy/3 now goes through Hex.Auth.with_repo/3 with optional: true, like get_package/3, instead of calling :mix_hex_repo.get_policy directly. It authenticates when credentials are available and fetches anonymously otherwise, so a public policy can be resolved without authenticating to the organization.",
"is_bot": false,
"headline": "Fetch dependency policies with optional repository auth (#1185)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T15:46:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f431e47818fc1013babe5f4d4f3b1a3be8d3bfdf",
"body": "* Re-vendor hex_core from the policy-rules branch\n\nPull in the restructured Policy resource: a Policy now carries a repeated\nRepositoryPolicy (\"tab\") per repository it constrains, each with an optional\nbaseline Restriction (advisory_min_severity, retirement_reasons, cooldown) and\na list of allow/den\n[…]\ncument that rejecting the bare hexpm repo is deliberate and would be\nrelaxed if a global policy is ever served directly under hexpm.\n\n---------\n\nCo-authored-by: Jonatan Männchen <jonatan@maennchen.ch>",
"is_bot": false,
"headline": "Dependency policies (#1168)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T09:36:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "69253211fa361fc83f8dbd7061ae9254d8a2c4f1",
"body": "The HEX_REPOS_KEY/stored-key deprecation warning also fired for the base\nhexpm repository, telling users of trusted mirrors (which authenticate with\nHEX_REPOS_KEY) that their key would be removed. Only the use of these keys\nfor organization repositories is deprecated — HEX_REPOS_KEY still\nauthenticates the base hexpm repository and trusted mirrors. Warn only for\norganization repositories.",
"is_bot": false,
"headline": "Only warn about deprecated keys for organization repositories (#1182)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-16T20:06:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3de1df34b1ecc02a3ec99b3518d07dcb180dccff",
"body": "* Fix crash when a server sends an x-hex-message header\n\nResponse headers are decoded to binaries, but handle_hex_message/1 ran\n:binary.list_to_bin/1 on the value, which requires a charlist and raised\n\"not an iodata term\", failing the request. Use IO.iodata_to_binary/1,\nwhich accepts both binaries a\n[…]\ne printed to the terminal, so an\nuntrusted server could embed ANSI escapes or bidirectional overrides.\nEscape control characters before printing while keeping printable text,\nnewlines and tabs intact.",
"is_bot": false,
"headline": "Fix crash when a server sends an x-hex-message header (#1180)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-16T19:39:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cda8717f34a14349778bbe9fe7b153043d70d002",
"body": "* Adopt :hex_repo.fingerprint\n\n* Refactor Code to use hex_cli_auth",
"is_bot": false,
"headline": "Update to use `hex_auth` module (#1143)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-06-16T19:28:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7fb9dd679a8f8d7d2c0214464a43b8a73eda9eab",
"body": "Authorizing an organization without --key, authenticating to a hexpm\nrepository with a stored key, and HEX_REPOS_KEY are deprecated in favour\nof `mix hex.user auth` for development and pre-generated organization\nkeys for CI. These paths still work but now emit a warning once per\ninvocation.",
"is_bot": false,
"headline": "Deprecate personal-key access to organization repositories (#1179)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-16T09:15:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3739607f20d066a75965a32b021a575a2ee60dad",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.0 to 4.36.2.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/7\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.36.0 to 4.36.2 (#1178)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-15T14:44:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0ec5a0d968ae8954a3760004e1f3a27de20d347d",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/checkout from 6.0.2 to 6.0.3 (#1177)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-15T14:43:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6f3f425318c2d23e34b5e964879c122a91c8f50b",
"body": "When the stored access token has expired and the refresh fails (for\nexample because the refresh token was consumed by a rotation from\nanother process or revoked by a re-authentication), repo requests were\nsilently sent without credentials. Public resources still resolve, so\nthe broken session goes u\n[…]\nvocation - the refresh result is cached in the\nOnceCache, so the warning naturally fires at most once - and tell the\nuser to run mix hex.user auth. Fully anonymous use (no stored tokens)\nstays silent.",
"is_bot": false,
"headline": "Warn when the OAuth session cannot be refreshed (#1176)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-12T11:17:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2386d5a75e48429fff3dee9c32c1ef095291923a",
"body": "* Build and publish Hex's own documentation\n\nHex's docs at https://hexdocs.pm/hex stopped at v2.2.1: the only publisher\nwas Bob's retired HexDocsChecker, and no release script ever built docs.\n\nAdd scripts/release_docs.sh, which builds the docs with ExDoc in a pinned\ncontainer and uploads the tarbal\n[…]\naennchen.ch>\n\n* Use new Hex logo for documentation\n\n* Use high-resolution Hex logo rendered from SVG source\n\n* Optimize Hex logo PNG\n\n---------\n\nCo-authored-by: Jonatan Männchen <jonatan@maennchen.ch>",
"is_bot": false,
"headline": "Build and publish Hex's own documentation (#1174)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-08T15:09:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3b1a7832faa530cbd03683e667939f4b74b0f9cb",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.5 to 4.36.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/9\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.5 to 4.36.0 (#1173)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-02T19:03:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "102afdcb6bc4363cce64b602dba4e4b52dd87ec4",
"body": "* Use subdomain URLs for hexpm package docs\n\nSwitch hexpm-repo docs URLs from `https://hexdocs.pm/PACKAGE/...`\nto `https://PACKAGE.hexdocs.pm/...`. Org-repo URLs are unchanged.\n\n* Map underscore to hyphen in hexdocs.pm subdomain URLs\n\nHex package names allow underscores. RFC 1123 hostname labels and\n[…]\nnue to be the storage key.\n\nApply the same mapping in the Hex CLI helpers that emit hexpm-repo\nsubdomain URLs. Org-repo branch is unchanged (hexorgs.pm is GKE and\ndoesn't enforce strict SAN matching).",
"is_bot": false,
"headline": "Use subdomain URLs for hexpm package docs (#1172)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-29T16:52:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ce6e3254beae57fecbc165d42d5a12fc6d18773",
"body": "* Annotate cooldown-held versions in mix hex.outdated\n\nShow \"(cooldown)\" alongside the status when the latest version of a\ndependency is within the configured cooldown window, with a \"Versions\nin cooldown\" legend below the table listing eligibility dates. The\nsingle-package output gets a similar lin\n[…]\nardless of\ncooldown — the (cooldown) tag was misleading. Strip the cooldown\nattachment for those rows so the status is just \"Update not possible\"\nand the version doesn't appear in the cooldown legend.",
"is_bot": false,
"headline": "Annotate cooldown-held versions in mix hex.outdated (#1171)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-28T14:10:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9e08746e02cafec2e9224f8320da9592450f14c5",
"body": null,
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#1170)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-26T11:44:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc607fe6e2a7bfa16b0f10c5f1f8689d083be663",
"body": null,
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.4 to 4.35.5 (#1169)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-26T11:43:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f4c120a2abb28450a027bfca4e44b0ecec4ab26a",
"body": "* update test matrix to include newer major and minor versions\n\n* test to see if yaml is truncating 29.0 to 29\n\n* Fix test fixtures for ecto 3.3.2 and ecto_sql 3.3.3\n\necto_3_3_2/mix.exs declared version \"3.3.1\" instead of \"3.3.2\", causing\nMix 1.20 to raise a nomatchvsn error when updating ecto_sql (\n[…]\ntest passes (masked), this test fails\n - 1.19.5 with fix: both pass\n - 1.20.0-rc.5 without fix: both fail\n - 1.20.0-rc.5 with fix: both pass\n\n* revert scm change an bump to stable 1.20\n\n* rc6",
"is_bot": false,
"headline": "Update test matrix to include newer major and minor versions (#1166)",
"author_name": "Chase Gilliam",
"author_login": "Ch4s3",
"committed_at": "2026-05-22T11:53:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b4e665d46be8a5f81e8cbbe4c3a67058a19cf133",
"body": "A configurable delay between when a package version is published and\nwhen it becomes eligible for selection during dependency resolution,\nto mitigate supply-chain attacks where a freshly compromised release\nis pulled into projects before it can be detected and retired.\n\nConfiguration:\n* New `cooldow\n[…]\n index, or self-hosted clones) are treated as\neligible. Empty env values (`HEX_COOLDOWN=`,\n`HEX_COOLDOWN_EXCLUDE_REPOS=`) fall through to the next source\ninstead of clobbering project / global config.",
"is_bot": false,
"headline": "Add release-age cooldown to dependency resolution (#1160)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-20T22:12:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "10072250c62792e72079ff196fbaa6bb12a9aec0",
"body": null,
"is_bot": false,
"headline": "Deduplicate aliased advisories (#1167)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-20T18:00:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70e17f7ae6c491f646c07b73b4a8b61737332925",
"body": "* Refactor hex.outdated\n\nThis unifies outdated dependency processing.\n\nAll behaviors should be the same, except for one edge case.\n\nIf there is only one dependency, the display will be the same as `single`. I'm not sure if that's an issue or not.\n\nAssuming that the current UI is not meant to be prog\n[…]\n The refactor accidentally made them apply when a single app\nwas specified, changing exit-code behavior for that path.\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Support json output (#1061)",
"author_name": "Tyler Witt",
"author_login": "TylerWitt",
"committed_at": "2026-05-19T16:46:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d1d4bcf4f07816eb1394766b699114bc236ac15",
"body": "* Move security advisory warning to post_converge\n\nLong deps.get / deps.update output could push the\n\"Found packages with security advisories\" line past\nthe scroll fold, hiding it. Move the summary to\npost_converge alongside the sponsor tip and point users\nback to the per-package advisory details above.\n\n* Move retired package warning to post_converge",
"is_bot": false,
"headline": "Move security advisory warning to post_converge (#1165)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-19T13:58:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf7407207427f710c806cd7037f624a68707b7d1",
"body": "Co-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Add --page and --format md to mix hex.docs (#1162)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2026-05-19T12:49:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "782c763d3a774167c8ba34dcd3edcd0db6ba4a4c",
"body": null,
"is_bot": false,
"headline": "Add mix hex.search QUERY (#1163)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2026-05-19T12:47:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0c92498270b7167668c96d88929f2d7cbbd1df06",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.3 to 4.35.4 (#1161)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-19T12:21:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4723f65427388eb5b749d369e3e2588c3971e49e",
"body": null,
"is_bot": false,
"headline": "Fix type warnings on Elixir v1.20 (#1164)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2026-05-19T11:09:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c02464d16a02dedc748a6ada4955c13b62b8a79",
"body": "* Warn on installation of vulnerable packages\n\n* Sync Hex.Dev ETS version, unify advisory rendering, and test deps.get advisory output\n\n- Bump `Hex.Dev.@ets_version` to 4 so registries extracted via\n `Hex.Dev.extract_registry/2` survive the version check in\n `Hex.Registry.Server.check_version/1`.\n\n[…]\n three times.\n- Add a test for Registry.prefetch/1 raising a Mix.Error in offline\n mode when a package is not cached.\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Warn on installation of vulnerable packages (#1150)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-05-14T22:44:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b145e8d5962463cca4427d1987d86c304145fc6e",
"body": "* Vendor hex_core 0.16.0\n\n* Update tarball test for hex_core 0.16.0 default files root\n\nhex_core 0.16.0 defaults `tarball_files_root` to `\".\"` and removed the\n`:missing_files_root` error, so the obsolete assertions for that error\nand for absolute paths inside the root no longer match. Keep the\nmismatched-archive-name symlink check, which is the integration coverage\nthat doesn't duplicate hex_core's own suite.\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Vendor hex_core 0.16.0 (#1157)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-05-14T16:04:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2961ec70c20ee82b9cf0205fda732ce0aa50ba3d",
"body": null,
"is_bot": false,
"headline": "Fix OTP archive root (#1156)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-13T01:15:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f996de41e2ca043a85ce137e7c28bd2ab9cd30c1",
"body": "* Validate package files in mix hex.build\n\n* Temporarily vendor tarball create validation\n\n* Delegate package file validation to hex_core\n\n* Sync root-relative tarball source validation\n\n* Vendor updated hex_core tarball files",
"is_bot": false,
"headline": "Validate package files in mix hex.build (#1153)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-13T00:22:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f7417ef38061a203fb6b65c211702d1025a16ad0",
"body": null,
"is_bot": false,
"headline": "Accept LicenseRef license identifiers (#1155)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-12T23:02:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12a46fe16d6e439d853c130070a95196b837c487",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/9\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.2 to 4.35.3 (#1152)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-12T11:15:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "115e4cc306c2afb4676b8528fe43f5b1086dd5a7",
"body": "The assertion locked in a 32-byte API key length. With hexpm now\nissuing hex_-prefixed v2 tokens (44 bytes) alongside v1 (32 bytes),\npinning the exact length makes the integration test brittle to\nhexpm-side format changes. Check that the secret is a non-empty\nstring and let the rest of the test verify the key actually works\nfor authentication.",
"is_bot": false,
"headline": "Loosen API key format assertion to is_binary + byte_size > 0 (#1151)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-09T21:07:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99f54a80727e372e239afbf6b1a2f371a3c58a64",
"body": null,
"is_bot": false,
"headline": "Move Fastly purge into release script and use fastly CLI",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:21:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "478def2db993dc98b7aa4b7e421a38a4988160e4",
"body": null,
"is_bot": false,
"headline": "Bump to v2.4.3-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9b8ecaa37ae3135359345143e41cffc5a7e13b5",
"body": null,
"is_bot": false,
"headline": "Release v2.4.2",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:10:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54b8cb0760905b473e0e9a8610f58aad5ddfb52e",
"body": null,
"is_bot": false,
"headline": "Update Fastly purge step in RELEASE.md",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:09:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d7528c8199a1144511508bf3a6460026a5a14c8e",
"body": "Checksum verification was not being performed due to a type mismatch\nin pattern matching. Comparing atom-based names against string-based\nlock data caused the verification to be silently skipped.\n\nFixes: GHSA-hmv9-4mfr-m92v\nFixes: CVE-2026-32148\n\nCo-authored-by: Jonatan Männchen <jonatan@maennchen.ch>\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Fix checksum verification for dependencies in mix.lock",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T17:55:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b5a1e942116ccab3d63ed3b6f0ed30421ce638d0",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2.\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.1 to 4.35.2 (#1149)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-27T22:54:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "573f566119059ff28f2f408e188f07cb53558a48",
"body": "The second-priority branch in build_hex_core_config attempted to exchange\nthe API key for an OAuth token whenever auth_key and trusted were set,\nrelying on the first branch to short-circuit for the disabled case. That\nleft the branch's condition incomplete: any state not caught by branch 1\nwould fir\n[…]\nh_exchange set, which resolve\nto an explicit nil).\n\nMake both branches self-gated on the oauth_exchange flag so the\nintent is local to each clause. Also clarify preflight comments in\nremote_converger.",
"is_bot": false,
"headline": "Gate API key to OAuth token exchange on oauth_exchange flag (#1148)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-24T14:04:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0d5d10d7af5a6a7ae47cefdebe0ced4a1a79d5f1",
"body": null,
"is_bot": false,
"headline": "Limit deps.get auth preflight and trust-gate user OAuth fallback (#1145)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-24T06:44:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8bb9ef5ffba50b142d8f7b9aa9f3eef3f279d7e0",
"body": null,
"is_bot": false,
"headline": "Show mix hex.package diff commands in hex.outdated output (#1137)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-23T07:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "022578d1a44f1cf5d4edfca9e56b15901bccec8d",
"body": "Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.2 to 0.5.3.\n- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)\n- [Commits](https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f3159\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 (#1144)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-20T21:56:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4370644a3214c0109fc40b62f91868c541b6a666",
"body": "…142)\n\nWaiters on Hex.OnceCache shared a hardcoded 5s default timeout while the\nunderlying HTTP call can take up to 15s. Under concurrent private package\nfetches in :hex_fetcher this caused all but the computing task to time out\nbefore the token exchange completed.\n\nUse a 60s timeout consistent with\n[…]\nx.OAuth with the same bound; the interactive device flow is invoked\nsequentially from check_and_refresh_auth before parallel fetches begin,\nso concurrent waiters only ever cover the HTTP refresh path.",
"is_bot": false,
"headline": "Set finite OnceCache timeout for OAuth token exchange and refresh (#1…",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-14T02:12:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3e5dd7932410a12238bfc460a18c4b59b2370b57",
"body": "Unpack both versions into a shared temporary parent directory and run\nthe diff command with that parent as the working directory, so output\nshows short relative paths like `ecto-3.13.4/...` instead of long\nabsolute tmp paths. Also drop git's `a/`/`b/` prefixes from the default\ndiff command via `--no-prefix`.",
"is_bot": false,
"headline": "Clean up paths in hex.package diff output (#1140)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-13T04:14:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34997a22d98921b74abd261624fb809877687365",
"body": "This adds download counts and release dates (provided by `hex.pm/api/packages/[package_name]`) to the `mix hex.info [package_name]` and `mix hex.info [package_name] [version]` commands.\n\nDownload counts for the overall package info include yesterday, last 7 days, and all-time. Showing the download n\n[…]\noads meant (it looks like it might be the last 8 releases), so I left that out of the download output.\n\nResolves #1128\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Add download stats and release dates to mix hex.info (#1130)",
"author_name": "Tyler A. Young",
"author_login": "s3cur3",
"committed_at": "2026-04-13T03:39:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5543a1919c709d8eb2b317f62aad76ca1eed375c",
"body": null,
"is_bot": false,
"headline": "Update to hex_core 0.15.0 (#1138)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-04-11T22:42:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "187a92118615deecccd798b2804e8b13a77b386f",
"body": "…(#1135) (#1136)\n\nThe `mix hex.organization auth` command should create a user-level key\nwith repository permissions scoped to the organization, not an\norganization-owned key. This was changed incorrectly in 5c039c3.",
"is_bot": false,
"headline": "Fix organization auth to create user key instead of organization key …",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-09T08:15:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff0eca4184526e9ae2f443a2931b9bd3b9403693",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.23.0 to 1.24.0.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/ee09b1e59bb240681c382eb1f0abc6a04af72764...fc68ffb90438ef2936bbb3251622353b3dcb2f93)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.23.0 to 1.24.0 (#1133)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-08T10:31:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa5f81af8616aadd0ab75b482a545b95280c9e9f",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.4 to 4.35.1.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/8\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.32.4 to 4.35.1 (#1132)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-08T10:30:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "720b5a409e98afec19d569ae3263b3b33454db9b",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.21.0 to 1.23.0.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/3580539ceec3dc05b0ed51e9e10b08eb7a7c2bb4...ee09b1e59bb240681c382eb1f0abc6a04af72764)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.21.0 to 1.23.0 (#1127)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-29T15:52:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "25d5c1a7cef6b16fcada67f94293399d0e187b9b",
"body": "… available (#1129)\n\nCloses #1106",
"is_bot": false,
"headline": "Change docs published message to indicate docs may not be immediately…",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-29T15:49:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74633a320e4f632eaab5d5bbd9addf10a922a3d1",
"body": null,
"is_bot": false,
"headline": "Filter expected error logs from cache handoff tests (#1126)",
"author_name": "Egor Mihnevich",
"author_login": "elfenlaid",
"committed_at": "2026-03-29T15:34:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6704968513dd474b034b745310003956015f7cd4",
"body": null,
"is_bot": false,
"headline": "Fix registry ets timestamp purging (#1125)",
"author_name": "Egor Mihnevich",
"author_login": "elfenlaid",
"committed_at": "2026-03-29T15:33:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7940feb54d242d7a963d7bb84bb10f28795ecbba",
"body": null,
"is_bot": false,
"headline": "Disable external git diff tool in tests (#1124)",
"author_name": "Egor Mihnevich",
"author_login": "elfenlaid",
"committed_at": "2026-03-29T15:32:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af9ff9076fa4681104a2fc1a16d3778d8241d638",
"body": null,
"is_bot": false,
"headline": "Update CA bundle",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-24T18:44:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "686d4cf94c4e50d8e82139674c57e89a0ffe56da",
"body": null,
"is_bot": false,
"headline": "Bump to v2.4.2-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-24T18:42:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d13a73440daef1a772bbbec2dcb6e66e106843be",
"body": null,
"is_bot": false,
"headline": "Release v2.4.1",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-24T18:39:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8886724c138c70fa049eaa0566e3219a1ac191eb",
"body": "…123)\n\nParallel package fetches each triggered an independent OAuth token\nexchange for the same repo, causing multiple calls to /api/oauth/token.\nUse Hex.OnceCache with a keyed fetch to ensure only one exchange per\nrepo+key combination, with concurrent tasks waiting for the result.",
"is_bot": false,
"headline": "Deduplicate OAuth token exchange during parallel package fetching (#1…",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-19T19:06:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4010feebd0722dc6c0f54c6c76c574c5003ae70c",
"body": "Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.0 to 0.5.2.\n- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)\n- [Commits](https://github.com/zizmorcore/zizmor-action/compare/0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d...71321a20a9ded102f6e9ce\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#1121)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-19T18:17:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1132784c2c2e628302c15cac38e971bf69d556ad",
"body": "Organization repos inherit config from their parent via\ndefault_organization but oauth_exchange and oauth_exchange_url were not\nbeing propagated. This meant org repos like hexpm:rtpacnroll never had\nthe oauth_exchange key set, falling back to the default of false in\nbuild_hex_core_config instead of inheriting true from hexpm.",
"is_bot": false,
"headline": "Propagate oauth_exchange to organization repos (#1122)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-18T16:51:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2520243dcf44dc8f750e077199f99317764ed3cf",
"body": "Compilation prunes code paths for isolation, which may remove archive\npaths like Hex. When a task like `format` triggers compilation and then\n`deps.get` runs in the same VM, Hex.Mix becomes unavailable.\n\nCall Mix.ensure_application!(:hex) to restore the code paths before\nconverging dependencies.\n\nCloses #1109",
"is_bot": false,
"headline": "Restore Hex code paths after compilation pruning (#1118)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-16T10:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84f2d67b49c5b97346d226a4e36455c75d4737cf",
"body": "Repos configured before v2.4.0 don't have the oauth_exchange key in\ntheir saved config. The default in build_hex_core_config was true,\ncausing hex to attempt OAuth token exchange for repos that don't\nsupport it (e.g. getoban.pro), resulting in :exchange_failed errors.\n\nChange the default to false. T\n[…]\nv2.4.0\nhave it explicitly set by the add command.\n\nAlso fix a test isolation issue where oauth_token from the user's\nactual ~/.hex/hex.config leaked into test state via init_reset_state.\n\nCloses #1119",
"is_bot": false,
"headline": "Fix OAuth exchange attempted for repos configured before v2.4.0 (#1120)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-16T10:54:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "11a8395516258ecce278a10f021565393a0f4b08",
"body": null,
"is_bot": false,
"headline": "Bump to v2.4.1-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-14T20:32:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa621312067a6c4453d30415ed928f0957afd5d2",
"body": null,
"is_bot": false,
"headline": "Release v2.4.0",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-14T20:27:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52bef927db16ac227a149db9d5dbe90f5d5b7dc7",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.20.4 to 1.21.0.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/e6d7c94229049569db56a7ad5a540c051a010af9...3580539ceec3dc05b0ed51e9e10b08eb7a7c2bb4)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.20.4 to 1.21.0 (#1114)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-14T17:36:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ee2a27f66d6cc223aae016943aea2c6a3c92f5ef",
"body": "Warn instead of raising when OAuth authentication fails or is declined\nduring dependency resolution since the user may only need public packages.\nImprove the prompt message when re-authentication is needed. Add 401 to\nthe recognized error statuses in the registry server and suggest running\n`mix hex.user auth` when no authentication token is found.",
"is_bot": false,
"headline": "Improve authentication error handling for package fetching (#1116)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-14T17:36:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fa6b0a81653e6149ee20cf44a765246274b89d6",
"body": "Update organization doc URL functions to use hexorgs.pm. Public\n(hexpm/nil) URLs remain on hexdocs.pm.",
"is_bot": false,
"headline": "Migrate private docs URLs from *.hexdocs.pm to *.hexorgs.pm (#1115)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-13T23:15:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af9fba29e3ca8c3dacb0d0bd85b64ae5e4235639",
"body": null,
"is_bot": false,
"headline": "Vendor hex_core v0.12.2",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-02-27T17:29:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9999e425d9c0f9fc8c53e7823eee898156c4d1a",
"body": null,
"is_bot": false,
"headline": "Fix unsafe deserialization of Erlang terms in API responses",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-02-27T17:24:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b797d12f47d22291e7a7f911528fe1646fe7d877",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 3.6.0 to 6.0.2.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v3.6.0...de0fac2e4500da\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/checkout from 3.6.0 to 6.0.2 (#1112)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-25T23:49:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b12887dfe995741c0361df4f2844f0138375317d",
"body": "* Add explicit permissions to CI workflow\n\nRestrict workflow permissions to read-only content access following\nGitHub security best practices.\n\n* Pin GitHub Actions to commit SHAs\n\nReplace mutable version tags with immutable commit hashes for\nactions/checkout and erlef/setup-beam to prevent supply c\n[…]\nits/#artipacked\n\n* Add CodeQL and Zizmor security scanning workflows\n\nAdd CodeQL for static analysis of GitHub Actions and Zizmor for\nworkflow security auditing. Runs on push, PR, and weekly schedule.",
"is_bot": false,
"headline": "Add GitHub Actions security scanning with CodeQL and zizmor (#1110)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-02-25T23:43:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "45bc7c2e0423d4bbd22ffae9b1d5ec152b6574c4",
"body": "Replace :erlang.binary_to_term with safe_binary_to_term! when parsing\nhex package manifests to restrict deserialization to safe terms only.",
"is_bot": false,
"headline": "Use safe_binary_to_term! for parsing package manifests (#1111)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-02-25T23:05:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33e4cf42eaca73a4193aad688f3150e075498344",
"body": null,
"is_bot": false,
"headline": "mix hex.search: Add --print-url flag (#1108)",
"author_name": "Nathan Long",
"author_login": "nathanl",
"committed_at": "2026-01-29T12:41:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f76737e2c9e692be36054499dced57eaf56cb77",
"body": "Co-authored-by: a.smolnikov <a.smolnikov@spectrumit.ru>\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Fix within-requirements option in mix hex.outdated (#1107)",
"author_name": "flatl",
"author_login": "flatl",
"committed_at": "2025-12-17T16:43:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73736d0f6b3047223be95f3d8de6c7224b7dfd4f",
"body": null,
"is_bot": false,
"headline": "Include stdlib by default in mix hex.search (#1103)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2025-10-29T06:30:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a418451cb80e48231f8fb03f39f3c59323a26f1b",
"body": null,
"is_bot": false,
"headline": "Remove unused Hex.Crypto.PublicKey module (#1102)",
"author_name": "Christopher Varjas",
"author_login": "varjas",
"committed_at": "2025-10-27T19:55:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8516cbba22dfded1dd04e75b71feae70dcd3ed1",
"body": "Since we may prompt the user to refresh their token we cannot use a short timeout.",
"is_bot": false,
"headline": "OnceCache for oauth tokens require longer timeout",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2025-10-26T20:27:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b94c384174f69aedf8d6827ed7c53c76e632882",
"body": null,
"is_bot": false,
"headline": "Add test for fetching package from custom repo",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2025-10-26T20:21:28Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 85,
"commits_last_year": 135,
"latest_release_at": "2026-07-09T23:17:14Z",
"latest_release_tag": "v2.5.1",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 28,
"days_since_latest_release": 15,
"mean_days_between_releases": 47.4
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 62,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 207,
"stars": 1084,
"watchers": 26,
"fork_history": {
"days": [
{
"date": "2014-04-21",
"count": 1
},
{
"date": "2014-05-27",
"count": 1
},
{
"date": "2014-06-19",
"count": 1
},
{
"date": "2014-08-11",
"count": 1
},
{
"date": "2014-09-23",
"count": 1
},
{
"date": "2014-12-15",
"count": 1
},
{
"date": "2015-04-13",
"count": 1
},
{
"date": "2015-05-10",
"count": 1
},
{
"date": "2015-06-18",
"count": 1
},
{
"date": "2015-07-16",
"count": 1
},
{
"date": "2015-07-31",
"count": 1
},
{
"date": "2015-08-04",
"count": 1
},
{
"date": "2015-08-09",
"count": 1
},
{
"date": "2015-08-15",
"count": 1
},
{
"date": "2015-09-07",
"count": 1
},
{
"date": "2015-09-08",
"count": 1
},
{
"date": "2015-10-07",
"count": 1
},
{
"date": "2015-10-18",
"count": 1
},
{
"date": "2015-11-06",
"count": 1
},
{
"date": "2015-12-01",
"count": 1
},
{
"date": "2015-12-04",
"count": 1
},
{
"date": "2015-12-15",
"count": 1
},
{
"date": "2015-12-22",
"count": 1
},
{
"date": "2016-01-14",
"count": 2
},
{
"date": "2016-01-15",
"count": 1
},
{
"date": "2016-01-22",
"count": 1
},
{
"date": "2016-01-24",
"count": 1
},
{
"date": "2016-01-29",
"count": 1
},
{
"date": "2016-02-02",
"count": 1
},
{
"date": "2016-03-10",
"count": 1
},
{
"date": "2016-03-17",
"count": 1
},
{
"date": "2016-03-24",
"count": 1
},
{
"date": "2016-04-16",
"count": 1
},
{
"date": "2016-04-21",
"count": 1
},
{
"date": "2016-04-25",
"count": 1
},
{
"date": "2016-04-28",
"count": 1
},
{
"date": "2016-05-09",
"count": 1
},
{
"date": "2016-05-14",
"count": 1
},
{
"date": "2016-05-31",
"count": 1
},
{
"date": "2016-06-29",
"count": 1
},
{
"date": "2016-07-07",
"count": 1
},
{
"date": "2016-07-11",
"count": 1
},
{
"date": "2016-09-05",
"count": 2
},
{
"date": "2016-09-11",
"count": 1
},
{
"date": "2016-09-23",
"count": 1
},
{
"date": "2016-10-22",
"count": 1
},
{
"date": "2016-10-31",
"count": 1
},
{
"date": "2016-11-03",
"count": 1
},
{
"date": "2016-11-08",
"count": 1
},
{
"date": "2016-11-17",
"count": 2
},
{
"date": "2016-11-22",
"count": 1
},
{
"date": "2016-12-07",
"count": 1
},
{
"date": "2016-12-26",
"count": 1
},
{
"date": "2016-12-27",
"count": 1
},
{
"date": "2017-02-12",
"count": 1
},
{
"date": "2017-02-24",
"count": 1
},
{
"date": "2017-03-31",
"count": 1
},
{
"date": "2017-04-13",
"count": 1
},
{
"date": "2017-04-20",
"count": 1
},
{
"date": "2017-04-28",
"count": 1
},
{
"date": "2017-05-17",
"count": 1
},
{
"date": "2017-06-01",
"count": 1
},
{
"date": "2017-06-02",
"count": 1
},
{
"date": "2017-06-11",
"count": 1
},
{
"date": "2017-07-28",
"count": 1
},
{
"date": "2017-08-04",
"count": 1
},
{
"date": "2017-08-20",
"count": 1
},
{
"date": "2017-09-08",
"count": 1
},
{
"date": "2017-09-11",
"count": 1
},
{
"date": "2017-09-12",
"count": 1
},
{
"date": "2017-09-19",
"count": 1
},
{
"date": "2017-09-20",
"count": 1
},
{
"date": "2017-10-07",
"count": 1
},
{
"date": "2017-10-19",
"count": 1
},
{
"date": "2017-11-25",
"count": 1
},
{
"date": "2017-12-23",
"count": 1
},
{
"date": "2017-12-29",
"count": 1
},
{
"date": "2018-01-16",
"count": 1
},
{
"date": "2018-03-12",
"count": 1
},
{
"date": "2018-03-21",
"count": 1
},
{
"date": "2018-03-29",
"count": 1
},
{
"date": "2018-05-06",
"count": 1
},
{
"date": "2018-05-22",
"count": 2
},
{
"date": "2018-07-31",
"count": 1
},
{
"date": "2018-08-19",
"count": 1
},
{
"date": "2018-09-07",
"count": 1
},
{
"date": "2018-10-17",
"count": 1
},
{
"date": "2018-10-23",
"count": 1
},
{
"date": "2018-11-06",
"count": 1
},
{
"date": "2018-11-28",
"count": 1
},
{
"date": "2018-12-05",
"count": 1
},
{
"date": "2018-12-22",
"count": 1
},
{
"date": "2019-01-23",
"count": 1
},
{
"date": "2019-02-13",
"count": 1
},
{
"date": "2019-02-18",
"count": 1
},
{
"date": "2019-03-08",
"count": 1
},
{
"date": "2019-04-26",
"count": 1
},
{
"date": "2019-07-09",
"count": 1
},
{
"date": "2019-07-15",
"count": 1
},
{
"date": "2019-09-20",
"count": 1
},
{
"date": "2019-10-24",
"count": 1
},
{
"date": "2019-10-30",
"count": 1
},
{
"date": "2019-11-08",
"count": 1
},
{
"date": "2019-11-21",
"count": 1
},
{
"date": "2019-12-14",
"count": 1
},
{
"date": "2019-12-19",
"count": 1
},
{
"date": "2020-02-04",
"count": 1
},
{
"date": "2020-02-07",
"count": 1
},
{
"date": "2020-03-01",
"count": 1
},
{
"date": "2020-03-06",
"count": 1
},
{
"date": "2020-03-10",
"count": 1
},
{
"date": "2020-05-04",
"count": 1
},
{
"date": "2020-05-12",
"count": 1
},
{
"date": "2020-07-30",
"count": 1
},
{
"date": "2020-08-02",
"count": 1
},
{
"date": "2020-09-17",
"count": 1
},
{
"date": "2020-09-24",
"count": 1
},
{
"date": "2020-10-06",
"count": 1
},
{
"date": "2020-10-09",
"count": 1
},
{
"date": "2020-10-21",
"count": 1
},
{
"date": "2020-11-07",
"count": 1
},
{
"date": "2020-11-26",
"count": 1
},
{
"date": "2020-12-24",
"count": 1
},
{
"date": "2020-12-31",
"count": 1
},
{
"date": "2021-01-07",
"count": 1
},
{
"date": "2021-01-11",
"count": 1
},
{
"date": "2021-02-06",
"count": 1
},
{
"date": "2021-02-14",
"count": 1
},
{
"date": "2021-03-17",
"count": 1
},
{
"date": "2021-03-19",
"count": 1
},
{
"date": "2021-04-11",
"count": 1
},
{
"date": "2021-05-07",
"count": 1
},
{
"date": "2021-06-14",
"count": 1
},
{
"date": "2021-06-20",
"count": 1
},
{
"date": "2021-06-23",
"count": 1
},
{
"date": "2021-07-02",
"count": 1
},
{
"date": "2021-07-07",
"count": 1
},
{
"date": "2021-07-15",
"count": 1
},
{
"date": "2021-07-24",
"count": 1
},
{
"date": "2021-08-30",
"count": 2
},
{
"date": "2021-09-26",
"count": 1
},
{
"date": "2021-10-01",
"count": 1
},
{
"date": "2021-10-30",
"count": 1
},
{
"date": "2021-12-01",
"count": 1
},
{
"date": "2022-01-04",
"count": 1
},
{
"date": "2022-01-10",
"count": 1
},
{
"date": "2022-03-10",
"count": 1
},
{
"date": "2022-03-17",
"count": 1
},
{
"date": "2022-03-23",
"count": 1
},
{
"date": "2022-04-05",
"count": 1
},
{
"date": "2022-04-17",
"count": 1
},
{
"date": "2022-04-29",
"count": 1
},
{
"date": "2022-05-20",
"count": 1
},
{
"date": "2022-11-17",
"count": 1
},
{
"date": "2022-11-24",
"count": 1
},
{
"date": "2022-11-25",
"count": 1
},
{
"date": "2022-12-19",
"count": 1
},
{
"date": "2023-01-04",
"count": 1
},
{
"date": "2023-02-05",
"count": 1
},
{
"date": "2023-02-15",
"count": 1
},
{
"date": "2023-05-18",
"count": 2
},
{
"date": "2023-05-30",
"count": 1
},
{
"date": "2023-06-13",
"count": 1
},
{
"date": "2023-07-25",
"count": 1
},
{
"date": "2023-09-30",
"count": 1
},
{
"date": "2023-10-06",
"count": 1
},
{
"date": "2023-12-08",
"count": 1
},
{
"date": "2023-12-21",
"count": 1
},
{
"date": "2023-12-29",
"count": 1
},
{
"date": "2024-01-13",
"count": 1
},
{
"date": "2024-03-01",
"count": 1
},
{
"date": "2024-03-31",
"count": 1
},
{
"date": "2024-05-04",
"count": 1
},
{
"date": "2024-05-14",
"count": 1
},
{
"date": "2024-08-06",
"count": 1
},
{
"date": "2024-09-27",
"count": 1
},
{
"date": "2024-11-14",
"count": 1
},
{
"date": "2024-11-17",
"count": 1
},
{
"date": "2025-01-14",
"count": 1
},
{
"date": "2025-01-23",
"count": 1
},
{
"date": "2025-04-16",
"count": 1
},
{
"date": "2025-05-27",
"count": 1
},
{
"date": "2025-06-30",
"count": 1
},
{
"date": "2025-07-06",
"count": 1
},
{
"date": "2025-07-17",
"count": 1
},
{
"date": "2025-07-18",
"count": 1
},
{
"date": "2025-08-18",
"count": 1
},
{
"date": "2025-10-22",
"count": 1
},
{
"date": "2025-10-25",
"count": 1
},
{
"date": "2025-11-25",
"count": 1
},
{
"date": "2026-01-22",
"count": 1
},
{
"date": "2026-03-19",
"count": 1
},
{
"date": "2026-03-21",
"count": 1
},
{
"date": "2026-03-29",
"count": 1
},
{
"date": "2026-05-19",
"count": 1
},
{
"date": "2026-06-29",
"count": 1
},
{
"date": "2026-07-14",
"count": 1
},
{
"date": "2026-07-15",
"count": 1
},
{
"date": "2026-07-21",
"count": 1
}
],
"complete": true,
"collected": 205,
"total_forks": 207
},
"star_history": null,
"open_issues_and_prs": 6
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"sample"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"mix.exs",
"test/fixtures/diff/mix.exs",
"test/fixtures/ecto/mix.exs",
"test/fixtures/ecto_3_3_1/mix.exs",
"test/fixtures/ecto_3_3_2/mix.exs",
"test/fixtures/ecto_enum_1_4_0/mix.exs",
"test/fixtures/ecto_override/mix.exs",
"test/fixtures/ecto_sql_3_3_2/mix.exs",
"test/fixtures/ecto_sql_3_3_3/mix.exs",
"test/fixtures/ex_doc/mix.exs",
"test/fixtures/has_hex_dep/mix.exs",
"test/fixtures/override_with_path/mix.exs",
"test/fixtures/sample/mix.exs",
"test/fixtures/umbrella/apps/my_app1/mix.exs",
"test/fixtures/umbrella/apps/my_app2/mix.exs",
"test/fixtures/umbrella/apps/my_app3/mix.exs",
"test/fixtures/umbrella/mix.exs",
"test/fixtures/umbrella_override/apps/my_app1/mix.exs",
"test/fixtures/umbrella_override/mix.exs"
],
"largest_source_bytes": 34595,
"source_files_sampled": 164,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"mix.exs"
],
"advisories": {
"error": "No resolved dependencies to assess",
"scope": "repository_graph",
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"hex"
],
"dependencies": [
{
"name": "bypass",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 2.0"
},
{
"name": "cowboy",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 2.14"
},
{
"name": "mime",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 1.0"
},
{
"name": "mox",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 1.0"
},
{
"name": "plug",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 1.18"
},
{
"name": "plug_cowboy",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 2.7"
},
{
"name": "ok",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": null
},
{
"name": "cached_deps",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": null
},
{
"name": "cached_deps",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": null
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [],
"collected": true,
"truncated": false,
"total_count": 0,
"direct_count": 0,
"indirect_count": 0
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 534,
"open_issues": 4,
"closed_ratio": 0.993,
"closed_issues": 605,
"closed_unmerged_prs": 53
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "ericmj",
"commits": 1283,
"avatar_url": "https://avatars.githubusercontent.com/u/316890?v=4"
},
{
"type": "User",
"login": "wojtekmach",
"commits": 184,
"avatar_url": "https://avatars.githubusercontent.com/u/76071?v=4"
},
{
"type": "User",
"login": "supersimple",
"commits": 61,
"avatar_url": "https://avatars.githubusercontent.com/u/773380?v=4"
},
{
"type": "User",
"login": "lexmag",
"commits": 35,
"avatar_url": "https://avatars.githubusercontent.com/u/248290?v=4"
},
{
"type": "User",
"login": "milmazz",
"commits": 20,
"avatar_url": "https://avatars.githubusercontent.com/u/34700?v=4"
},
{
"type": "User",
"login": "josevalim",
"commits": 16,
"avatar_url": "https://avatars.githubusercontent.com/u/9582?v=4"
},
{
"type": "User",
"login": "maennchen",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/333918?v=4"
},
{
"type": "User",
"login": "fteem",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/854173?v=4"
},
{
"type": "User",
"login": "gfvcastro",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/10352597?v=4"
},
{
"type": "User",
"login": "whatyouhide",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/3890250?v=4"
}
],
"contributors_sampled": 99,
"top_contributor_share": 0.731
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"codeql.yml",
"main.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"mix.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 1,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 4,
"reason": "Found 11/25 approved changesets -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 28 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "11 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "0eb1763fa232e8d274c70e99ec3110b55eadd16b",
"ran_at": "2026-07-25T22:12:34Z",
"aggregate_score": 6.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": true,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T20:18:54Z",
"oldest_open_prs": [
{
"number": 1139,
"created_at": "2026-04-13T01:55:59Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1181,
"created_at": "2026-06-16T18:57:34Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-21T20:18:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 1048,
"created_at": "2024-08-13T20:13:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1105,
"created_at": "2025-04-07T19:23:20Z",
"last_comment_at": "2026-06-16T20:01:50Z",
"last_comment_author": "maennchen"
},
{
"number": 1186,
"created_at": "2026-06-17T16:01:24Z",
"last_comment_at": "2026-06-30T17:15:49Z",
"last_comment_author": "josevalim"
},
{
"number": 1188,
"created_at": "2026-06-17T17:48:07Z",
"last_comment_at": "2026-07-02T06:02:51Z",
"last_comment_author": "thbar"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/hexpm/hex",
"host": "github.com",
"name": "hex",
"owner": "hexpm"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"security": 69,
"vitality": 87,
"community": 62,
"governance": 62,
"engineering": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 87,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 83,
"inputs": {
"commits_last_year": 135,
"human_commit_share": 0.81,
"days_since_last_push": 4,
"active_weeks_last_year": 28
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "28/52 weeks with commits",
"points": 19.4,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 28
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "135 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 135
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 85,
"latest_release_tag": "v2.5.1",
"releases_from_tags": false,
"days_since_latest_release": 15,
"mean_days_between_releases": 47.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "85 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 85
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 15 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 15
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~47.4 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 47.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 4,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 4 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 4
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 62,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "good",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"forks": 207,
"stars": 1084,
"watchers": 26,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1,084 stars",
"points": 49.2,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 1084
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "207 forks",
"points": 19.3,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 207
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "26 watchers",
"points": 7.8,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 26
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "at_risk",
"name": "Community health",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 39,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 99,
"top_contributor_share": 0.731
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 73% of commits",
"points": 6.1,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 73
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "99 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 99
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 28 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 87,
"inputs": {
"merged_prs": 534,
"open_issues": 4,
"closed_issues": 605,
"issue_closed_ratio": 0.993,
"closed_unmerged_prs": 53
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "99% of issues closed",
"points": 46.4,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 99
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "534/587 decided PRs merged",
"points": 34.8,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 534,
"decided": 587
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 11/25 approved changesets -- score normalized to 4",
"points": 6,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"followers": 129,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "hexpm",
"public_repos": 16,
"account_age_days": 4550
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "129 followers of hexpm",
"points": 15.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 129,
"login": "hexpm"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "16 public repos, account ~12 yr old",
"points": 21,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 16
}
},
{
"code": "account_age_years",
"params": {
"years": 12
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 71,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"hacktoberfest",
"elixir",
"erlang",
"package-manager"
],
"has_wiki": true,
"homepage": "https://hex.pm",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://hex.pm",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "4 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 4
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 69,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 69,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 6.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 11/25 approved changesets -- score normalized to 4",
"points": 3,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 28 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "11 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 28
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 52,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.79,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "64 of 81 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 64,
"sampled": 81
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"mix.lock"
],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.01,
"toolchain_manifests": [
"mix.exs",
"test/fixtures/diff/mix.exs",
"test/fixtures/ecto/mix.exs",
"test/fixtures/ecto_3_3_1/mix.exs",
"test/fixtures/ecto_3_3_2/mix.exs",
"test/fixtures/ecto_enum_1_4_0/mix.exs",
"test/fixtures/ecto_override/mix.exs",
"test/fixtures/ecto_sql_3_3_2/mix.exs",
"test/fixtures/ecto_sql_3_3_3/mix.exs",
"test/fixtures/ex_doc/mix.exs",
"test/fixtures/has_hex_dep/mix.exs",
"test/fixtures/override_with_path/mix.exs",
"test/fixtures/sample/mix.exs",
"test/fixtures/umbrella/apps/my_app1/mix.exs",
"test/fixtures/umbrella/apps/my_app2/mix.exs",
"test/fixtures/umbrella/apps/my_app3/mix.exs",
"test/fixtures/umbrella/mix.exs",
"test/fixtures/umbrella_override/apps/my_app1/mix.exs",
"test/fixtures/umbrella_override/mix.exs"
],
"dependency_bot_commit_share": 0.19
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "mix.exs, test/fixtures/diff/mix.exs, test/fixtures/ecto/mix.exs (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "mix.exs, test/fixtures/diff/mix.exs, test/fixtures/ecto/mix.exs"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "1 of the last 100 commits agent-authored or agent-credited",
"points": 2,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "19 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 19,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Elixir",
"largest_source_bytes": 34595,
"source_files_sampled": 164,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Elixir without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Elixir"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/164 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 164,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"sample"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "sample",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "sample"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch hex package 'hex' from its registry"
],
"report_type": "repository",
"generated_at": "2026-07-25T22:13:00.373581Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/h/hexpm/hex.svg",
"full_name": "hexpm/hex",
"license_state": "absent",
"license_spdx": null
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with hexpm/hex. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
