公开记录良好
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-25 22:13 UTC
hexpm / hex
Package manager for the Erlang ecosystem.
hexpm/hex 的健康指数为 100 分中的 70 分，处于「良好」区间。 其得分最高的类别是Vitality（87/100），最低的是AI Readiness（52/100）。 最近一次更新在 4 天前。 近期的大部分工作由 1 位贡献者完成。
70
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
70
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
87
开发活跃度
83良好
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 4 天前 |
| 19.4/36 | 提交节奏 — 52 周中有 28 周有提交 |
| 18/18 | 提交量 — 最近一年 135 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 135 |
| human_commit_share | 0.81 |
| days_since_last_push | 4 |
| active_weeks_last_year | 28 |
发布纪律
92优秀
评分方式
| 27/27 | 有发布版本 — 已发布 85 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 15 天前 |
| 19.8/27 | 发布节奏 — 约每 47.4 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 85 |
| latest_release_tag | v2.5.1 |
| releases_from_tags | 否 |
| days_since_latest_release | 15 |
| mean_days_between_releases | 47.4 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
62
流行度与采用
76良好
评分方式
| 49.2/60 | 星标 — 1,084 个星标 |
| 19.3/25 | 复刻 — 207 个复刻 |
| 7.8/15 | 关注者 — 26 位关注者 |
所用输入
| forks | 207 |
| stars | 1,084 |
| watchers | 26 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
47存在风险
评分方式
| 22.5/22.5 | README |
| 0/22.5 | 许可证 — 未检测到许可证文件 |
| 0/18 | CONTRIBUTING 指南 |
| 13.5/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 6.3/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 否 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 是 |
| has_pull_request_template | 是 |
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
62
维护者韧性（巴士系数）
39存在风险
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 6.1/22.5 | 提交分布 — 头号贡献者编写了 73% 的提交 |
| 13.5/13.5 | 贡献者广度 — 99 位贡献者 |
| 10/10 | OpenSSF Scorecard：Contributors — project has 28 contributing companies or organizations |
所用输入
| bus_factor | 1 |
| contributors_sampled | 99 |
| top_contributor_share | 0.731 |
议题与 PR 响应能力
87优秀
评分方式
| 46.4/46.8 | 议题解决 — 99% 的议题已关闭 |
| 34.8/38.3 | PR 接受 — 已裁定的 PR 中 534/587 已合并 |
| 6/15 | OpenSSF Scorecard：Code-Review — Found 11/25 approved changesets -- score normalized to 4 |
所用输入
| merged_prs | 534 |
| open_issues | 4 |
| closed_issues | 605 |
| issue_closed_ratio | 0.993 |
| closed_unmerged_prs | 53 |
所有权与托管责任
66中等
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 15.2/25 | 所有者影响力 — hexpm 有 129 位关注者 |
| 21/25 | 既往记录 — 16 个公开仓库，账户约 12 年 |
所用输入
| followers | 129 |
| owner_type | Organization |
| is_verified | — |
| owner_login | hexpm |
| public_repos | 16 |
| account_age_days | 4,550 |
工程质量
基础的工程与文档实践是否到位？
71
工程实践
68中等
评分方式
| 24/24 | CI 工作流 — 2 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 26 out of 26 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
75良好
评分方式
| 30/30 | README |
| 0/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://hex.pm |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 4 个主题标签 |
| 10/10 | Wiki |
所用输入
| topics | hacktoberfest, elixir, erlang, package-manager |
| has_wiki | 是 |
| homepage | https://hex.pm |
| has_readme | 是 |
| has_docs_dir | 否 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
69
安全态势
69中等
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0.8/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 2.5/2.5 | CI-Tests — 26 out of 26 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 3/7.5 | Code-Review — Found 11/25 approved changesets -- score normalized to 4 |
| 2.5/2.5 | Contributors — project has 28 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 0/2.5 | 许可证 — license file not detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — 无数据 |
| 5/5 | Pinned-Dependencies — all dependencies are pinned |
| 5/5 | SAST — SAST tool is run on all commits |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 7.5/7.5 | Token-Permissions — GitHub workflow tokens follow principle of least privilege |
| 0/7.5 | Vulnerabilities — 11 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 6.9 |
已排除计分（无数据或不适用）：packaging, signed_releases。 其余权重已重新归一化。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
52
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 81 次人类提交中有 64 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.79 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 12.6/18 | 一条命令的引导启动 — mix.exs, test/fixtures/diff/mix.exs, test/fixtures/ecto/mix.exs（工具链约定，无任务运行器） |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 0/11 | 静态类型检查 |
| 10/10 | 可复现环境 — lockfile |
| 2/10 | 已体现的代理实践 — 最近 100 次提交中有 1 次由代理编写或署名代理 |
| 8/8 | 自动化维护 — 最近 100 次提交中有 19 次为自动依赖更新 |
| 10/10 | OpenSSF Scorecard：Pinned-Dependencies — all dependencies are pinned |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | mix.lock |
| has_dockerfile | 否 |
| typed_language | 否 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | — |
| agent_commit_share | 0.01 |
| toolchain_manifests | mix.exs, test/fixtures/diff/mix.exs, test/fixtures/ecto/mix.exs, test/fixtures/ecto_3_3_1/mix.exs, test/fixtures/ecto_3_3_2/mix.exs, test/fixtures/ecto_enum_1_4_0/mix.exs, test/fixtures/ecto_override/mix.exs, test/fixtures/ecto_sql_3_3_2/mix.exs, test/fixtures/ecto_sql_3_3_3/mix.exs, test/fixtures/ex_doc/mix.exs, test/fixtures/has_hex_dep/mix.exs, test/fixtures/override_with_path/mix.exs, test/fixtures/sample/mix.exs, test/fixtures/umbrella/apps/my_app1/mix.exs, test/fixtures/umbrella/apps/my_app2/mix.exs, test/fixtures/umbrella/apps/my_app3/mix.exs, test/fixtures/umbrella/mix.exs, test/fixtures/umbrella_override/apps/my_app1/mix.exs, test/fixtures/umbrella_override/mix.exs |
| dependency_bot_commit_share | 0.19 |
面向模型的代码可读性
55中等
评分方式
| 0/45 | 可类型检查的代码 — Elixir，未配置类型检查 |
| 55/55 | 可控的文件大小 — 采样的 164 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | Elixir |
| largest_source_bytes | 34,595 |
| source_files_sampled | 164 |
| oversized_source_files | 0 |
机器可读接口
40存在风险
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 0/20 | MCP 服务器 |
| 40/40 | 可运行示例 — sample |
所用输入
| example_dirs | sample |
| has_mcp_signal | 否 |
| api_schema_files | — |
关键数据
1,084GitHub 星标
99贡献者
135最近 12 个月提交数
4距最近推送天数
85发布版本数
1巴士系数（bus factor）
4开放议题
Hex软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- Could not fetch hex package 'hex' from its registry
更多细节
Star 与 Fork 历史 0 ★ / 207 ⇿
0Star
207Fork
85发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 2次版本 22修订 61
每个点涵盖 12 天。
OpenSSF Scorecard 6.9 / 10
6.9综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 1 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 10 | CI-Tests | 26 out of 26 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 4 | Code-Review | Found 11/25 approved changesets -- score normalized to 4 |
| 10 | Contributors | project has 28 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 0 | License | license file not detected |
| 10 | Maintained | 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 |
| 不适用 | Packaging | packaging workflow not detected |
| 10 | Pinned-Dependencies | all dependencies are pinned |
| 10 | SAST | SAST tool is run on all commits |
| 10 | Security-Policy | security policy file detected |
| 不适用 | Signed-Releases | no releases found |
| 10 | Token-Permissions | GitHub workflow tokens follow principle of least privilege |
| 0 | Vulnerabilities | 11 existing vulnerabilities detected |
直接依赖 9
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| Hex | bypass | ~> 2.0 | mix.exs |
| Hex | cowboy | ~> 2.14 | mix.exs |
| Hex | mime | ~> 1.0 | mix.exs |
| Hex | mox | ~> 1.0 | mix.exs |
| Hex | plug | ~> 1.18 | mix.exs |
| Hex | plug_cowboy | ~> 2.7 | mix.exs |
| Hex | ok | — | mix.exs |
| Hex | cached_deps | — | mix.exs |
| Hex | cached_deps | — | mix.exs |
全部依赖 0
来自 GitHub 依赖图的完整解析依赖集合：0 个直接依赖与 0 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。
| 注册表 | 软件包 | 版本 | 关系 |
|---|
依赖安全公告 未评估
本报告未能完成公告比对：No resolved dependencies to assess
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"hacktoberfest",
"elixir",
"erlang",
"package-manager"
],
"is_fork": false,
"size_kb": 4910,
"has_wiki": true,
"homepage": "https://hex.pm",
"languages": {
"Shell": 16452,
"Elixir": 919116,
"Erlang": 669353
},
"pushed_at": "2026-07-21T20:18:09Z",
"created_at": "2013-12-23T17:15:00Z",
"owner_type": "Organization",
"updated_at": "2026-07-22T12:20:31Z",
"description": "Package manager for the Erlang ecosystem.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "Elixir",
"significant_languages": [
"Elixir",
"Erlang"
]
},
"owner": {
"blog": "https://hex.pm",
"name": "Hex",
"type": "Organization",
"login": "hexpm",
"company": null,
"location": "In the tubes",
"followers": 129,
"avatar_url": "https://avatars.githubusercontent.com/u/6621265?v=4",
"created_at": "2014-02-08T01:34:53Z",
"is_verified": null,
"public_repos": 16,
"account_age_days": 4550
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2026-07-09T23:17:14Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2026-06-29T02:07:07Z"
},
{
"tag": "v2.4.2",
"kind": "patch",
"published_at": "2026-04-30T18:11:08Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2026-03-24T18:39:53Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2026-03-14T20:29:30Z"
},
{
"tag": "v2.3.2",
"kind": "patch",
"published_at": "2026-02-27T16:06:48Z"
},
{
"tag": "v2.3.1",
"kind": "patch",
"published_at": "2025-10-26T20:11:04Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2025-10-26T17:42:10Z"
},
{
"tag": "v2.2.2",
"kind": "patch",
"published_at": "2025-06-27T09:14:31Z"
},
{
"tag": "v2.2.1",
"kind": "patch",
"published_at": "2025-05-09T13:03:16Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2025-05-09T12:10:46Z"
},
{
"tag": "v2.1.1",
"kind": "patch",
"published_at": "2024-05-22T17:21:29Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2024-05-21T14:31:16Z"
},
{
"tag": "v2.0.6",
"kind": "patch",
"published_at": "2023-02-06T17:59:28Z"
},
{
"tag": "v2.0.5",
"kind": "patch",
"published_at": "2023-02-06T16:36:05Z"
},
{
"tag": "v2.0.4",
"kind": "patch",
"published_at": "2023-02-02T01:41:02Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2023-02-01T23:29:47Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2023-01-30T12:18:19Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2023-01-09T17:28:47Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2022-10-30T15:28:34Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2021-12-14T23:08:28Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2021-12-13T20:31:11Z"
},
{
"tag": "v0.21.3",
"kind": "patch",
"published_at": "2021-09-18T14:51:13Z"
},
{
"tag": "v0.21.2",
"kind": "patch",
"published_at": "2021-04-14T14:29:40Z"
},
{
"tag": "v0.21.1",
"kind": "patch",
"published_at": "2021-01-15T16:21:13Z"
},
{
"tag": "v0.21.0",
"kind": "minor",
"published_at": "2021-01-14T22:55:08Z"
},
{
"tag": "v0.20.6",
"kind": "patch",
"published_at": "2021-01-14T22:54:31Z"
},
{
"tag": "v0.20.5",
"kind": "patch",
"published_at": "2020-02-05T00:16:28Z"
},
{
"tag": "v0.20.4",
"kind": "patch",
"published_at": "2020-02-04T00:36:09Z"
},
{
"tag": "v0.20.3",
"kind": "patch",
"published_at": "2020-02-03T23:06:10Z"
},
{
"tag": "v0.20.2",
"kind": "patch",
"published_at": "2020-02-03T22:03:28Z"
},
{
"tag": "v0.20.1",
"kind": "patch",
"published_at": "2019-06-10T18:17:07Z"
},
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2019-06-09T12:38:15Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2019-01-15T21:14:15Z"
},
{
"tag": "v0.18.2",
"kind": "patch",
"published_at": "2018-11-08T09:00:23Z"
},
{
"tag": "v0.18.1",
"kind": "patch",
"published_at": "2018-07-06T09:15:37Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2018-07-05T19:52:03Z"
},
{
"tag": "v0.17.8",
"kind": "patch",
"published_at": "2018-07-01T14:09:13Z"
},
{
"tag": "v0.17.7",
"kind": "patch",
"published_at": "2018-04-19T22:26:46Z"
},
{
"tag": "v0.17.6",
"kind": "patch",
"published_at": "2018-04-18T17:01:00Z"
},
{
"tag": "v0.17.5",
"kind": "patch",
"published_at": "2018-04-18T16:46:41Z"
},
{
"tag": "v0.17.4",
"kind": "patch",
"published_at": "2018-04-18T16:02:20Z"
},
{
"tag": "v0.17.3",
"kind": "patch",
"published_at": "2018-01-16T23:18:21Z"
},
{
"tag": "v0.17.2",
"kind": "patch",
"published_at": "2018-01-16T14:05:12Z"
},
{
"tag": "v0.17.1",
"kind": "patch",
"published_at": "2018-01-16T14:05:27Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2018-01-16T14:07:23Z"
},
{
"tag": "v0.16.1",
"kind": "patch",
"published_at": "2018-01-16T14:11:18Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2018-01-16T14:11:34Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2018-01-16T14:11:53Z"
},
{
"tag": "v0.14.1",
"kind": "patch",
"published_at": "2018-01-16T14:12:13Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2018-01-16T14:12:30Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2018-01-16T14:12:46Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2018-01-16T14:12:58Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2018-01-16T14:13:21Z"
},
{
"tag": "v0.12.1",
"kind": "patch",
"published_at": "2018-01-16T14:13:36Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2018-01-16T14:13:48Z"
},
{
"tag": "v0.11.5",
"kind": "patch",
"published_at": "2018-01-16T14:14:13Z"
},
{
"tag": "v0.11.4",
"kind": "patch",
"published_at": "2018-01-16T14:14:33Z"
},
{
"tag": "v0.11.3",
"kind": "patch",
"published_at": "2018-01-16T14:14:46Z"
},
{
"tag": "v0.11.2",
"kind": "patch",
"published_at": "2018-01-16T14:14:59Z"
},
{
"tag": "v0.11.1",
"kind": "patch",
"published_at": "2018-01-16T14:15:23Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2018-01-16T14:15:34Z"
},
{
"tag": "v0.10.4",
"kind": "patch",
"published_at": "2018-01-16T14:27:07Z"
},
{
"tag": "v0.10.3",
"kind": "patch",
"published_at": "2018-01-16T14:27:18Z"
},
{
"tag": "v0.10.2",
"kind": "patch",
"published_at": "2018-01-16T14:27:31Z"
},
{
"tag": "v0.10.1",
"kind": "patch",
"published_at": "2018-01-16T14:27:47Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2018-01-16T14:28:00Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2018-01-16T14:28:13Z"
},
{
"tag": "v0.8.3",
"kind": "patch",
"published_at": "2018-01-16T14:28:29Z"
},
{
"tag": "v0.8.2",
"kind": "patch",
"published_at": "2018-01-16T14:28:42Z"
},
{
"tag": "v0.8.1",
"kind": "patch",
"published_at": "2018-01-16T14:28:54Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2018-01-16T14:29:06Z"
},
{
"tag": "v0.7.5",
"kind": "patch",
"published_at": "2018-01-16T14:29:19Z"
},
{
"tag": "v0.7.4",
"kind": "patch",
"published_at": "2018-01-16T14:29:29Z"
},
{
"tag": "v0.7.3",
"kind": "patch",
"published_at": "2018-01-16T14:29:39Z"
},
{
"tag": "v0.7.2",
"kind": "patch",
"published_at": "2018-01-16T14:29:52Z"
},
{
"tag": "v0.7.1",
"kind": "patch",
"published_at": "2018-01-16T14:31:22Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2018-01-16T14:31:34Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2018-01-16T14:31:45Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2018-01-16T14:31:58Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2018-01-16T14:32:14Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2018-01-16T14:32:31Z"
},
{
"tag": "v0.4.3",
"kind": "patch",
"published_at": "2018-01-16T14:32:38Z"
},
{
"tag": "v0.4.2",
"kind": "patch",
"published_at": "2018-01-16T14:32:53Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2018-01-16T14:33:06Z"
}
],
"recent_commits": [
{
"oid": "0eb1763fa232e8d274c70e99ec3110b55eadd16b",
"body": "The stored-key deprecation warning recommends mix hex.organization auth\nORG --key KEY, but following it did not silence the warning because the\nclient could not tell an organization-owned key from a user-owned key\nonce stored.\n\nExtract the key owner from the GET /api/auth response when verifying the\n[…]\nge, user\nkeys warn that they stop working in Hex 2.6, and keys stored before this\nversion keep warning until the command is re-run. Servers that respond\n204 without owner information behave as before.",
"is_bot": false,
"headline": "Record key ownership when authenticating organizations (#1207)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-21T20:18:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a9d3d7cdf88eba56fecd59d41a7db15f18f20696",
"body": "Bumps the codeql group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.36.3 to 4.37.0\n- [Release notes](https://github.com/github/codeql-acti\n[…]\nype: version-update:semver-minor\n dependency-group: codeql\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump the codeql group with 2 updates (#1206)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T15:50:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f19416264f7f408adb84ea251afd88d634df9ea4",
"body": "Carry the lock repository through to build_diff_link/1 so `mix hex.outdated`\nemits repository-qualified comparisons (ORG/name:from:to) for organization\npackages and skips packages from custom repositories that hex.pm cannot diff.\nRepository-qualified links are never shortened, so organization and package\nnames are not exposed through an unauthenticated short-URL redirect.",
"is_bot": false,
"headline": "Support organization packages in the outdated diffs link (#1205)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-19T16:59:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e36cdf1eccb54ef6439652687d7dc43daaeeeedc",
"body": null,
"is_bot": false,
"headline": "Link to the hex.pm diffs page in mix hex.outdated (#1204)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-19T16:08:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22bb0af948d5f213939dcf8adf4078539f08133f",
"body": "Add a --format sarif option that renders the audit result as a SARIF\nv2.1.0 document, plus an --output PATH option to write it to a file\ninstead of stdout. This allows uploading audit findings to GitHub code\nscanning and other SARIF consumers; the moduledoc documents a complete\nGitHub Actions workfl\n[…]\nincluded with a suppression so they show up as closed alerts.\n\nThe exit code behaves the same as with the human format. SARIF output\nrequires the OTP 27 :json module, matching mix hex.outdated --json.",
"is_bot": false,
"headline": "Add SARIF output format to mix hex.audit (#1203)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-07-18T20:27:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "29b5731c7bace752b87edb8ec16ec100ba6c7a3b",
"body": "Hex.Shell.warn/1 wrote to stdout via Mix.shell().info/1, so warnings\nlike the expired-authentication notice or the stale mix.lock version\nwarning polluted machine-readable stdout output such as\n`mix hex.outdated --json`. Route warn/1 through Mix.shell().error/1,\nwhich prints to stderr, keeping the y\n[…]\nar stdout\noutput (the retirement reason in the `mix deps.get` dependency\nlisting and the retirement notice in `mix hex.info`) stay on stdout\nand are now printed as yellow-formatted info lines instead.",
"is_bot": false,
"headline": "Print warnings to stderr instead of stdout (#1202)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-07-18T20:00:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d61c28a8a9e12ec3f38c06ee31d857361c709d30",
"body": "Dependabot opened separate PRs for the init and analyze sub-actions,\nleaving them on mismatched versions. The analyze step refuses to run\nwhen its version differs from the config written by init, so neither\nPR could pass CI. Grouping the updates keeps both pins in lockstep.",
"is_bot": false,
"headline": "Group codeql-action Dependabot updates and bump to v4.36.3 (#1201)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-10T00:54:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb0a930647d651f25fe1ca9611db649fabb19ef5",
"body": null,
"is_bot": false,
"headline": "Bump to v2.5.2-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-09T23:31:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a43131c26aeca06064959297d737991163f5ac5d",
"body": null,
"is_bot": false,
"headline": "Release v2.5.1",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-09T23:13:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "49155dc0d6b2e4d47861531ea6f4ca97694962b1",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.24.0 to 1.24.1.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/fc68ffb90438ef2936bbb3251622353b3dcb2f93...54075bcc5e249e4758d363f27d099f55d843f124)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.24.0 to 1.24.1 (#1200)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-09T22:58:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ce453a6ad05f0396140386334acee9104f390067",
"body": "* Suppress whole aliased advisory groups when ignoring advisories\n\n* Show config source in stale ignore warnings",
"is_bot": false,
"headline": "Improve advisory ignore matching and stale ignore warnings (#1199)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-02T00:56:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "594ac3d3c4ca727eac6087adc21145eef3435df1",
"body": "* Add Hex.Ignores config parsing\n\n* Add Hex.Ignores advisory and retirement matching\n\n* Add ignore_advisories and ignore_retirements configs\n\n* Support ignoring advisories and retirements in mix hex.audit\n\n* Skip ignored advisories and retirements in mix deps.get output\n\n* Document ignore_advisories and ignore_retirements",
"is_bot": false,
"headline": "Add ignore_advisories and ignore_retirements configs (#1198)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-02T00:36:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f38ba599ee4771b84e4f724e2f8717e19829525",
"body": "List each package override (package, requirement, ALLOW/DENY) in the\nper-repository output of mix hex.policy show instead of only printing a\ncount, and render a (none) placeholder when a repository has no\noverrides. Drop the implicit show default so a bare mix hex.policy now\nraises the usage message\n[…]\n: https://claude.ai/code/session_01MQ7G74DcZPFPEgDJMTEcCR\n\nCo-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: list package overrides in mix hex.policy show (#1193)",
"author_name": "Matt Van Horn",
"author_login": "mvanhorn",
"committed_at": "2026-07-01T23:12:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a3521ea55de50433c644576a8b8798c3213fb440",
"body": "* Replace regex with Integer.parse in cooldown duration parsing\n\nRegex literals are compiled into beam files, and the compiled PCRE\npattern format is not portable across OTP versions. An archive built\non OTP 28.1+ embeds patterns that load via :re.import/1, which does\nnot exist on OTP <= 28.0, crash\n[…]\nerns\nregexes are unaffected; they are built in the user's project at\nruntime and never embedded in Hex's beams.\n\n* Add lint test rejecting regexes in shipped code\n\n* Update CHANGELOG for regex removal",
"is_bot": false,
"headline": "Remove regexes from compiled code (#1197)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-07-01T23:07:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "90f215ab1c6cca90bf0e0d83e52dc8e3a6d6eb1c",
"body": null,
"is_bot": true,
"headline": "Bump actions/checkout from 6.0.3 to 7.0.0 (#1195)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T02:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68e842f40cd50475734a3e2dbf8890c6f2bd8426",
"body": null,
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#1196)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-30T02:08:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7ea3bef3f3cb69669c5d9f7c3b8cf193da12ef4",
"body": null,
"is_bot": false,
"headline": "Bump to v2.5.1-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T02:21:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7993e9239b5c9dea91a98042f7786e471e56b6cf",
"body": null,
"is_bot": false,
"headline": "Release v2.5.0",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T02:04:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e550bb6d60fe49a9ffeb451f3fbc50a8e6b3570f",
"body": null,
"is_bot": false,
"headline": "Bump CI to released Elixir 1.20.2 (#1192)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T02:02:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8111a13aa8fe6e5ceb488193ae2187712a02c70",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG for v2.5.0-dev (#1183)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-29T01:39:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52b0287d65c51708e54d75badf995ab26824f9fd",
"body": "When resolution fails under an active policy, the per-package failure\nnote and the post-solve policy summary both rendered the hidden-version\nlisting, so it printed twice. On the failure path the summary now\ncontributes only the active-policy header; the failure note remains the\nsingle listing.\n\nCloses #1187",
"is_bot": false,
"headline": "Fix duplicated policy version listing on resolution failure (#1191)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-18T11:02:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "101f697f8fa7f5ba368c821df148751d3043add3",
"body": "mix hex.policy show and why now highlight the active policy with ANSI colors: the policy name and rule values, ALLOWED/BLOCKED status, and per-reason colors (advisory, retirement, cooldown). The \"Versions filtered by cooldown\" summary printed during mix deps.get highlights the package, version, and eligible date.\n\nAlso shorten the cooldown summary line to \"PKG VSN — eligible DATE\", dropping the redundant \"published N days ago\" — the eligible date is the actionable part.",
"is_bot": false,
"headline": "Colorize hex.policy and cooldown output (#1189)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T21:26:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0ab6bc5444365798ce89c2f3bf134cafe1728cf",
"body": "An expired global OAuth token whose refresh the server rejects was refreshed once per package during dependency resolution -- dozens of failed POSTs to /oauth/token, serialized by the token-refresh lock -- and the failure was swallowed, so resolution silently continued without credentials. This regr\n[…]\nailure can recover on the next run) and warn once that the session expired and to re-run `mix hex.user auth`. With the token gone, the rest of the run stops retrying the refresh.\n\nRe-vendors hex_core.",
"is_bot": false,
"headline": "Clear the OAuth token and warn when its refresh fails (#1184)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T15:52:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "16809f6be13f77936963a445900196336fc6bf39",
"body": "get_policy/3 now goes through Hex.Auth.with_repo/3 with optional: true, like get_package/3, instead of calling :mix_hex_repo.get_policy directly. It authenticates when credentials are available and fetches anonymously otherwise, so a public policy can be resolved without authenticating to the organization.",
"is_bot": false,
"headline": "Fetch dependency policies with optional repository auth (#1185)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T15:46:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f431e47818fc1013babe5f4d4f3b1a3be8d3bfdf",
"body": "* Re-vendor hex_core from the policy-rules branch\n\nPull in the restructured Policy resource: a Policy now carries a repeated\nRepositoryPolicy (\"tab\") per repository it constrains, each with an optional\nbaseline Restriction (advisory_min_severity, retirement_reasons, cooldown) and\na list of allow/den\n[…]\ncument that rejecting the bare hexpm repo is deliberate and would be\nrelaxed if a global policy is ever served directly under hexpm.\n\n---------\n\nCo-authored-by: Jonatan Männchen <jonatan@maennchen.ch>",
"is_bot": false,
"headline": "Dependency policies (#1168)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-17T09:36:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "69253211fa361fc83f8dbd7061ae9254d8a2c4f1",
"body": "The HEX_REPOS_KEY/stored-key deprecation warning also fired for the base\nhexpm repository, telling users of trusted mirrors (which authenticate with\nHEX_REPOS_KEY) that their key would be removed. Only the use of these keys\nfor organization repositories is deprecated — HEX_REPOS_KEY still\nauthenticates the base hexpm repository and trusted mirrors. Warn only for\norganization repositories.",
"is_bot": false,
"headline": "Only warn about deprecated keys for organization repositories (#1182)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-16T20:06:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3de1df34b1ecc02a3ec99b3518d07dcb180dccff",
"body": "* Fix crash when a server sends an x-hex-message header\n\nResponse headers are decoded to binaries, but handle_hex_message/1 ran\n:binary.list_to_bin/1 on the value, which requires a charlist and raised\n\"not an iodata term\", failing the request. Use IO.iodata_to_binary/1,\nwhich accepts both binaries a\n[…]\ne printed to the terminal, so an\nuntrusted server could embed ANSI escapes or bidirectional overrides.\nEscape control characters before printing while keeping printable text,\nnewlines and tabs intact.",
"is_bot": false,
"headline": "Fix crash when a server sends an x-hex-message header (#1180)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-16T19:39:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cda8717f34a14349778bbe9fe7b153043d70d002",
"body": "* Adopt :hex_repo.fingerprint\n\n* Refactor Code to use hex_cli_auth",
"is_bot": false,
"headline": "Update to use `hex_auth` module (#1143)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-06-16T19:28:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7fb9dd679a8f8d7d2c0214464a43b8a73eda9eab",
"body": "Authorizing an organization without --key, authenticating to a hexpm\nrepository with a stored key, and HEX_REPOS_KEY are deprecated in favour\nof `mix hex.user auth` for development and pre-generated organization\nkeys for CI. These paths still work but now emit a warning once per\ninvocation.",
"is_bot": false,
"headline": "Deprecate personal-key access to organization repositories (#1179)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-16T09:15:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3739607f20d066a75965a32b021a575a2ee60dad",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.36.0 to 4.36.2.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/7\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.36.0 to 4.36.2 (#1178)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-15T14:44:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0ec5a0d968ae8954a3760004e1f3a27de20d347d",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/checkout from 6.0.2 to 6.0.3 (#1177)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-15T14:43:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6f3f425318c2d23e34b5e964879c122a91c8f50b",
"body": "When the stored access token has expired and the refresh fails (for\nexample because the refresh token was consumed by a rotation from\nanother process or revoked by a re-authentication), repo requests were\nsilently sent without credentials. Public resources still resolve, so\nthe broken session goes u\n[…]\nvocation - the refresh result is cached in the\nOnceCache, so the warning naturally fires at most once - and tell the\nuser to run mix hex.user auth. Fully anonymous use (no stored tokens)\nstays silent.",
"is_bot": false,
"headline": "Warn when the OAuth session cannot be refreshed (#1176)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-12T11:17:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2386d5a75e48429fff3dee9c32c1ef095291923a",
"body": "* Build and publish Hex's own documentation\n\nHex's docs at https://hexdocs.pm/hex stopped at v2.2.1: the only publisher\nwas Bob's retired HexDocsChecker, and no release script ever built docs.\n\nAdd scripts/release_docs.sh, which builds the docs with ExDoc in a pinned\ncontainer and uploads the tarbal\n[…]\naennchen.ch>\n\n* Use new Hex logo for documentation\n\n* Use high-resolution Hex logo rendered from SVG source\n\n* Optimize Hex logo PNG\n\n---------\n\nCo-authored-by: Jonatan Männchen <jonatan@maennchen.ch>",
"is_bot": false,
"headline": "Build and publish Hex's own documentation (#1174)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-06-08T15:09:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3b1a7832faa530cbd03683e667939f4b74b0f9cb",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.5 to 4.36.0.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/9\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.5 to 4.36.0 (#1173)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-02T19:03:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "102afdcb6bc4363cce64b602dba4e4b52dd87ec4",
"body": "* Use subdomain URLs for hexpm package docs\n\nSwitch hexpm-repo docs URLs from `https://hexdocs.pm/PACKAGE/...`\nto `https://PACKAGE.hexdocs.pm/...`. Org-repo URLs are unchanged.\n\n* Map underscore to hyphen in hexdocs.pm subdomain URLs\n\nHex package names allow underscores. RFC 1123 hostname labels and\n[…]\nnue to be the storage key.\n\nApply the same mapping in the Hex CLI helpers that emit hexpm-repo\nsubdomain URLs. Org-repo branch is unchanged (hexorgs.pm is GKE and\ndoesn't enforce strict SAN matching).",
"is_bot": false,
"headline": "Use subdomain URLs for hexpm package docs (#1172)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-29T16:52:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ce6e3254beae57fecbc165d42d5a12fc6d18773",
"body": "* Annotate cooldown-held versions in mix hex.outdated\n\nShow \"(cooldown)\" alongside the status when the latest version of a\ndependency is within the configured cooldown window, with a \"Versions\nin cooldown\" legend below the table listing eligibility dates. The\nsingle-package output gets a similar lin\n[…]\nardless of\ncooldown — the (cooldown) tag was misleading. Strip the cooldown\nattachment for those rows so the status is just \"Update not possible\"\nand the version doesn't appear in the cooldown legend.",
"is_bot": false,
"headline": "Annotate cooldown-held versions in mix hex.outdated (#1171)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-28T14:10:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9e08746e02cafec2e9224f8320da9592450f14c5",
"body": null,
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#1170)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-26T11:44:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc607fe6e2a7bfa16b0f10c5f1f8689d083be663",
"body": null,
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.4 to 4.35.5 (#1169)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-26T11:43:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f4c120a2abb28450a027bfca4e44b0ecec4ab26a",
"body": "* update test matrix to include newer major and minor versions\n\n* test to see if yaml is truncating 29.0 to 29\n\n* Fix test fixtures for ecto 3.3.2 and ecto_sql 3.3.3\n\necto_3_3_2/mix.exs declared version \"3.3.1\" instead of \"3.3.2\", causing\nMix 1.20 to raise a nomatchvsn error when updating ecto_sql (\n[…]\ntest passes (masked), this test fails\n - 1.19.5 with fix: both pass\n - 1.20.0-rc.5 without fix: both fail\n - 1.20.0-rc.5 with fix: both pass\n\n* revert scm change an bump to stable 1.20\n\n* rc6",
"is_bot": false,
"headline": "Update test matrix to include newer major and minor versions (#1166)",
"author_name": "Chase Gilliam",
"author_login": "Ch4s3",
"committed_at": "2026-05-22T11:53:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b4e665d46be8a5f81e8cbbe4c3a67058a19cf133",
"body": "A configurable delay between when a package version is published and\nwhen it becomes eligible for selection during dependency resolution,\nto mitigate supply-chain attacks where a freshly compromised release\nis pulled into projects before it can be detected and retired.\n\nConfiguration:\n* New `cooldow\n[…]\n index, or self-hosted clones) are treated as\neligible. Empty env values (`HEX_COOLDOWN=`,\n`HEX_COOLDOWN_EXCLUDE_REPOS=`) fall through to the next source\ninstead of clobbering project / global config.",
"is_bot": false,
"headline": "Add release-age cooldown to dependency resolution (#1160)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-20T22:12:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "10072250c62792e72079ff196fbaa6bb12a9aec0",
"body": null,
"is_bot": false,
"headline": "Deduplicate aliased advisories (#1167)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-20T18:00:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70e17f7ae6c491f646c07b73b4a8b61737332925",
"body": "* Refactor hex.outdated\n\nThis unifies outdated dependency processing.\n\nAll behaviors should be the same, except for one edge case.\n\nIf there is only one dependency, the display will be the same as `single`. I'm not sure if that's an issue or not.\n\nAssuming that the current UI is not meant to be prog\n[…]\n The refactor accidentally made them apply when a single app\nwas specified, changing exit-code behavior for that path.\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Support json output (#1061)",
"author_name": "Tyler Witt",
"author_login": "TylerWitt",
"committed_at": "2026-05-19T16:46:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d1d4bcf4f07816eb1394766b699114bc236ac15",
"body": "* Move security advisory warning to post_converge\n\nLong deps.get / deps.update output could push the\n\"Found packages with security advisories\" line past\nthe scroll fold, hiding it. Move the summary to\npost_converge alongside the sponsor tip and point users\nback to the per-package advisory details above.\n\n* Move retired package warning to post_converge",
"is_bot": false,
"headline": "Move security advisory warning to post_converge (#1165)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-19T13:58:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf7407207427f710c806cd7037f624a68707b7d1",
"body": "Co-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Add --page and --format md to mix hex.docs (#1162)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2026-05-19T12:49:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "782c763d3a774167c8ba34dcd3edcd0db6ba4a4c",
"body": null,
"is_bot": false,
"headline": "Add mix hex.search QUERY (#1163)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2026-05-19T12:47:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0c92498270b7167668c96d88929f2d7cbbd1df06",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/e\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.3 to 4.35.4 (#1161)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-19T12:21:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4723f65427388eb5b749d369e3e2588c3971e49e",
"body": null,
"is_bot": false,
"headline": "Fix type warnings on Elixir v1.20 (#1164)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2026-05-19T11:09:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c02464d16a02dedc748a6ada4955c13b62b8a79",
"body": "* Warn on installation of vulnerable packages\n\n* Sync Hex.Dev ETS version, unify advisory rendering, and test deps.get advisory output\n\n- Bump `Hex.Dev.@ets_version` to 4 so registries extracted via\n `Hex.Dev.extract_registry/2` survive the version check in\n `Hex.Registry.Server.check_version/1`.\n\n[…]\n three times.\n- Add a test for Registry.prefetch/1 raising a Mix.Error in offline\n mode when a package is not cached.\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Warn on installation of vulnerable packages (#1150)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-05-14T22:44:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b145e8d5962463cca4427d1987d86c304145fc6e",
"body": "* Vendor hex_core 0.16.0\n\n* Update tarball test for hex_core 0.16.0 default files root\n\nhex_core 0.16.0 defaults `tarball_files_root` to `\".\"` and removed the\n`:missing_files_root` error, so the obsolete assertions for that error\nand for absolute paths inside the root no longer match. Keep the\nmismatched-archive-name symlink check, which is the integration coverage\nthat doesn't duplicate hex_core's own suite.\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Vendor hex_core 0.16.0 (#1157)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-05-14T16:04:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2961ec70c20ee82b9cf0205fda732ce0aa50ba3d",
"body": null,
"is_bot": false,
"headline": "Fix OTP archive root (#1156)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-13T01:15:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f996de41e2ca043a85ce137e7c28bd2ab9cd30c1",
"body": "* Validate package files in mix hex.build\n\n* Temporarily vendor tarball create validation\n\n* Delegate package file validation to hex_core\n\n* Sync root-relative tarball source validation\n\n* Vendor updated hex_core tarball files",
"is_bot": false,
"headline": "Validate package files in mix hex.build (#1153)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-13T00:22:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f7417ef38061a203fb6b65c211702d1025a16ad0",
"body": null,
"is_bot": false,
"headline": "Accept LicenseRef license identifiers (#1155)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-12T23:02:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12a46fe16d6e439d853c130070a95196b837c487",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/9\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.2 to 4.35.3 (#1152)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-12T11:15:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "115e4cc306c2afb4676b8528fe43f5b1086dd5a7",
"body": "The assertion locked in a 32-byte API key length. With hexpm now\nissuing hex_-prefixed v2 tokens (44 bytes) alongside v1 (32 bytes),\npinning the exact length makes the integration test brittle to\nhexpm-side format changes. Check that the secret is a non-empty\nstring and let the rest of the test verify the key actually works\nfor authentication.",
"is_bot": false,
"headline": "Loosen API key format assertion to is_binary + byte_size > 0 (#1151)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-05-09T21:07:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99f54a80727e372e239afbf6b1a2f371a3c58a64",
"body": null,
"is_bot": false,
"headline": "Move Fastly purge into release script and use fastly CLI",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:21:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "478def2db993dc98b7aa4b7e421a38a4988160e4",
"body": null,
"is_bot": false,
"headline": "Bump to v2.4.3-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9b8ecaa37ae3135359345143e41cffc5a7e13b5",
"body": null,
"is_bot": false,
"headline": "Release v2.4.2",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:10:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54b8cb0760905b473e0e9a8610f58aad5ddfb52e",
"body": null,
"is_bot": false,
"headline": "Update Fastly purge step in RELEASE.md",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T18:09:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d7528c8199a1144511508bf3a6460026a5a14c8e",
"body": "Checksum verification was not being performed due to a type mismatch\nin pattern matching. Comparing atom-based names against string-based\nlock data caused the verification to be silently skipped.\n\nFixes: GHSA-hmv9-4mfr-m92v\nFixes: CVE-2026-32148\n\nCo-authored-by: Jonatan Männchen <jonatan@maennchen.ch>\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Fix checksum verification for dependencies in mix.lock",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-30T17:55:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b5a1e942116ccab3d63ed3b6f0ed30421ce638d0",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2.\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.35.1 to 4.35.2 (#1149)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-27T22:54:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "573f566119059ff28f2f408e188f07cb53558a48",
"body": "The second-priority branch in build_hex_core_config attempted to exchange\nthe API key for an OAuth token whenever auth_key and trusted were set,\nrelying on the first branch to short-circuit for the disabled case. That\nleft the branch's condition incomplete: any state not caught by branch 1\nwould fir\n[…]\nh_exchange set, which resolve\nto an explicit nil).\n\nMake both branches self-gated on the oauth_exchange flag so the\nintent is local to each clause. Also clarify preflight comments in\nremote_converger.",
"is_bot": false,
"headline": "Gate API key to OAuth token exchange on oauth_exchange flag (#1148)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-24T14:04:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0d5d10d7af5a6a7ae47cefdebe0ced4a1a79d5f1",
"body": null,
"is_bot": false,
"headline": "Limit deps.get auth preflight and trust-gate user OAuth fallback (#1145)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-24T06:44:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8bb9ef5ffba50b142d8f7b9aa9f3eef3f279d7e0",
"body": null,
"is_bot": false,
"headline": "Show mix hex.package diff commands in hex.outdated output (#1137)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-23T07:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "022578d1a44f1cf5d4edfca9e56b15901bccec8d",
"body": "Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.2 to 0.5.3.\n- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)\n- [Commits](https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f3159\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 (#1144)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-20T21:56:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4370644a3214c0109fc40b62f91868c541b6a666",
"body": "…142)\n\nWaiters on Hex.OnceCache shared a hardcoded 5s default timeout while the\nunderlying HTTP call can take up to 15s. Under concurrent private package\nfetches in :hex_fetcher this caused all but the computing task to time out\nbefore the token exchange completed.\n\nUse a 60s timeout consistent with\n[…]\nx.OAuth with the same bound; the interactive device flow is invoked\nsequentially from check_and_refresh_auth before parallel fetches begin,\nso concurrent waiters only ever cover the HTTP refresh path.",
"is_bot": false,
"headline": "Set finite OnceCache timeout for OAuth token exchange and refresh (#1…",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-14T02:12:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3e5dd7932410a12238bfc460a18c4b59b2370b57",
"body": "Unpack both versions into a shared temporary parent directory and run\nthe diff command with that parent as the working directory, so output\nshows short relative paths like `ecto-3.13.4/...` instead of long\nabsolute tmp paths. Also drop git's `a/`/`b/` prefixes from the default\ndiff command via `--no-prefix`.",
"is_bot": false,
"headline": "Clean up paths in hex.package diff output (#1140)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-13T04:14:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34997a22d98921b74abd261624fb809877687365",
"body": "This adds download counts and release dates (provided by `hex.pm/api/packages/[package_name]`) to the `mix hex.info [package_name]` and `mix hex.info [package_name] [version]` commands.\n\nDownload counts for the overall package info include yesterday, last 7 days, and all-time. Showing the download n\n[…]\noads meant (it looks like it might be the last 8 releases), so I left that out of the download output.\n\nResolves #1128\n\n---------\n\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Add download stats and release dates to mix hex.info (#1130)",
"author_name": "Tyler A. Young",
"author_login": "s3cur3",
"committed_at": "2026-04-13T03:39:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5543a1919c709d8eb2b317f62aad76ca1eed375c",
"body": null,
"is_bot": false,
"headline": "Update to hex_core 0.15.0 (#1138)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-04-11T22:42:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "187a92118615deecccd798b2804e8b13a77b386f",
"body": "…(#1135) (#1136)\n\nThe `mix hex.organization auth` command should create a user-level key\nwith repository permissions scoped to the organization, not an\norganization-owned key. This was changed incorrectly in 5c039c3.",
"is_bot": false,
"headline": "Fix organization auth to create user key instead of organization key …",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-04-09T08:15:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff0eca4184526e9ae2f443a2931b9bd3b9403693",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.23.0 to 1.24.0.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/ee09b1e59bb240681c382eb1f0abc6a04af72764...fc68ffb90438ef2936bbb3251622353b3dcb2f93)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.23.0 to 1.24.0 (#1133)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-08T10:31:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "aa5f81af8616aadd0ab75b482a545b95280c9e9f",
"body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.4 to 4.35.1.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/8\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump github/codeql-action from 4.32.4 to 4.35.1 (#1132)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-04-08T10:30:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "720b5a409e98afec19d569ae3263b3b33454db9b",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.21.0 to 1.23.0.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/3580539ceec3dc05b0ed51e9e10b08eb7a7c2bb4...ee09b1e59bb240681c382eb1f0abc6a04af72764)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.21.0 to 1.23.0 (#1127)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-29T15:52:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "25d5c1a7cef6b16fcada67f94293399d0e187b9b",
"body": "… available (#1129)\n\nCloses #1106",
"is_bot": false,
"headline": "Change docs published message to indicate docs may not be immediately…",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-29T15:49:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74633a320e4f632eaab5d5bbd9addf10a922a3d1",
"body": null,
"is_bot": false,
"headline": "Filter expected error logs from cache handoff tests (#1126)",
"author_name": "Egor Mihnevich",
"author_login": "elfenlaid",
"committed_at": "2026-03-29T15:34:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6704968513dd474b034b745310003956015f7cd4",
"body": null,
"is_bot": false,
"headline": "Fix registry ets timestamp purging (#1125)",
"author_name": "Egor Mihnevich",
"author_login": "elfenlaid",
"committed_at": "2026-03-29T15:33:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7940feb54d242d7a963d7bb84bb10f28795ecbba",
"body": null,
"is_bot": false,
"headline": "Disable external git diff tool in tests (#1124)",
"author_name": "Egor Mihnevich",
"author_login": "elfenlaid",
"committed_at": "2026-03-29T15:32:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af9ff9076fa4681104a2fc1a16d3778d8241d638",
"body": null,
"is_bot": false,
"headline": "Update CA bundle",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-24T18:44:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "686d4cf94c4e50d8e82139674c57e89a0ffe56da",
"body": null,
"is_bot": false,
"headline": "Bump to v2.4.2-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-24T18:42:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d13a73440daef1a772bbbec2dcb6e66e106843be",
"body": null,
"is_bot": false,
"headline": "Release v2.4.1",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-24T18:39:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8886724c138c70fa049eaa0566e3219a1ac191eb",
"body": "…123)\n\nParallel package fetches each triggered an independent OAuth token\nexchange for the same repo, causing multiple calls to /api/oauth/token.\nUse Hex.OnceCache with a keyed fetch to ensure only one exchange per\nrepo+key combination, with concurrent tasks waiting for the result.",
"is_bot": false,
"headline": "Deduplicate OAuth token exchange during parallel package fetching (#1…",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-19T19:06:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4010feebd0722dc6c0f54c6c76c574c5003ae70c",
"body": "Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.0 to 0.5.2.\n- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)\n- [Commits](https://github.com/zizmorcore/zizmor-action/compare/0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d...71321a20a9ded102f6e9ce\n[…]\nirect:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (#1121)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-19T18:17:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1132784c2c2e628302c15cac38e971bf69d556ad",
"body": "Organization repos inherit config from their parent via\ndefault_organization but oauth_exchange and oauth_exchange_url were not\nbeing propagated. This meant org repos like hexpm:rtpacnroll never had\nthe oauth_exchange key set, falling back to the default of false in\nbuild_hex_core_config instead of inheriting true from hexpm.",
"is_bot": false,
"headline": "Propagate oauth_exchange to organization repos (#1122)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-18T16:51:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2520243dcf44dc8f750e077199f99317764ed3cf",
"body": "Compilation prunes code paths for isolation, which may remove archive\npaths like Hex. When a task like `format` triggers compilation and then\n`deps.get` runs in the same VM, Hex.Mix becomes unavailable.\n\nCall Mix.ensure_application!(:hex) to restore the code paths before\nconverging dependencies.\n\nCloses #1109",
"is_bot": false,
"headline": "Restore Hex code paths after compilation pruning (#1118)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-16T10:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84f2d67b49c5b97346d226a4e36455c75d4737cf",
"body": "Repos configured before v2.4.0 don't have the oauth_exchange key in\ntheir saved config. The default in build_hex_core_config was true,\ncausing hex to attempt OAuth token exchange for repos that don't\nsupport it (e.g. getoban.pro), resulting in :exchange_failed errors.\n\nChange the default to false. T\n[…]\nv2.4.0\nhave it explicitly set by the add command.\n\nAlso fix a test isolation issue where oauth_token from the user's\nactual ~/.hex/hex.config leaked into test state via init_reset_state.\n\nCloses #1119",
"is_bot": false,
"headline": "Fix OAuth exchange attempted for repos configured before v2.4.0 (#1120)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-16T10:54:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "11a8395516258ecce278a10f021565393a0f4b08",
"body": null,
"is_bot": false,
"headline": "Bump to v2.4.1-dev",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-14T20:32:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa621312067a6c4453d30415ed928f0957afd5d2",
"body": null,
"is_bot": false,
"headline": "Release v2.4.0",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-14T20:27:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52bef927db16ac227a149db9d5dbe90f5d5b7dc7",
"body": "Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.20.4 to 1.21.0.\n- [Release notes](https://github.com/erlef/setup-beam/releases)\n- [Commits](https://github.com/erlef/setup-beam/compare/e6d7c94229049569db56a7ad5a540c051a010af9...3580539ceec3dc05b0ed51e9e10b08eb7a7c2bb4)\n\n---\nupdat\n[…]\nirect:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump erlef/setup-beam from 1.20.4 to 1.21.0 (#1114)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-03-14T17:36:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ee2a27f66d6cc223aae016943aea2c6a3c92f5ef",
"body": "Warn instead of raising when OAuth authentication fails or is declined\nduring dependency resolution since the user may only need public packages.\nImprove the prompt message when re-authentication is needed. Add 401 to\nthe recognized error statuses in the registry server and suggest running\n`mix hex.user auth` when no authentication token is found.",
"is_bot": false,
"headline": "Improve authentication error handling for package fetching (#1116)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-14T17:36:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fa6b0a81653e6149ee20cf44a765246274b89d6",
"body": "Update organization doc URL functions to use hexorgs.pm. Public\n(hexpm/nil) URLs remain on hexdocs.pm.",
"is_bot": false,
"headline": "Migrate private docs URLs from *.hexdocs.pm to *.hexorgs.pm (#1115)",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-03-13T23:15:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af9fba29e3ca8c3dacb0d0bd85b64ae5e4235639",
"body": null,
"is_bot": false,
"headline": "Vendor hex_core v0.12.2",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-02-27T17:29:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9999e425d9c0f9fc8c53e7823eee898156c4d1a",
"body": null,
"is_bot": false,
"headline": "Fix unsafe deserialization of Erlang terms in API responses",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2026-02-27T17:24:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b797d12f47d22291e7a7f911528fe1646fe7d877",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 3.6.0 to 6.0.2.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v3.6.0...de0fac2e4500da\n[…]\nirect:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump actions/checkout from 3.6.0 to 6.0.2 (#1112)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-02-25T23:49:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b12887dfe995741c0361df4f2844f0138375317d",
"body": "* Add explicit permissions to CI workflow\n\nRestrict workflow permissions to read-only content access following\nGitHub security best practices.\n\n* Pin GitHub Actions to commit SHAs\n\nReplace mutable version tags with immutable commit hashes for\nactions/checkout and erlef/setup-beam to prevent supply c\n[…]\nits/#artipacked\n\n* Add CodeQL and Zizmor security scanning workflows\n\nAdd CodeQL for static analysis of GitHub Actions and Zizmor for\nworkflow security auditing. Runs on push, PR, and weekly schedule.",
"is_bot": false,
"headline": "Add GitHub Actions security scanning with CodeQL and zizmor (#1110)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-02-25T23:43:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "45bc7c2e0423d4bbd22ffae9b1d5ec152b6574c4",
"body": "Replace :erlang.binary_to_term with safe_binary_to_term! when parsing\nhex package manifests to restrict deserialization to safe terms only.",
"is_bot": false,
"headline": "Use safe_binary_to_term! for parsing package manifests (#1111)",
"author_name": "Jonatan Männchen",
"author_login": "maennchen",
"committed_at": "2026-02-25T23:05:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33e4cf42eaca73a4193aad688f3150e075498344",
"body": null,
"is_bot": false,
"headline": "mix hex.search: Add --print-url flag (#1108)",
"author_name": "Nathan Long",
"author_login": "nathanl",
"committed_at": "2026-01-29T12:41:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f76737e2c9e692be36054499dced57eaf56cb77",
"body": "Co-authored-by: a.smolnikov <a.smolnikov@spectrumit.ru>\nCo-authored-by: Eric Meadows-Jönsson <eric.meadows.jonsson@gmail.com>",
"is_bot": false,
"headline": "Fix within-requirements option in mix hex.outdated (#1107)",
"author_name": "flatl",
"author_login": "flatl",
"committed_at": "2025-12-17T16:43:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73736d0f6b3047223be95f3d8de6c7224b7dfd4f",
"body": null,
"is_bot": false,
"headline": "Include stdlib by default in mix hex.search (#1103)",
"author_name": "José Valim",
"author_login": "josevalim",
"committed_at": "2025-10-29T06:30:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a418451cb80e48231f8fb03f39f3c59323a26f1b",
"body": null,
"is_bot": false,
"headline": "Remove unused Hex.Crypto.PublicKey module (#1102)",
"author_name": "Christopher Varjas",
"author_login": "varjas",
"committed_at": "2025-10-27T19:55:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8516cbba22dfded1dd04e75b71feae70dcd3ed1",
"body": "Since we may prompt the user to refresh their token we cannot use a short timeout.",
"is_bot": false,
"headline": "OnceCache for oauth tokens require longer timeout",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2025-10-26T20:27:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b94c384174f69aedf8d6827ed7c53c76e632882",
"body": null,
"is_bot": false,
"headline": "Add test for fetching package from custom repo",
"author_name": "Eric Meadows-Jönsson",
"author_login": "ericmj",
"committed_at": "2025-10-26T20:21:28Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 85,
"commits_last_year": 135,
"latest_release_at": "2026-07-09T23:17:14Z",
"latest_release_tag": "v2.5.1",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 28,
"days_since_latest_release": 15,
"mean_days_between_releases": 47.4
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 62,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 207,
"stars": 1084,
"watchers": 26,
"fork_history": {
"days": [
{
"date": "2014-04-21",
"count": 1
},
{
"date": "2014-05-27",
"count": 1
},
{
"date": "2014-06-19",
"count": 1
},
{
"date": "2014-08-11",
"count": 1
},
{
"date": "2014-09-23",
"count": 1
},
{
"date": "2014-12-15",
"count": 1
},
{
"date": "2015-04-13",
"count": 1
},
{
"date": "2015-05-10",
"count": 1
},
{
"date": "2015-06-18",
"count": 1
},
{
"date": "2015-07-16",
"count": 1
},
{
"date": "2015-07-31",
"count": 1
},
{
"date": "2015-08-04",
"count": 1
},
{
"date": "2015-08-09",
"count": 1
},
{
"date": "2015-08-15",
"count": 1
},
{
"date": "2015-09-07",
"count": 1
},
{
"date": "2015-09-08",
"count": 1
},
{
"date": "2015-10-07",
"count": 1
},
{
"date": "2015-10-18",
"count": 1
},
{
"date": "2015-11-06",
"count": 1
},
{
"date": "2015-12-01",
"count": 1
},
{
"date": "2015-12-04",
"count": 1
},
{
"date": "2015-12-15",
"count": 1
},
{
"date": "2015-12-22",
"count": 1
},
{
"date": "2016-01-14",
"count": 2
},
{
"date": "2016-01-15",
"count": 1
},
{
"date": "2016-01-22",
"count": 1
},
{
"date": "2016-01-24",
"count": 1
},
{
"date": "2016-01-29",
"count": 1
},
{
"date": "2016-02-02",
"count": 1
},
{
"date": "2016-03-10",
"count": 1
},
{
"date": "2016-03-17",
"count": 1
},
{
"date": "2016-03-24",
"count": 1
},
{
"date": "2016-04-16",
"count": 1
},
{
"date": "2016-04-21",
"count": 1
},
{
"date": "2016-04-25",
"count": 1
},
{
"date": "2016-04-28",
"count": 1
},
{
"date": "2016-05-09",
"count": 1
},
{
"date": "2016-05-14",
"count": 1
},
{
"date": "2016-05-31",
"count": 1
},
{
"date": "2016-06-29",
"count": 1
},
{
"date": "2016-07-07",
"count": 1
},
{
"date": "2016-07-11",
"count": 1
},
{
"date": "2016-09-05",
"count": 2
},
{
"date": "2016-09-11",
"count": 1
},
{
"date": "2016-09-23",
"count": 1
},
{
"date": "2016-10-22",
"count": 1
},
{
"date": "2016-10-31",
"count": 1
},
{
"date": "2016-11-03",
"count": 1
},
{
"date": "2016-11-08",
"count": 1
},
{
"date": "2016-11-17",
"count": 2
},
{
"date": "2016-11-22",
"count": 1
},
{
"date": "2016-12-07",
"count": 1
},
{
"date": "2016-12-26",
"count": 1
},
{
"date": "2016-12-27",
"count": 1
},
{
"date": "2017-02-12",
"count": 1
},
{
"date": "2017-02-24",
"count": 1
},
{
"date": "2017-03-31",
"count": 1
},
{
"date": "2017-04-13",
"count": 1
},
{
"date": "2017-04-20",
"count": 1
},
{
"date": "2017-04-28",
"count": 1
},
{
"date": "2017-05-17",
"count": 1
},
{
"date": "2017-06-01",
"count": 1
},
{
"date": "2017-06-02",
"count": 1
},
{
"date": "2017-06-11",
"count": 1
},
{
"date": "2017-07-28",
"count": 1
},
{
"date": "2017-08-04",
"count": 1
},
{
"date": "2017-08-20",
"count": 1
},
{
"date": "2017-09-08",
"count": 1
},
{
"date": "2017-09-11",
"count": 1
},
{
"date": "2017-09-12",
"count": 1
},
{
"date": "2017-09-19",
"count": 1
},
{
"date": "2017-09-20",
"count": 1
},
{
"date": "2017-10-07",
"count": 1
},
{
"date": "2017-10-19",
"count": 1
},
{
"date": "2017-11-25",
"count": 1
},
{
"date": "2017-12-23",
"count": 1
},
{
"date": "2017-12-29",
"count": 1
},
{
"date": "2018-01-16",
"count": 1
},
{
"date": "2018-03-12",
"count": 1
},
{
"date": "2018-03-21",
"count": 1
},
{
"date": "2018-03-29",
"count": 1
},
{
"date": "2018-05-06",
"count": 1
},
{
"date": "2018-05-22",
"count": 2
},
{
"date": "2018-07-31",
"count": 1
},
{
"date": "2018-08-19",
"count": 1
},
{
"date": "2018-09-07",
"count": 1
},
{
"date": "2018-10-17",
"count": 1
},
{
"date": "2018-10-23",
"count": 1
},
{
"date": "2018-11-06",
"count": 1
},
{
"date": "2018-11-28",
"count": 1
},
{
"date": "2018-12-05",
"count": 1
},
{
"date": "2018-12-22",
"count": 1
},
{
"date": "2019-01-23",
"count": 1
},
{
"date": "2019-02-13",
"count": 1
},
{
"date": "2019-02-18",
"count": 1
},
{
"date": "2019-03-08",
"count": 1
},
{
"date": "2019-04-26",
"count": 1
},
{
"date": "2019-07-09",
"count": 1
},
{
"date": "2019-07-15",
"count": 1
},
{
"date": "2019-09-20",
"count": 1
},
{
"date": "2019-10-24",
"count": 1
},
{
"date": "2019-10-30",
"count": 1
},
{
"date": "2019-11-08",
"count": 1
},
{
"date": "2019-11-21",
"count": 1
},
{
"date": "2019-12-14",
"count": 1
},
{
"date": "2019-12-19",
"count": 1
},
{
"date": "2020-02-04",
"count": 1
},
{
"date": "2020-02-07",
"count": 1
},
{
"date": "2020-03-01",
"count": 1
},
{
"date": "2020-03-06",
"count": 1
},
{
"date": "2020-03-10",
"count": 1
},
{
"date": "2020-05-04",
"count": 1
},
{
"date": "2020-05-12",
"count": 1
},
{
"date": "2020-07-30",
"count": 1
},
{
"date": "2020-08-02",
"count": 1
},
{
"date": "2020-09-17",
"count": 1
},
{
"date": "2020-09-24",
"count": 1
},
{
"date": "2020-10-06",
"count": 1
},
{
"date": "2020-10-09",
"count": 1
},
{
"date": "2020-10-21",
"count": 1
},
{
"date": "2020-11-07",
"count": 1
},
{
"date": "2020-11-26",
"count": 1
},
{
"date": "2020-12-24",
"count": 1
},
{
"date": "2020-12-31",
"count": 1
},
{
"date": "2021-01-07",
"count": 1
},
{
"date": "2021-01-11",
"count": 1
},
{
"date": "2021-02-06",
"count": 1
},
{
"date": "2021-02-14",
"count": 1
},
{
"date": "2021-03-17",
"count": 1
},
{
"date": "2021-03-19",
"count": 1
},
{
"date": "2021-04-11",
"count": 1
},
{
"date": "2021-05-07",
"count": 1
},
{
"date": "2021-06-14",
"count": 1
},
{
"date": "2021-06-20",
"count": 1
},
{
"date": "2021-06-23",
"count": 1
},
{
"date": "2021-07-02",
"count": 1
},
{
"date": "2021-07-07",
"count": 1
},
{
"date": "2021-07-15",
"count": 1
},
{
"date": "2021-07-24",
"count": 1
},
{
"date": "2021-08-30",
"count": 2
},
{
"date": "2021-09-26",
"count": 1
},
{
"date": "2021-10-01",
"count": 1
},
{
"date": "2021-10-30",
"count": 1
},
{
"date": "2021-12-01",
"count": 1
},
{
"date": "2022-01-04",
"count": 1
},
{
"date": "2022-01-10",
"count": 1
},
{
"date": "2022-03-10",
"count": 1
},
{
"date": "2022-03-17",
"count": 1
},
{
"date": "2022-03-23",
"count": 1
},
{
"date": "2022-04-05",
"count": 1
},
{
"date": "2022-04-17",
"count": 1
},
{
"date": "2022-04-29",
"count": 1
},
{
"date": "2022-05-20",
"count": 1
},
{
"date": "2022-11-17",
"count": 1
},
{
"date": "2022-11-24",
"count": 1
},
{
"date": "2022-11-25",
"count": 1
},
{
"date": "2022-12-19",
"count": 1
},
{
"date": "2023-01-04",
"count": 1
},
{
"date": "2023-02-05",
"count": 1
},
{
"date": "2023-02-15",
"count": 1
},
{
"date": "2023-05-18",
"count": 2
},
{
"date": "2023-05-30",
"count": 1
},
{
"date": "2023-06-13",
"count": 1
},
{
"date": "2023-07-25",
"count": 1
},
{
"date": "2023-09-30",
"count": 1
},
{
"date": "2023-10-06",
"count": 1
},
{
"date": "2023-12-08",
"count": 1
},
{
"date": "2023-12-21",
"count": 1
},
{
"date": "2023-12-29",
"count": 1
},
{
"date": "2024-01-13",
"count": 1
},
{
"date": "2024-03-01",
"count": 1
},
{
"date": "2024-03-31",
"count": 1
},
{
"date": "2024-05-04",
"count": 1
},
{
"date": "2024-05-14",
"count": 1
},
{
"date": "2024-08-06",
"count": 1
},
{
"date": "2024-09-27",
"count": 1
},
{
"date": "2024-11-14",
"count": 1
},
{
"date": "2024-11-17",
"count": 1
},
{
"date": "2025-01-14",
"count": 1
},
{
"date": "2025-01-23",
"count": 1
},
{
"date": "2025-04-16",
"count": 1
},
{
"date": "2025-05-27",
"count": 1
},
{
"date": "2025-06-30",
"count": 1
},
{
"date": "2025-07-06",
"count": 1
},
{
"date": "2025-07-17",
"count": 1
},
{
"date": "2025-07-18",
"count": 1
},
{
"date": "2025-08-18",
"count": 1
},
{
"date": "2025-10-22",
"count": 1
},
{
"date": "2025-10-25",
"count": 1
},
{
"date": "2025-11-25",
"count": 1
},
{
"date": "2026-01-22",
"count": 1
},
{
"date": "2026-03-19",
"count": 1
},
{
"date": "2026-03-21",
"count": 1
},
{
"date": "2026-03-29",
"count": 1
},
{
"date": "2026-05-19",
"count": 1
},
{
"date": "2026-06-29",
"count": 1
},
{
"date": "2026-07-14",
"count": 1
},
{
"date": "2026-07-15",
"count": 1
},
{
"date": "2026-07-21",
"count": 1
}
],
"complete": true,
"collected": 205,
"total_forks": 207
},
"star_history": null,
"open_issues_and_prs": 6
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"sample"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"mix.exs",
"test/fixtures/diff/mix.exs",
"test/fixtures/ecto/mix.exs",
"test/fixtures/ecto_3_3_1/mix.exs",
"test/fixtures/ecto_3_3_2/mix.exs",
"test/fixtures/ecto_enum_1_4_0/mix.exs",
"test/fixtures/ecto_override/mix.exs",
"test/fixtures/ecto_sql_3_3_2/mix.exs",
"test/fixtures/ecto_sql_3_3_3/mix.exs",
"test/fixtures/ex_doc/mix.exs",
"test/fixtures/has_hex_dep/mix.exs",
"test/fixtures/override_with_path/mix.exs",
"test/fixtures/sample/mix.exs",
"test/fixtures/umbrella/apps/my_app1/mix.exs",
"test/fixtures/umbrella/apps/my_app2/mix.exs",
"test/fixtures/umbrella/apps/my_app3/mix.exs",
"test/fixtures/umbrella/mix.exs",
"test/fixtures/umbrella_override/apps/my_app1/mix.exs",
"test/fixtures/umbrella_override/mix.exs"
],
"largest_source_bytes": 34595,
"source_files_sampled": 164,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"mix.exs"
],
"advisories": {
"error": "No resolved dependencies to assess",
"scope": "repository_graph",
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"hex"
],
"dependencies": [
{
"name": "bypass",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 2.0"
},
{
"name": "cowboy",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 2.14"
},
{
"name": "mime",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 1.0"
},
{
"name": "mox",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 1.0"
},
{
"name": "plug",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 1.18"
},
{
"name": "plug_cowboy",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": "~> 2.7"
},
{
"name": "ok",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": null
},
{
"name": "cached_deps",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": null
},
{
"name": "cached_deps",
"manifest": "mix.exs",
"ecosystem": "hex",
"version_constraint": null
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [],
"collected": true,
"truncated": false,
"total_count": 0,
"direct_count": 0,
"indirect_count": 0
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 534,
"open_issues": 4,
"closed_ratio": 0.993,
"closed_issues": 605,
"closed_unmerged_prs": 53
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "ericmj",
"commits": 1283,
"avatar_url": "https://avatars.githubusercontent.com/u/316890?v=4"
},
{
"type": "User",
"login": "wojtekmach",
"commits": 184,
"avatar_url": "https://avatars.githubusercontent.com/u/76071?v=4"
},
{
"type": "User",
"login": "supersimple",
"commits": 61,
"avatar_url": "https://avatars.githubusercontent.com/u/773380?v=4"
},
{
"type": "User",
"login": "lexmag",
"commits": 35,
"avatar_url": "https://avatars.githubusercontent.com/u/248290?v=4"
},
{
"type": "User",
"login": "milmazz",
"commits": 20,
"avatar_url": "https://avatars.githubusercontent.com/u/34700?v=4"
},
{
"type": "User",
"login": "josevalim",
"commits": 16,
"avatar_url": "https://avatars.githubusercontent.com/u/9582?v=4"
},
{
"type": "User",
"login": "maennchen",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/333918?v=4"
},
{
"type": "User",
"login": "fteem",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/854173?v=4"
},
{
"type": "User",
"login": "gfvcastro",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/10352597?v=4"
},
{
"type": "User",
"login": "whatyouhide",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/3890250?v=4"
}
],
"contributors_sampled": 99,
"top_contributor_share": 0.731
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"codeql.yml",
"main.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"mix.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 1,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 4,
"reason": "Found 11/25 approved changesets -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 28 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "11 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "0eb1763fa232e8d274c70e99ec3110b55eadd16b",
"ran_at": "2026-07-25T22:12:34Z",
"aggregate_score": 6.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": true,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T20:18:54Z",
"oldest_open_prs": [
{
"number": 1139,
"created_at": "2026-04-13T01:55:59Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1181,
"created_at": "2026-06-16T18:57:34Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-21T20:18:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 1048,
"created_at": "2024-08-13T20:13:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1105,
"created_at": "2025-04-07T19:23:20Z",
"last_comment_at": "2026-06-16T20:01:50Z",
"last_comment_author": "maennchen"
},
{
"number": 1186,
"created_at": "2026-06-17T16:01:24Z",
"last_comment_at": "2026-06-30T17:15:49Z",
"last_comment_author": "josevalim"
},
{
"number": 1188,
"created_at": "2026-06-17T17:48:07Z",
"last_comment_at": "2026-07-02T06:02:51Z",
"last_comment_author": "thbar"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/hexpm/hex",
"host": "github.com",
"name": "hex",
"owner": "hexpm"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"security": 69,
"vitality": 87,
"community": 62,
"governance": 62,
"engineering": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 87,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 83,
"inputs": {
"commits_last_year": 135,
"human_commit_share": 0.81,
"days_since_last_push": 4,
"active_weeks_last_year": 28
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "28/52 weeks with commits",
"points": 19.4,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 28
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "135 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 135
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 85,
"latest_release_tag": "v2.5.1",
"releases_from_tags": false,
"days_since_latest_release": 15,
"mean_days_between_releases": 47.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "85 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 85
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 15 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 15
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~47.4 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 47.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 4,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 4 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 4
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 62,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "good",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"forks": 207,
"stars": 1084,
"watchers": 26,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1,084 stars",
"points": 49.2,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 1084
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "207 forks",
"points": 19.3,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 207
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "26 watchers",
"points": 7.8,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 26
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "at_risk",
"name": "Community health",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 39,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 99,
"top_contributor_share": 0.731
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 73% of commits",
"points": 6.1,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 73
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "99 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 99
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 28 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 87,
"inputs": {
"merged_prs": 534,
"open_issues": 4,
"closed_issues": 605,
"issue_closed_ratio": 0.993,
"closed_unmerged_prs": 53
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "99% of issues closed",
"points": 46.4,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 99
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "534/587 decided PRs merged",
"points": 34.8,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 534,
"decided": 587
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 11/25 approved changesets -- score normalized to 4",
"points": 6,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"followers": 129,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "hexpm",
"public_repos": 16,
"account_age_days": 4550
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "129 followers of hexpm",
"points": 15.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 129,
"login": "hexpm"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "16 public repos, account ~12 yr old",
"points": 21,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 16
}
},
{
"code": "account_age_years",
"params": {
"years": 12
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 71,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [
"hacktoberfest",
"elixir",
"erlang",
"package-manager"
],
"has_wiki": true,
"homepage": "https://hex.pm",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://hex.pm",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "4 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 4
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 69,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 69,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 6.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 11/25 approved changesets -- score normalized to 4",
"points": 3,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 28 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "11 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 28
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 52,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.79,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "64 of 81 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 64,
"sampled": 81
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"mix.lock"
],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.01,
"toolchain_manifests": [
"mix.exs",
"test/fixtures/diff/mix.exs",
"test/fixtures/ecto/mix.exs",
"test/fixtures/ecto_3_3_1/mix.exs",
"test/fixtures/ecto_3_3_2/mix.exs",
"test/fixtures/ecto_enum_1_4_0/mix.exs",
"test/fixtures/ecto_override/mix.exs",
"test/fixtures/ecto_sql_3_3_2/mix.exs",
"test/fixtures/ecto_sql_3_3_3/mix.exs",
"test/fixtures/ex_doc/mix.exs",
"test/fixtures/has_hex_dep/mix.exs",
"test/fixtures/override_with_path/mix.exs",
"test/fixtures/sample/mix.exs",
"test/fixtures/umbrella/apps/my_app1/mix.exs",
"test/fixtures/umbrella/apps/my_app2/mix.exs",
"test/fixtures/umbrella/apps/my_app3/mix.exs",
"test/fixtures/umbrella/mix.exs",
"test/fixtures/umbrella_override/apps/my_app1/mix.exs",
"test/fixtures/umbrella_override/mix.exs"
],
"dependency_bot_commit_share": 0.19
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "mix.exs, test/fixtures/diff/mix.exs, test/fixtures/ecto/mix.exs (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "mix.exs, test/fixtures/diff/mix.exs, test/fixtures/ecto/mix.exs"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "1 of the last 100 commits agent-authored or agent-credited",
"points": 2,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "19 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 19,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Elixir",
"largest_source_bytes": 34595,
"source_files_sampled": 164,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Elixir without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Elixir"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/164 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 164,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"sample"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "sample",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "sample"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch hex package 'hex' from its registry"
],
"report_type": "repository",
"generated_at": "2026-07-25T22:13:00.373581Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/h/hexpm/hex.svg",
"full_name": "hexpm/hex",
"license_state": "absent",
"license_spdx": null
}