Hex v2.5.0, the Elixir package manager, introduces organization-defined dependency policies that filter package versions during resolution based on security advisories, retirement reasons, or release age. A new configurable release-age cooldown helps mitigate supply-chain attacks by withholding freshly published packages until they reach a minimum age. The release also adds security advisory warnings during deps.get/update, a new mix hex.search command for documentation search, JSON output for mix hex.outdated, and several bug fixes. Authentication deprecations signal a move toward user-based and short-lived token auth for organization repositories.
175 Impressions