v2.4.1

Bug fixes

• Fix OAuth exchange attempted for repos configured before v2.4.0
• Propagate OAuth exchange configuration to organization repos
• Deduplicate OAuth token exchange during parallel package fetching
• Restore Hex code paths after compilation pruning

v2.4.0

Enhancements

• Replace password based authentication with OAuth device flow
• Add 2FA support for API write operations
• Use OAuth tokens for hexpm and custom repositories
• Add --print-url flag to mix hex.search
• Include stdlib packages by default in mix hex.search
• Change private docs URLs from *.hexdocs.pm to *.hexorgs.pm
• Improve authentication error handling for package fetching

Bug fixes

• Fix --within-requirements option in mix hex.outdated

Security fixes

• Use safe deserialization for parsing package manifests

v2.3.2

Security fixes

• Fix unsafe deserialization of Erlang terms in API responses (CVE-2026-21619)

v2.3.1

Bug fixes

• Fix repository name verification for organizations and custom repositories

v2.3.0

Enhancements

• Update mix hex.search task with full-text documentation search across all your dependencies
• Add :only column and filtering to mix hex.outdated
• Improve registry verification error messages
• Improve caching of packages across multiple repos
• Add HTTP request debug logging with MIX_DEBUG=1
• Prevent publishing packages with :in_umbrella dependencies

Bug fixes

• Handle truthy boolean for CI env variable
• Fix warn_if_outdated if package name and app name are different
• Allow nested maps for extra package metadata

v2.2.2

Bug fixes

• mix hex.publish: Pass --no-listeners to deps.loadpaths

v2.2.1

Bug fixes

• Precompile Hex for Elixir 1.18 using Elixir 1.18.0

v2.2.0

Enhancements

• Add verifications of the registry cache ets table (~/.cache/hex/cache.ets)

• Add help when docs download times out

• Support :warn_if_outdated in deps

  Let's say you have the following in mix.exs:

  {:ex_doc, ">= 0.0.0", warn_if_outdated: true, only: :dev}

  and ExDoc is at version v0.37.2 in mix.lock, and v0.37.3 was released.

  You will now see:

  $ mix deps.get
  Resolving Hex dependencies...
  Resolution completed in 0.054s
  Unchanged:
    ex_doc 0.37.2
  warning: the following deps are outdated and set "warn_if_outdated: true":
  
   * ex_doc 0.37.3 is available

v2.1.1

Bug fixes

• Fix overriding Hex packages from non Hex dependencies

v2.1.0

Enhancements

• Improve solver error message when collecting conflicting requirements from multiple places. Fixes the "empty" versions error. This is done by including path and git parents of hex packages in the solver.
• Add "(CI)" to user-agent HTTP header if environment variable CI is set
• Improve message for authentication errors
• Set exit code 1 on mix hex.organization auth errors
• Add --sort flag mix hex.outdated
• Improve error message when trying to publish existing package with permissions
• Consider ex_doc :output option when publishing documentation
• Warn on unknown dependency options

Bug fixes

• Do not close registry server in post_converge. Fixes the "the table identifier does not refer to an existing ETS table" error.
• Revert Mix changes on Hex application stop
• Fix passing requests from umbrella apps to solver
• Handle empty package name in mix hex.info