v0.19.0

• Add hex_cli_auth module with callback-based authentication handling for build tools: with_api/3,4 and with_repo/2,3 request wrappers, credential resolution, OAuth token exchange and automatic refresh, OTP prompt handling, and device authentication.
• Add hex_api_oauth:device_auth_flow/4,5 handling the complete OAuth device authorization flow.
• Add trusted, oauth_exchange, oauth_exchange_url, and cli_auth_callbacks config options.
• Restructure the Policy registry resource into per-repository restrictions and per-package overrides, replacing the ordered rule list.
• Build the policy URL like other registry resources, so hex_repo:get_policy/2 no longer requires repo_organization.

v0.18.0

• Add support for the Policy registry resource: signed organization dependency policies that opted-in clients honor at resolution time.
• Add hex_repo:get_policy/2 to fetch and verify a policy resource from a repository.
• Add hex_registry:build_policy/2, hex_registry:unpack_policy/4, hex_registry:encode_policy/1, and hex_registry:decode_policy/3.

v0.17.0

• Add aliases field to SecurityAdvisory proto for cross-referencing advisories (e.g. GHSA/CVE pairs).
• Add hex_advisory:group_for_display/1 to deduplicate advisories that share aliases.

v0.16.1

• Add published_at timestamp field to release registry resource.

v0.16.0

• Validate tarball file paths and symlink targets when creating package and docs tarballs.
• Add tarball_files_root config for tarball source paths, defaulting to the current directory and allowing absolute paths only inside that root.
• Add streaming metadata.config decoding and increase max metadata size to 1024KB.
• Add metadata_fields config to decode only selected package metadata fields.
• Add security advisory fields to package and versions registry resources.
• Add hex_repo:fingerprint/1 and hex_repo:fingerprint_equal/2 for repository public key verification.
• Return response headers from hex_http_httpc:request_to_file/6.
• Accept SPDX LicenseRef-* license identifiers.

v0.15.0

• Add request_to_file callback to hex_http behaviour for streaming HTTP response body directly to a file.
• Add hex_repo:get_tarball_to_file/4 and hex_repo:get_docs_to_file/4 for downloading tarballs and docs directly to disk.
• Implement request_to_file in hex_http_httpc using httpc's {stream, Filename} option.

v0.14.1

• Add max_size extraction limit to package inner tarball and docs tarball unpacking for zip bomb protection.

v0.14.0

• Stream tar extraction to disk, writing file entries in chunks instead of loading into memory.
• Add {file, Path} support to hex_tarball:unpack_docs/2,3 to read doc tarballs from disk.
• Add none output mode to hex_tarball:unpack/2,3 to extract only metadata and checksums, skipping contents.

v0.13.0

• Add file-based unpack via hex_tarball:unpack({file, Path}, Output) to avoid loading entire tarball into memory.
• Add size validations for outer tarball entries (VERSION, CHECKSUM, metadata.config) during creation and extraction.

v0.12.1

• Fix unsafe deserialization of Erlang terms in API responses (CVE-2026-21619)