Workload Identity and staged publishing are now available on hex.pm. Publish from GitHub Actions without storing a key, and hold releases until a person approves them with 2FA. hex.pm/blog/announcin…
Hex v2.6 is out: policy overrides for a specific advisory, retirement reason or cooldown, mix hex.audit --policy to check mix.lock against your policy, 2FA requirements for organizations, reproducible package builds, and a faster mix deps.get.
Hex v2.5 adds three layers of supply chain defense: security advisories in your terminal on mix deps.get, a release-age cooldown that withholds new versions until they’ve aged, and organization policies for filtered dependency fetching.