erlang-hex (2.5.3-2) unstable; urgency=medium * Team upload. * Upload to unstable. -- Sergei Golovan Sun, 18 Oct 2026 12:02:21 +0300 erlang-hex (2.5.3-1) experimental; urgency=medium * Team upload. * New upstream release. - Fix CVE-2026-105274: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api). Closes: #1150902. - Fix CVE-2026-103503: Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. - Fix CVE-2026-105280: Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. - Fix CVE-2026-105668: Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. - Fix CVE-2026-96618: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. - Fix CVE-2026-96612: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. - Fix CVE-2026-81856: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. * Bump debhelper compatibility level to 14. -- Sergei Golovan Sat, 17 Oct 2026 00:17:11 +0300 erlang-hex (2.5.1-2) unstable; urgency=medium * Team upload. * Upload to unstable. -- Sergei Golovan Sun, 19 Jul 2026 12:19:36 +0300 erlang-hex (2.5.1-1) experimental; urgency=medium * Team upload. * New upstream release. * Relax build dependency on elixir. -- Sergei Golovan Sat, 18 Jul 2026 20:20:54 +0300 erlang-hex (2.4.2-2) unstable; urgency=medium * Team upload. * Upload to unstable because Erlang 29 and Elixir 1.20 is already in unstable. -- Sergei Golovan Sat, 13 Jun 2026 19:49:02 +0300 erlang-hex (2.4.2-1) experimental; urgency=medium * Team upload. * New upstream release compatible with Elixir 1.19. * Refresh patches. * Upload to experimental for prospective update of Erlang to 29 and Elixir to 1.19/1.20. * Bump standards version to 4.7.4. -- Sergei Golovan Tue, 26 May 2026 12:36:28 +0300 erlang-hex (2.0.6-2) unstable; urgency=medium * install into /usr/lib/elixir/lib rather than /usr/lib/elixir (Closes: #1105838) -- John Lines Sat, 17 May 2025 18:20:11 +0100 erlang-hex (2.0.6-1) unstable; urgency=medium * New upstream bugfix version - has minimal changes from 2.0.5 (Closes: #1105185) * Depend on elixir >= 1.17 (Closes: #1092577) * Update debain/rules to answer "n" to mix "upgrade Hex" questionq * Swich to team mainentance within the erlang-team -- John Lines Thu, 15 May 2025 13:49:40 +0100 erlang-hex (2.0.5-1) unstable; urgency=medium * New upstream version. * Upload to unstable (Closes: #1052280) -- John Lines Wed, 20 Sep 2023 10:02:13 +0100 erlang-hex (2.0.0-1) unstable; urgency=medium * Initial release. -- Gantua Sun, 20 Nov 2022 16:09:06 +0100