erlang-hex (2.5.3-1) experimental; urgency=medium

  * Team upload.
  * New upstream release.
    - Fix CVE-2026-105274: Improper Handling of Highly Compressed Data
      (Data Amplification) vulnerability in hexpm hex_core allows
      an untrusted repository mirror, or a server answering hex_core's
      API requests, to exhaust the memory of the Erlang VM running hex_core.
      The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and
      rebar3 (r3_hex_repo, r3_hex_api). Closes: #1150902.
    - Fix CVE-2026-103503: Improper Certificate Validation vulnerability
      in hexpm hex allows an attacker who can intercept HTTPS connections,
      and holds a certificate for a Hex host issued by a CA in Hex's bundled
      CA store, to impersonate that host to users who set cacerts_path to
      a CA store that leaves that CA out.
    - Fix CVE-2026-105280: Improper Validation of Integrity Check Value
      vulnerability in hexpm hex allows a package mirror to substitute
      the tarball that mix hex.package fetch PACKAGE VERSION --output -
      writes to standard output.
    - Fix CVE-2026-105668: Protection Mechanism Failure vulnerability
      in hexpm hex allows the owner of a package, or an attacker who has
      taken over the owner's account, to get a newly published release past
      the release-age cooldown.
    - Fix CVE-2026-96618: Improper Handling of Highly Compressed Data
      (Data Amplification) vulnerability in hexpm hex allows an untrusted
      package mirror to exhaust the memory or disk space of the machine
      running mix deps.get, mix deps.update, mix hex.package fetch or
      mix hex.docs fetch.
    - Fix CVE-2026-96612: Improper Limitation of a Pathname to a Restricted
      Directory ('Path Traversal') vulnerability in hexpm hex allows
      a malicious package publisher to delete a directory outside
      the project's deps directory and extract package files into it when
      a developer fetches dependencies.
    - Fix CVE-2026-81856: Improper Neutralization of Escape, Meta, or Control
      Sequences vulnerability in hexpm hex allows a malicious package
      publisher or a hostile repository server to inject terminal control
      sequences into the output of Mix tasks.
  * Bump debhelper compatibility level to 14.

 -- Sergei Golovan <sgolovan@debian.org>  Sat, 17 Oct 2026 00:17:11 +0300

erlang-hex (2.5.1-2) unstable; urgency=medium

  * Team upload.
  * Upload to unstable.

 -- Sergei Golovan <sgolovan@debian.org>  Sun, 19 Jul 2026 12:19:36 +0300

erlang-hex (2.5.1-1) experimental; urgency=medium

  * Team upload.
  * New upstream release.
  * Relax build dependency on elixir.

 -- Sergei Golovan <sgolovan@debian.org>  Sat, 18 Jul 2026 20:20:54 +0300

erlang-hex (2.4.2-2) unstable; urgency=medium

  * Team upload.
  * Upload to unstable because Erlang 29 and Elixir 1.20 is already
    in unstable.

 -- Sergei Golovan <sgolovan@debian.org>  Sat, 13 Jun 2026 19:49:02 +0300

erlang-hex (2.4.2-1) experimental; urgency=medium

  * Team upload.
  * New upstream release compatible with Elixir 1.19.
  * Refresh patches.
  * Upload to experimental for prospective update of Erlang to 29
    and Elixir to 1.19/1.20.
  * Bump standards version to 4.7.4.

 -- Sergei Golovan <sgolovan@debian.org>  Tue, 26 May 2026 12:36:28 +0300

erlang-hex (2.0.6-2) unstable; urgency=medium

  * install into /usr/lib/elixir/lib rather than /usr/lib/elixir
    (Closes: #1105838) 

 -- John Lines <john@paladyn.org>  Sat, 17 May 2025 18:20:11 +0100

erlang-hex (2.0.6-1) unstable; urgency=medium

  * New upstream bugfix version - has minimal changes
    from 2.0.5 (Closes: #1105185)
  * Depend on elixir >= 1.17 (Closes: #1092577) 
  * Update debain/rules to answer "n" to mix "upgrade Hex" questionq
  * Swich to team mainentance within the erlang-team 

 -- John Lines <john@paladyn.org>  Thu, 15 May 2025 13:49:40 +0100

erlang-hex (2.0.5-1) unstable; urgency=medium

  * New upstream version.
  * Upload to unstable (Closes: #1052280)

 -- John Lines <john@paladyn.org>  Wed, 20 Sep 2023 10:02:13 +0100

erlang-hex (2.0.0-1) unstable; urgency=medium

  * Initial release.

 -- Gantua <ladmin@marchera-pas.fr>  Sun, 20 Nov 2022 16:09:06 +0100
