hexreg

Documentation

Overview

Package hexreg asks hex.pm what it knows about the Hex packages a diff touches (Elixir mix.lock and Gleam manifest.toml both resolve against Hex). deps.dev has no Hex system at all, so for the BEAM world this package IS the metadata layer, not a fallback:

• Release ages and the ⏱ cooldown flag, from each release's inserted_at timestamp.
• Retired releases (Hex's per-version deprecation mechanism) land in the deprecation lane with the maintainer's reason and message ("Not really maintained, please check out Tesla").
• Unlisted detection: hex.pm lets publishers fully delete a release (and admins remove malicious ones), and deleted releases vanish from the API — an incoming version missing while the package's other versions ARE listed is what that looks like. Packages Hex does not know at all are never flagged, and the parsers mark git/path installs NonRegistry besides.
• The upstream source repository from the package links, which the changelog layers turn into verified compare links and release notes.

Hex has no per-release license history, so license-change detection is honestly left out for this ecosystem.

One anonymous GET per changed package against the CORS-open hex.pm/api/packages endpoint — the same route works native and in the browser (wasm) build. Anonymous quota is 100 requests/minute; setting HEX_API_KEY (a hex.pm API key, same variable mix itself understands) raises it.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Variables

var BaseURL = "https://hex.pm"

BaseURL is the hex.pm API base; a var so tests can fake it.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) (bool, error)

Annotate fills hex.pm metadata on the diffs; see the package comment for what it covers. The returned bool reports whether at least one package was actually vetted against hex.pm (callers use it to decide whether release metadata was checked at all, since deps.dev never covers Hex). freshDays mirrors -fresh-days. Best-effort: per-package failures skip that package; only total failure returns an error.