Learn what’s new with hex.pm with our latest Blog Updates
We are updating the price of Hex.pm organizations to $9 per user / month or $90 per user / year. This is the first price increase since paid organizations and private packages went live in 2018.
Read MoreHex 2.5 is focused on making it harder for a malicious or compromised release to reach your system. Supply chain attacks on package registries have become routine, and the pattern is familiar across every ecosystem. An attacker compromises a maintainer account or a build pipeline, publishes a tampered release, and automated tooling pulls it into thousands of projects within hours, long before anyone notices. Read More
HexDocs URLs are changing. Public package docs move from hexdocs.pm/package to package.hexdocs.pm, and private organization docs move from org.hexdocs.pm/package to org.hexorgs.pm/package (note the new top-level domain). This isolates packages from each other in the browser, addressing a finding from our recent security audit.
Read More
Over the past months, we conducted the first comprehensive third-party security audit of Hex.pm and its surrounding ecosystem. This work was made possible by Alpha-Omega, an initiative under the OpenSSF that funds security improvements for critical open source projects. The audit was carried out as part of the Erlang Ecosystem Foundation's Ægis initiative. Read More
Hex 2.4 replaces password based authentication with an OAuth device flow and adds two-factor authentication support to the CLI. These changes significantly improve the security of publishing packages. We have also given the hex.pm website a new look. Read More
Starting today, you can search across all Erlang and Elixir packages with the new search engine and landing page for HexDocs, powered by Typesense. Read More
Between approximately 2025-07-30 21:27 UTC and 2025-07-31 07:27 UTC hex.pm, diff.hex.pm, and preview.hex.pm were running with expired SSL certificates and couldn't be accessed over secure connections. Read More
The Hex team builds and hosts precompiled versions of Elixir, Erlang/OTP, and Hex itself. These are currently hosted on https://repo.hex.pm but will be moved to https://builds.hex.pm. (You can read more about the builds on https://github.com/hexpm/bob). Read More
Hex 2.0 drops support for Elixir 1.0-1.4. Hex 1.0 will continue to be maintained but will only receive security updates. For more details see the release announcement for Hex 1.0. Read More
We just released Hex 1.0.0 with no major changes compared to the last release 0.21.0 and we will soon release Hex 2.0.0, again with no major changes. Let's talk about why we are doing this and what Hex being version 1.0.0 or 2.0.0 means. Read More
After months of development, I am proud to announce the launch of preview.hex.pm! Read More
Hex v0.21 adds registry self-hosting, diff & dependencies improvements, mix hex.sponsor task, and more!
Read More
Today we announce the vulnerability report system, which will allow users to report and keep track of security vulnerabilies on Hex packages. Read More
Today we are publishing updates to our Terms of Service and Code of Conduct. Read More
Today we launched the option for two-factor authentication on hex.pm. Starting today, you can activate 2FA via the hex.pm dashboard. Many thanks to community contributors Bryan Paxton and Jeffrey Liao for their work on this project. Read More
I'm incredibly excited to announce the new web-based Hex package differ: diff.hex.pm, maintained by the Hex team! This is the result of the issue on the hex.pm Github repo and the discussion it started. Read More
A bit more than year ago we released private packages with organizations. With it you can add members to your organization and publish private packages only accessible by the members of the organization. The private packages are published to a separate repository (hosted by hex.pm) making sure they are separate from public packages. Read More
The v0.19 release includes an important security fix to anyone accessing Hex repositories through a mirror. A bug has been found that would allow a malicious mirror to serve modified versions of Hex packages. hex versions 0.14.0 to 0.18.2 and rebar3 versions 3.7.0 to 3.7.5 are vulnerable. Make sure to update to hex 0.19.0 and rebar3 3.8.0.
Read More
We are changing hosting provider from Heroku to Google Cloud. All applications have already been moved to Google Kubernetes Engine, but we sill have to move the database for hex.pm itself. Read More
Today we are happy to announce the release of Hexdocs for private packages. All the private packages you have uploaded documentation for (the default when running mix hex.publish) are now available and browsable on Hexdocs.
Read More
Today we are releasing the first version of hex_core, an Erlang library to interact with Hex.pm and other servers implementing Hex specifications. Read More
The v0.18 release includes improvements to API key handling and workflows when using continuous integration. Read More
A few months ago we introduced the beta of private packages and organizations. In the meantime we have been building the billing system and iterating on organizations. We'd like to thank beta users for their valuable feedback. Read More
We are announcing the addition of private packages on Hex.pm. With private packages you can publish packages to Hex.pm that only your organization members can access and download. With your organization you get a repository namespace on Hex.pm so that your private packages will not conflict with packages in the global, public repository. Go check out the private package documentation to learn exactly how it works. Read More