hexpm · ericmj · May 14, 2026 · May 13, 2026 · May 14, 2026
diff --git a/src/mix_hex_api.erl b/src/mix_hex_api.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API

diff --git a/src/mix_hex_api_auth.erl b/src/mix_hex_api_auth.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Authentication.

diff --git a/src/mix_hex_api_key.erl b/src/mix_hex_api_key.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Keys.

diff --git a/src/mix_hex_api_oauth.erl b/src/mix_hex_api_oauth.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - OAuth.

diff --git a/src/mix_hex_api_organization.erl b/src/mix_hex_api_organization.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Organizations.

diff --git a/src/mix_hex_api_organization_member.erl b/src/mix_hex_api_organization_member.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Organization Members.

diff --git a/src/mix_hex_api_package.erl b/src/mix_hex_api_package.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Packages.

diff --git a/src/mix_hex_api_package_owner.erl b/src/mix_hex_api_package_owner.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Package Owners.

diff --git a/src/mix_hex_api_release.erl b/src/mix_hex_api_release.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Releases.

diff --git a/src/mix_hex_api_short_url.erl b/src/mix_hex_api_short_url.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Short URLs.

diff --git a/src/mix_hex_api_user.erl b/src/mix_hex_api_user.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Users.

diff --git a/src/mix_hex_core.erl b/src/mix_hex_core.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% `hex_core' entrypoint module.
@@ -69,15 +69,20 @@
 %%   `134_217_728' (128 MiB). Set to `infinity' to not enforce the limit.
 %%
 %% * `tarball_files_root' - Root directory for source files when creating tarballs.
-%%   Required for filesystem source paths, which must be relative and must resolve inside
-%%   this root after following symlinks. Set to `undefined' when all tarball contents are
-%%   provided as binaries and no filesystem source paths are used (default: `undefined').
+%%   Filesystem source paths must resolve inside this root after following symlinks.
+%%   Relative source paths are resolved from this root and absolute source paths must be
+%%   inside it (default: `"."').
 %%
 %% * `docs_tarball_max_size' - Maximum size of docs tarball, defaults to
 %%   `16_777_216' (16 MiB). Set to `infinity' to not enforce the limit.
 %%
 %% * `docs_tarball_max_uncompressed_size' - Maximum size of uncompressed docs tarball, defaults to
 %%   `134_217_728' (128 MiB). Set to `infinity' to not enforce the limit.
+%%
+%% * `metadata_fields' - Either `all' or a list of metadata.config keys (binaries) to read.
+%%   When set to a list, the metadata decoder streams past unrequested fields without
+%%   buffering their tokens, which keeps peak memory bounded for packages with very
+%%   large fields like `<<"files">>'. Defaults to `all'.
 
 -module(mix_hex_core).
 -export([default_config/0]).
@@ -115,11 +120,12 @@
     repo_verify => boolean(),
     repo_verify_origin => boolean(),
     send_100_continue => boolean(),
-    tarball_files_root => file:filename() | undefined,
+    tarball_files_root => file:filename(),
     tarball_max_size => pos_integer() | infinity,
     tarball_max_uncompressed_size => pos_integer() | infinity,
     docs_tarball_max_size => pos_integer() | infinity,
-    docs_tarball_max_uncompressed_size => pos_integer() | infinity
+    docs_tarball_max_uncompressed_size => pos_integer() | infinity,
+    metadata_fields => all | [binary()]
 }.
 
 -spec default_config() -> config().
@@ -142,9 +148,10 @@ default_config() ->
         repo_verify => true,
         repo_verify_origin => true,
         send_100_continue => true,
-        tarball_files_root => undefined,
+        tarball_files_root => ".",
         tarball_max_size => 16 * 1024 * 1024,
         tarball_max_uncompressed_size => 128 * 1024 * 1024,
         docs_tarball_max_size => 16 * 1024 * 1024,
-        docs_tarball_max_uncompressed_size => 128 * 1024 * 1024
+        docs_tarball_max_uncompressed_size => 128 * 1024 * 1024,
+        metadata_fields => all
     }.
diff --git a/src/mix_hex_core.hrl b/src/mix_hex_core.hrl
@@ -1,3 +1,3 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
--define(HEX_CORE_VERSION, "0.15.0").
+-define(HEX_CORE_VERSION, "0.16.0").
diff --git a/src/mix_hex_erl_tar.erl b/src/mix_hex_erl_tar.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% This file is a copy of erl_tar.erl from OTP with the following modifications:
 %% 1. Module renamed from erl_tar to mix_hex_erl_tar

diff --git a/src/mix_hex_erl_tar.hrl b/src/mix_hex_erl_tar.hrl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% This file is a copy of erl_tar.hrl from OTP with the following modifications:
 %% 1. Added chunk_size field to #read_opts{} for streaming extraction to disk

diff --git a/src/mix_hex_http.erl b/src/mix_hex_http.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% HTTP contract.

diff --git a/src/mix_hex_http_httpc.erl b/src/mix_hex_http_httpc.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% httpc-based implementation of {@link mix_hex_http} contract.
@@ -41,15 +41,12 @@ request_to_file(Method, URI, ReqHeaders, Body, Filename, AdapterConfig) when is_
             Method,
             Request,
             HTTPOptions,
-            [{stream, unicode:characters_to_list(Filename)}],
+            [{sync, false}, {stream, self}],
             Profile
         )
     of
-        {ok, saved_to_file} ->
-            {ok, {200, #{}}};
-        {ok, {{_, StatusCode, _}, RespHeaders, _RespBody}} ->
-            RespHeaders2 = load_headers(RespHeaders),
-            {ok, {StatusCode, RespHeaders2}};
+        {ok, RequestId} ->
+            stream_to_file(RequestId, Filename);
         {error, Reason} ->
             {error, Reason}
     end.
@@ -58,6 +55,39 @@ request_to_file(Method, URI, ReqHeaders, Body, Filename, AdapterConfig) when is_
 %% Internal functions
 %%====================================================================
 
+%% @private
+%% httpc streams 200/206 responses as messages and returns non-2xx as
+%% a normal response tuple. stream_start includes the response headers.
+stream_to_file(RequestId, Filename) ->
+    receive
+        {http, {RequestId, stream_start, Headers}} ->
+            {ok, File} = file:open(Filename, [write, binary]),
+            case stream_body(RequestId, File) of
+                ok ->
+                    ok = file:close(File),
+                    {ok, {200, load_headers(Headers)}};
+                {error, Reason} ->
+                    ok = file:close(File),
+                    {error, Reason}
+            end;
+        {http, {RequestId, {{_, StatusCode, _}, RespHeaders, _RespBody}}} ->
+            {ok, {StatusCode, load_headers(RespHeaders)}};
+        {http, {RequestId, {error, Reason}}} ->
+            {error, Reason}
+    end.
+
+%% @private
+stream_body(RequestId, File) ->
+    receive
+        {http, {RequestId, stream, BinBodyPart}} ->
+            ok = file:write(File, BinBodyPart),
+            stream_body(RequestId, File);
+        {http, {RequestId, stream_end, _Headers}} ->
+            ok;
+        {http, {RequestId, {error, Reason}}} ->
+            {error, Reason}
+    end.
+
 %% @private
 http_options(URI, AdapterConfig) ->
     HTTPOptions0 = maps:get(http_options, AdapterConfig, []),

diff --git a/src/mix_hex_licenses.erl b/src/mix_hex_licenses.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (4ff8378), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% @doc
 %% Hex Licenses.

diff --git a/src/mix_hex_pb_names.erl b/src/mix_hex_pb_names.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.15.0 (90f9f59), do not edit manually
+%% Vendored from hex_core v0.16.0 (0e332e5), do not edit manually
 
 %% -*- coding: utf-8 -*-
 %% % this file is @generated