Release v0.16.0

Author: ericmj

CHANGELOG.md

@@ -1,5 +1,16 @@
 # CHANGELOG
 
+## v0.16.0 (2026-05-13)
+
+* Validate tarball file paths and symlink targets when creating package and docs tarballs.
+* Add `tarball_files_root` config for tarball source paths, defaulting to the current directory and allowing absolute paths only inside that root.
+* Add streaming `metadata.config` decoding and increase max metadata size to 1024KB.
+* Add `metadata_fields` config to decode only selected package metadata fields.
+* Add security advisory fields to package and versions registry resources.
+* Add `hex_repo:fingerprint/1` and `hex_repo:fingerprint_equal/2` for repository public key verification.
+* Return response headers from `hex_http_httpc:request_to_file/6`.
+* Accept SPDX `LicenseRef-*` license identifiers.
+
 ## v0.15.0 (2026-03-09)
 
 * Add `request_to_file` callback to `hex_http` behaviour for streaming HTTP response body directly to a file.

README.md

@@ -221,7 +221,7 @@ Add to `rebar.config`:
 
 ```erlang
 {deps, [
-  {hex_core, "0.15.0"}
+  {hex_core, "0.16.0"}
 ]}
 ```
 
@@ -232,7 +232,7 @@ Add to `mix.exs`:
 ```elixir
 defp deps do
   [
-    {:hex_core, "~> 0.15.0"}
+    {:hex_core, "~> 0.16.0"}
   ]
 end
 ```

src/hex_core.app.src

@@ -1,6 +1,6 @@
 {application, hex_core, [
     {description, "Reference implementation of Hex specifications"},
-    {vsn, "0.15.0"},
+    {vsn, "0.16.0"},
     {registered, []},
     {applications, [kernel, stdlib, inets, ssl, ssh]},
     {licenses, ["Apache-2.0"]},

src/hex_core.hrl

@@ -1 +1 @@
--define(HEX_CORE_VERSION, "0.15.0").
+-define(HEX_CORE_VERSION, "0.16.0").

src/hex_repo.erl

@@ -211,7 +211,7 @@ get_hex_installs(Config) ->
 %% @doc
 %% Computes a SHA256 fingerprint of a PEM-encoded public key.
 %%
-%% Returns a string in the format "SHA256:<base64>" which can be used
+%% Returns a string in the format "SHA256:" followed by base64, which can be used
 %% to verify public keys out-of-band.
 %%
 %% Examples:

src/hex_tarball.erl

@@ -577,7 +577,6 @@ decode_metadata(#{files := #{"metadata.config" := Binary}, config := Config} = S
     end.
 
 -ifdef(TEST).
-%% @private
 do_decode_metadata(Binary) ->
     do_decode_metadata(Binary, all).
 -endif.