Release v0.18.0

Author: ericmj

CHANGELOG.md

@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## v0.18.0 (2026-06-02)
+
+* Add support for the `Policy` registry resource: signed organization dependency policies that opted-in clients honor at resolution time.
+* Add `hex_repo:get_policy/2` to fetch and verify a policy resource from a repository.
+* Add `hex_registry:build_policy/2`, `hex_registry:unpack_policy/4`, `hex_registry:encode_policy/1`, and `hex_registry:decode_policy/3`.
+
 ## v0.17.0 (2026-05-20)
 
 * Add `aliases` field to `SecurityAdvisory` proto for cross-referencing advisories (e.g. GHSA/CVE pairs).

README.md

@@ -221,7 +221,7 @@ Add to `rebar.config`:
 
 ```erlang
 {deps, [
-  {hex_core, "0.17.0"}
+  {hex_core, "0.18.0"}
 ]}
 ```
 
@@ -232,7 +232,7 @@ Add to `mix.exs`:
 ```elixir
 defp deps do
   [
-    {:hex_core, "~> 0.17.0"}
+    {:hex_core, "~> 0.18.0"}
   ]
 end
 ```

src/hex_core.app.src

@@ -1,6 +1,6 @@
 {application, hex_core, [
     {description, "Reference implementation of Hex specifications"},
-    {vsn, "0.17.0"},
+    {vsn, "0.18.0"},
     {registered, []},
     {applications, [kernel, stdlib, inets, ssl, ssh]},
     {licenses, ["Apache-2.0"]},

src/hex_core.hrl

@@ -1 +1 @@
--define(HEX_CORE_VERSION, "0.17.0").
+-define(HEX_CORE_VERSION, "0.18.0").