From 29cdbb4e2d0511c23f2e0b8dbe1172a44fd2ed9a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?= Date: Tue, 6 Oct 2026 16:44:10 +0200 Subject: [PATCH] Build the Elixir 1.12-1.14 archives on OTP 24 The release script built the Elixir 1.12 and 1.13 archives on OTP 22.3 and the 1.14 archive on OTP 23.3, but CI's oldest OTP is 24.3 and hex_core is only tested on OTP 24 and later. Since the update to hex_core 0.15.0 (https://github.com/hexpm/hex/pull/1138) the vendored erl_tar calls filelib:safe_relative_path/2, which OTP 22 doesn't have, so Hex 2.4.2 to 2.5.1 fail to unpack packages on OTP 22. mix_hex_repo:fingerprint/1 calls ssh:hostkey_fingerprint/2, which OTP 23 doesn't have, so mix hex.repo show and list crash on the OTP 23 build since 2.5.0. Build these archives on OTP 24.3.4.17 like the 1.15 and 1.16 archives, which makes OTP 24 the minimum, and document that archives are only built on OTP versions CI tests. --- CHANGELOG.md | 4 ++++ RELEASE.md | 2 ++ scripts/release_hex.sh | 6 +++--- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4cc6d0bd..512b05f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ ## v2.5.2-dev +### Backwards incompatible changes + +* Require OTP 24 or later. Hex 2.4.2 to 2.5.1 can't unpack packages on OTP 22, so Hex 2.4.1 is the last release that works there. Hex 2.5.1 is the last release for OTP 23 + ### Enhancements * Print warnings to standard error instead of standard output, keeping stdout clean for machine-readable output such as `mix hex.outdated --json`. Warning-colored lines that are part of a command's regular output, such as retirement notices in `mix hex.info` and the `mix deps.get` dependency listing, remain on standard output diff --git a/RELEASE.md b/RELEASE.md index bd878da8..0839eab2 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -34,6 +34,8 @@ Hex needs to built for every Elixir supported vMAJOR.MINOR version. Currently th Always build on the latest patch version and make sure tests pass before building the archive. +Only build on OTP versions that CI tests. Archives don't load on an OTP version older than the one they were built on, and the old CSV format used for Elixir v1.12-v1.16 has no OTP column, so the OTP version used for those archives is the minimum OTP version Hex supports on that Elixir version. + ## Places where version is mentioned * mix.exs `@version` attribute diff --git a/scripts/release_hex.sh b/scripts/release_hex.sh index 56107bb7..cfc4618b 100755 --- a/scripts/release_hex.sh +++ b/scripts/release_hex.sh @@ -47,9 +47,9 @@ function main { # UPDATE THIS FOR EVERY RELEASE, ORDER MATTERS # Elixir v1.12-v1.16 (old CSV format) - build_old ${hex_version} 22.3 1.12.3 1.12.0 xenial-20200212 - build_old ${hex_version} 22.3 1.13.4 1.13.0 xenial-20200212 - build_old ${hex_version} 23.3 1.14.2 1.14.0 xenial-20210114 + build_old ${hex_version} 24.3.4.17 1.12.3 1.12.0 focal-20240427 + build_old ${hex_version} 24.3.4.17 1.13.4 1.13.0 focal-20240427 + build_old ${hex_version} 24.3.4.17 1.14.2 1.14.0 focal-20250404 build_old ${hex_version} 24.3.4.17 1.15.8 1.15.0 focal-20240427 build_old ${hex_version} 24.3.4.17 1.16.3 1.16.0 focal-20240427