Elixir: Hex version >= 0.14.0 no longer appropriate

[webnard]

Environment

• Elixir & Erlang/OTP versions (elixir --version): Erlang/OTP 22; Elixir 1.9.0
• Operating system: Arch Linux (Linux version 5.2.14-arch2-1-ARCH)

Current behavior

The latest updates in Elixir/Erlang have broken the hex dependency tool for versions before 0.20.1. With hex version 0.17.7, running mix deps.get produces a bunch of errors like the following:

* Getting phoenix (Hex package)
Request failed ({:failed_connect, [{:to_address, {'repo.hex.pm', 443}}, {:inet, [:inet], {:option, :server_only, :honor_cipher_order}}]})
** (Mix) Package fetch failed and no cached copy available (https://repo.hex.pm/tarballs/phoenix-1.4.9.tar)

The honor_cipher_order option was removed in January 2019 and release 0.20.1 of hex. Deleting my old version of hex and installing the newest version fixes this problem.

[josevalim]

@webnard just to clear: is this an Elixir issue or a Hex issue? If it is SSL related, it sounds like the latter.

[webnard]

@josevalim As far as I can tease out, this is an issue with Elixir permitting an outdated and (now) broken dependency:

https://github.com/elixir-lang/elixir/blob/9b6ec7bae79ececfb9ed481c780febb6a5b293e8/lib/mix/lib/mix/hex.ex#L4

[josevalim]

@webnard I understand your point now. Thank you!

[webnard]

It might be worth noting that Hex has different releases for different versions of Elixir which is not accounted for alongside the @hex_requirement check. The highest compatible Elixir version for Hex 0.17.7 is apparently 1.6.0. (1.9.0 does not currently appear in their CSV.)

[x-ji]

I also just encountered this issue with an old VM that runs Elixir 1.6.6, on which hex hasn't been updated for a while. I was able to fix it by running mix local.hex to update hex.