About Hexorcist

Hexorcist watches your Elixir apps and tells you when their hex dependencies have known security advisories or available updates — and exactly what to do about it. It also tracks FreeBSD hosts, matching their installed packages against the FreeBSD vulnerability database.

Vulnerability scanning

Your dependencies are checked against a local mirror of the Elixir security advisory database (mirego/elixir-security-advisories — the same source that powers mix deps.audit). Each match becomes an alert with its severity and a link to the advisory.

Remediation

Every vulnerability tells you exactly how to fix it: the minimal safe version to upgrade to (from the advisory's patched releases) and the command to run — e.g. "update plug to ≥ 1.0.4: mix deps.update plug".

Available updates

Hexorcist mirrors the signed hex.pm registry, so each project shows which dependencies have newer releases — classified as patch, minor, or major — plus any dependency pinned to a version hex has marked retired.

Update blockers

When an update can't be applied, Hexorcist reconstructs the dependency graph from your lock and names the parent packages whose version requirements hold it back — so you can see "bump this one and these others free up".

Apply updates locally

Install the hexorcist_update mix archive to pull a project's upgrade plan and apply the safe, lockfile-only part (mix deps.update) right on your machine or in CI — optionally test-gated, leaving the mix.lock change as a reviewable diff. No GitHub integration, nothing auto-pushed. With --edit-mix it can also raise mix.exs constraints to unlock held-back majors, including each app of an umbrella.

Automated ingest

Drop a one-line post-commit git hook into a repo and every commit that changes mix.lock pushes it here automatically (token-authenticated). No GitHub or CI service required — it works from any local repo.

Notifications

When a scheduled scan finds a new vulnerability you weren't already looking at, you get an email — including the recommended fix — so you hear about it even when you're not watching the dashboard.

SBOM in and out

Download a standards-compliant CycloneDX SBOM for any project — components by package URL (purl), licenses, dependency relationships, integrity hashes, and your known vulnerabilities embedded as VEX. You can also point Hexorcist at an existing CycloneDX or SPDX SBOM instead of a mix.lock.

Runtime advisories

For deployed apps, record the Erlang/OTP, Elixir, and host-OS versions you run on (reported by the hook, or set by hand) and Hexorcist flags advisories against the runtime itself — not just your hex dependencies. Libraries skip this, since they have no single runtime.

FreeBSD systems

Beyond hex, track a FreeBSD host: upload its pkg query output (by paste, or a one-line token-authenticated cron push) and Hexorcist matches the installed packages against the FreeBSD VuXML database — the same source pkg audit uses. Each host shows its advisory count and the package updates available in its branch (quarterly or latest), and you're emailed once when a new advisory affects a package you run.

Ecosystem insight

Beyond your own projects, Hexorcist publishes aggregate views of the Elixir ecosystem — starting with "packages that may need support": widely-used libraries that haven't shipped in a long time and could use community attention, funding, or a new maintainer.

How it works

Add a project and paste its mix.lock (or wire up the git hook).
Hexorcist parses the lock and scans every dependency against the advisory mirror.
It re-scans automatically as new advisories land and as you push lock changes, and refreshes update info from hex daily.
You see vulnerabilities, fixes, and available updates per project — and get emailed about anything new.

Free, supported by donations

Hexorcist is a free service. If you find it useful, you can help keep it running.

Donate on Liberapay

Browse packages that may need support