Bump hex_core from 0.18.0 to 0.19.0

[dependabot]

Bumps hex_core from 0.18.0 to 0.19.0.

Release notes

Sourced from hex_core's releases.

v0.19.0

• Add hex_cli_auth module with callback-based authentication handling for build tools: with_api/3,4 and with_repo/2,3 request wrappers, credential resolution, OAuth token exchange and automatic refresh, OTP prompt handling, and device authentication.
• Add hex_api_oauth:device_auth_flow/4,5 handling the complete OAuth device authorization flow.
• Add trusted, oauth_exchange, oauth_exchange_url, and cli_auth_callbacks config options.
• Restructure the Policy registry resource into per-repository restrictions and per-package overrides, replacing the ordered rule list.
• Build the policy URL like other registry resources, so hex_repo:get_policy/2 no longer requires repo_organization.

Changelog

Sourced from hex_core's changelog.

v0.19.0 (2026-07-21)

• Add hex_cli_auth module with callback-based authentication handling for build tools: with_api/3,4 and with_repo/2,3 request wrappers, credential resolution, OAuth token exchange and automatic refresh, OTP prompt handling, and device authentication.
• Add hex_api_oauth:device_auth_flow/4,5 handling the complete OAuth device authorization flow.
• Add trusted, oauth_exchange, oauth_exchange_url, and cli_auth_callbacks config options.
• Restructure the Policy registry resource into per-repository restrictions and per-package overrides, replacing the ordered rule list.
• Build the policy URL like other registry resources, so hex_repo:get_policy/2 no longer requires repo_organization.

Commits

• 1318a45 Release v0.19.0
• 4b13880 Bump the codeql group with 2 updates (#207)
• 97ef958 Group codeql-action Dependabot updates and bump to v4.36.3 (#206)
• def3694 Bump erlef/setup-beam from 1.24.0 to 1.24.1 (#205)
• ae0b9ba Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#202)
• acf2119 Bump actions/checkout from 6.0.3 to 7.0.0 (#201)
• 19001bb Stop retrying a failed token refresh on every request (#199)
• d6a6a5a Restructure Policy into per-repository restrictions and overrides (#194)
• e093545 Apply optional token_refresh_failed fallback in with_api/4 (#198)
• cd3d425 Serialize device auth in hex_cli_auth to reuse concurrent logins (#197)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)