Release v0.13.0

Author: ericmj

CHANGELOG.md

@@ -1,5 +1,10 @@
 # CHANGELOG
 
+## v0.13.0 (2026-03-08)
+
+* Add file-based unpack via `hex_tarball:unpack({file, Path}, Output)` to avoid loading entire tarball into memory.
+* Add size validations for outer tarball entries (VERSION, CHECKSUM, metadata.config) during creation and extraction.
+
 ## v0.12.2 (2026-02-27)
 
 * Exclude `src/safe_erl_term.erl` from package.

README.md

@@ -221,7 +221,7 @@ Add to `rebar.config`:
 
 ```erlang
 {deps, [
-  {hex_core, "0.12.2"}
+  {hex_core, "0.13.0"}
 ]}
 ```
 
@@ -232,7 +232,7 @@ Add to `mix.exs`:
 ```elixir
 defp deps do
   [
-    {:hex_core, "~> 0.12.2"}
+    {:hex_core, "~> 0.13.0"}
   ]
 end
 ```

src/hex_core.app.src

@@ -1,6 +1,6 @@
 {application, hex_core, [
     {description, "Reference implementation of Hex specifications"},
-    {vsn, "0.12.2"},
+    {vsn, "0.13.0"},
     {registered, []},
     {applications, [kernel, stdlib, inets, ssl]},
     {licenses, ["Apache-2.0"]},

src/hex_core.hrl

@@ -1 +1 @@
--define(HEX_CORE_VERSION, "0.12.2").
+-define(HEX_CORE_VERSION, "0.13.0").