ericmj · Oct 22, 2026 · Oct 22, 2026
diff --git a/src/mix_hex_advisory.erl b/src/mix_hex_advisory.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Display-time deduplication of security advisories.

diff --git a/src/mix_hex_api.erl b/src/mix_hex_api.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API

diff --git a/src/mix_hex_api_auth.erl b/src/mix_hex_api_auth.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Authentication.

diff --git a/src/mix_hex_api_key.erl b/src/mix_hex_api_key.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Keys.

diff --git a/src/mix_hex_api_oauth.erl b/src/mix_hex_api_oauth.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - OAuth.

diff --git a/src/mix_hex_api_organization.erl b/src/mix_hex_api_organization.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Organizations.

diff --git a/src/mix_hex_api_organization_member.erl b/src/mix_hex_api_organization_member.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Organization Members.

diff --git a/src/mix_hex_api_package.erl b/src/mix_hex_api_package.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Packages.

diff --git a/src/mix_hex_api_package_owner.erl b/src/mix_hex_api_package_owner.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Package Owners.

diff --git a/src/mix_hex_api_release.erl b/src/mix_hex_api_release.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Releases.

diff --git a/src/mix_hex_api_short_url.erl b/src/mix_hex_api_short_url.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Short URLs.

diff --git a/src/mix_hex_api_user.erl b/src/mix_hex_api_user.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex HTTP API - Users.

diff --git a/src/mix_hex_cli_auth.erl b/src/mix_hex_cli_auth.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Authentication handling with callback functions for build-tool-specific operations.

diff --git a/src/mix_hex_core.erl b/src/mix_hex_core.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% `hex_core' entrypoint module.

diff --git a/src/mix_hex_core.hrl b/src/mix_hex_core.hrl
@@ -1,3 +1,3 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
--define(HEX_CORE_VERSION, "0.21.0").
+-define(HEX_CORE_VERSION, "0.21.1").
diff --git a/src/mix_hex_deflate.erl b/src/mix_hex_deflate.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Pure-Erlang raw DEFLATE (RFC 1951) encoder. The output only depends on the

diff --git a/src/mix_hex_erl_tar.erl b/src/mix_hex_erl_tar.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% This file is a copy of erl_tar.erl from OTP with the following modifications:
 %% 1. Module renamed from erl_tar to mix_hex_erl_tar

diff --git a/src/mix_hex_erl_tar.hrl b/src/mix_hex_erl_tar.hrl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% This file is a copy of erl_tar.hrl from OTP without modifications.
 %%

diff --git a/src/mix_hex_http.erl b/src/mix_hex_http.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% HTTP contract.

diff --git a/src/mix_hex_http_httpc.erl b/src/mix_hex_http_httpc.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% httpc-based implementation of {@link mix_hex_http} contract.

diff --git a/src/mix_hex_licenses.erl b/src/mix_hex_licenses.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Hex Licenses.

diff --git a/src/mix_hex_oidc.erl b/src/mix_hex_oidc.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% OIDC token issuance for CI providers, used by Workload Identity.

diff --git a/src/mix_hex_pb_names.erl b/src/mix_hex_pb_names.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% -*- coding: utf-8 -*-
 %% % this file is @generated

diff --git a/src/mix_hex_pb_package.erl b/src/mix_hex_pb_package.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% -*- coding: utf-8 -*-
 %% % this file is @generated

diff --git a/src/mix_hex_pb_policy.erl b/src/mix_hex_pb_policy.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% -*- coding: utf-8 -*-
 %% % this file is @generated

diff --git a/src/mix_hex_pb_signed.erl b/src/mix_hex_pb_signed.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% -*- coding: utf-8 -*-
 %% % this file is @generated

diff --git a/src/mix_hex_pb_versions.erl b/src/mix_hex_pb_versions.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% -*- coding: utf-8 -*-
 %% % this file is @generated

diff --git a/src/mix_hex_registry.erl b/src/mix_hex_registry.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Functions for encoding and decoding Hex registries.

diff --git a/src/mix_hex_repo.erl b/src/mix_hex_repo.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Repo API.

diff --git a/src/mix_hex_safe_binary_to_term.erl b/src/mix_hex_safe_binary_to_term.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @hidden
 %% Safe deserialization of Erlang terms from binary.

diff --git a/src/mix_hex_tarball.erl b/src/mix_hex_tarball.erl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %% @doc
 %% Functions for creating and unpacking Hex tarballs.
@@ -1130,8 +1130,16 @@ validate_create_files([], _FilesRoot, Acc) ->
     {ok, lists:reverse(Acc)};
 validate_create_files([File | Rest], FilesRoot, Acc) ->
     case validate_create_file(File, FilesRoot) of
-        {ok, ValidatedFile} -> validate_create_files(Rest, FilesRoot, [ValidatedFile | Acc]);
-        {error, _} = Error -> Error
+        {ok, {ArchiveName, Entry} = ValidatedFile} ->
+            %% The archive root always exists, so a directory named after it
+            %% isn't stored and other entries can't take its name
+            case {archive_path_parts(ArchiveName), Entry} of
+                {[], directory} -> validate_create_files(Rest, FilesRoot, Acc);
+                {[], _} -> {error, {tarball, {unsafe_path, ArchiveName}}};
+                _ -> validate_create_files(Rest, FilesRoot, [ValidatedFile | Acc])
+            end;
+        {error, _} = Error ->
+            Error
     end.
 
 validate_create_file({Filename, Source, Options}, FilesRoot) when is_map(Options) ->

diff --git a/src/mix_safe_erl_term.xrl b/src/mix_safe_erl_term.xrl
@@ -1,4 +1,4 @@
-%% Vendored from hex_core v0.21.0 (564a33e), do not edit manually
+%% Vendored from hex_core v0.21.1 (d366662), do not edit manually
 
 %%% Author  : Robert Virding
 %%% Purpose : Token definitions for Erlang.

diff --git a/test/mix/tasks/hex.build_test.exs b/test/mix/tasks/hex.build_test.exs
@@ -233,6 +233,26 @@ defmodule Mix.Tasks.Hex.BuildTest do
     purge([ReleaseExcludePatterns.MixProject])
   end
 
+  test "create with the project directory in files" do
+    Process.put(:hex_test_app_name, :build_with_project_dir)
+    Mix.Project.push(ReleaseProjectDir.MixProject)
+
+    in_tmp(fn ->
+      Hex.State.put(:cache_home, tmp_path())
+
+      File.write!("myfile.txt", "hello")
+      File.mkdir!("dir")
+      File.write!("dir/test.txt", "world")
+
+      Mix.Tasks.Hex.Build.run([])
+
+      extract("build_with_project_dir-0.0.1.tar", "unzip")
+      assert extracted_files("unzip") == ["dir/test.txt", "myfile.txt"]
+    end)
+  after
+    purge([ReleaseProjectDir.MixProject])
+  end
+
   test "excludes junk files at any depth" do
     Process.put(:hex_test_app_name, :build_junk_files)
     Mix.Project.push(ReleaseDefaultFiles.MixProject)

diff --git a/test/support/release_samples.ex b/test/support/release_samples.ex
@@ -209,6 +209,21 @@ defmodule ReleaseExcludePatterns.MixProject do
   end
 end
 
+defmodule ReleaseProjectDir.MixProject do
+  def project do
+    [
+      app: Process.get(:hex_test_app_name) || raise("missing app name"),
+      version: "0.0.1",
+      description: "foo",
+      package: [
+        files: ["."],
+        licenses: ["MIT"],
+        links: %{"a" => "http://a"}
+      ]
+    ]
+  end
+end
+
 defmodule ReleaseEscapingFiles.MixProject do
   def project do
     [