Mix.lock being rewritten with and then without "hexpm"

This is, most probably, the difference between an older hex client and a newer hex client that stores additional metadata (the format allows adding additional fields at the end, so the older client should still be able to consume the file, it will only spit out the older format on write operations).

Michal is correct. If all your developers updates their Hex version with mix local.hex it should stop happening.

I’m curious, is there a way to constrain the used hex version from the mix.exs file to a specific minimum version? Would help resolve these issues.

Not currently but it’s a nice idea.

Yes, this looks right. I’ve asked the rest of the team to upgrade to 0.16.0 and all seems well now. Thanks for the pointer.

We’re getting similar churn in Mix.lock - changes that are just [repo: "hexpm", hex: :poison, optional: false] vs [hex: :poison, optional: false] (with/without repo: "hexpm") and with/without the trailing “hexpm”.

My colleague and I have both run mix local.hex, and both appear to already be on 0.17.1.

$: mix local.hex
Found existing entry: /Users/nathanl/.mix/archives/hex-0.17.1
Are you sure you want to replace it with "https://repo.hex.pm/installs/1.5.0/hex-0.17.1.ez"? [Yn]

Any other reason why this might happen?

Here’s an example diff.

-  "phoenix": {:hex, :phoenix, "1.3.0", "1c01124caa1b4a7af46f2050ff11b267baa3edb441b45dbf243e979cd4c5891b", [:mix], [{:cowboy, "~> 1.0", [repo: "hexpm", hex: :cowboy, optional: true]}, {:phoenix_pubsub, "~> 1.0", [repo: "hexpm", hex: :phoenix_pubsub, optional: false]}, {:plug, "~> 1.3.3 or ~> 1.4", [repo: "hexpm", hex: :plug, optional: false]}, {:poison, "~> 2.2 or ~> 3.0", [repo: "hexpm", hex: :poison, optional: false]}], "hexpm"},
-  "phoenix_ecto": {:hex, :phoenix_ecto, "3.3.0", "702f6e164512853d29f9d20763493f2b3bcfcb44f118af2bc37bb95d0801b480", [:mix], [{:ecto, "~> 2.1", [repo: "hexpm", hex: :ecto, optional: false]}, {:phoenix_html, "~> 2.9", [repo: "hexpm", hex: :phoenix_html, optional: true]}, {:plug, "~> 1.0", [repo: "hexpm", hex: :plug, optional: false]}], "hexpm"},
+  "phoenix": {:hex, :phoenix, "1.3.0", "1c01124caa1b4a7af46f2050ff11b267baa3edb441b45dbf243e979cd4c5891b", [:mix], [{:cowboy, "~> 1.0", [hex: :cowboy, optional: true]}, {:phoenix_pubsub, "~> 1.0", [hex: :phoenix_pubsub, optional: false]}, {:plug, "~> 1.3.3 or ~> 1.4", [hex: :plug, optional: false]}, {:poison, "~> 2.2 or ~> 3.0", [hex: :poison, optional: false]}]},
+  "phoenix_ecto": {:hex, :phoenix_ecto, "3.3.0", "702f6e164512853d29f9d20763493f2b3bcfcb44f118af2bc37bb95d0801b480", [:mix], [{:ecto, "~> 2.1", [hex: :ecto, optional: false]}, {:phoenix_html, "~> 2.9", [hex: :phoenix_html, optional: true]}, {:plug, "~> 1.0", [hex: :plug, optional: false]}]},

That should not happen if you are both on 0.17.1, my guess would be that someone is using an older version. If you have a way to reproduce please open an issue.