GitHub Advisory Database Expands to Erlang and Elixir
GitHub has added support for the Erlang ecosystem to its Advisory Database. This means curated security advisories are now available for packages managed by the Hex package registry, covering languages that run on the BEAM virtual machine—most notably Elixir and Erlang.
Elixir is a dynamic, functional language designed for building scalable and maintainable applications, frequently used to manage large infrastructure. Erlang is a general-purpose language and runtime environment geared toward scalable and concurrent systems. With this addition, the database's coverage now spans nine supported ecosystems: Composer (PHP), Go, Maven (Java), npm (JavaScript), NuGet (.NET), pip (Python), RubyGems (Ruby), Rust, and Erlang (Hex). Developers in the Erlang and Elixir communities can now search for known security issues directly on GitHub, where their code is hosted.
Open Data, Community Contributions
The Advisory Database remains an open source resource, licensed under Creative Commons Attribution 4.0. All vulnerability data is free to use in any context. GitHub maintains this feed to provide high-quality, actionable information that helps the industry as a whole secure software supply chains.
Now that Hex packages are supported, the project is accepting community contributions for Erlang-specific advisories. Security researchers, academics, and enthusiasts can submit additional context or corrections to improve the depth of these records. Contributors are asked to follow the project's community guidelines when submitting edits.
Getting Started
Developers can begin by viewing the available advisories historically posted for other ecosystems or by visiting the new collection. For deeper exploration of the security tooling available around these data, GitHub offers documentation on its related services:
