Record a vetted Hex package version in hex_vet.exs after a security review - manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs.
---
name: phx:deps-vet
description: "Record a vetted Hex package version in hex_vet.exs after a security review — manages the audit ledger, not the scanner. Use to approve a dep after /phx:deps-audit findings or to initialize hex_vet.exs."
argument-hint: "<pkg> <version> | --seed | --list | --check"
effort: medium
---
# Deps Vet — Hex package audit ledger
Review a Hex package version, run Phase 1 supply-chain rules against it,
prompt the user for a verdict, append the result to `hex_vet.exs`
(project-root audit ledger). Vetted versions get downgraded to `INFO`
on subsequent `/phx:deps-audit` runs.
Run this AFTER `/phx:deps-audit` to clear findings.
Run this BEFORE merging a `mix.lock` PR to certify new versions.
## Usage
```text
/phx:deps-vet phoenix 1.7.21 # vet a single package version
/phx:deps-vet --seed # import curated baseline seed (~30 pkgs)
/phx:deps-vet --list # show existing ledger entries
/phx:deps-vet --check # cross-check mix.lock vs ledger
```… install to load the full skill