CVE-2026-105668 Hex release-age cooldown is lifted package-wide when the locked release is retired

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown cooldown config, HEXCOOLDOWN withholds versions younger than the configured ag...