Warn on unknown dependency options

lib/hex/scm.ex

@@ -125,6 +125,15 @@ defmodule Hex.SCM do
     repo = opts[:repo] || "hexpm"
     path = cache_path(repo, name, lock.version)
 
+    unknown_options = Keyword.keys(opts) -- ~w[hex dest repo lock env build optional]a
+
+    if unknown_options != [] do
+      Hex.Shell.warn(
+        "#{name} dependency is using unknown options: " <>
+          Enum.map_join(unknown_options, ", ", &inspect/1)
+      )
+    end
+
     case Hex.Parallel.await(:hex_fetcher, {:tarball, repo, name, lock.version}, @fetch_timeout) do
       {:ok, :cached} ->
         Hex.Shell.debug("  Using locally cached package (#{path})")

test/hex/mix_task_test.exs

@@ -229,6 +229,19 @@ defmodule Hex.MixTaskTest do
     end
   end
 
+  defmodule WithUnknownOptions do
+    def project do
+      [
+        app: :with_unknown_options,
+        version: "0.1.0",
+        consolidate_protocols: false,
+        deps: [
+          {:ex_doc, dir: "/bad", typo: true}
+        ]
+      ]
+    end
+  end
+
   defmodule WithNonMatchingRequirement do
     def project do
       [
@@ -882,6 +895,22 @@ defmodule Hex.MixTaskTest do
     end)
   end
 
+  test "deps.get with unknown options" do
+    Mix.Project.push(WithUnknownOptions)
+
+    in_tmp(fn ->
+      Hex.State.put(:cache_home, File.cwd!())
+
+      Mix.Task.run("deps.get")
+
+      assert_received {:mix_shell, :info,
+                       ["\e[33mex_doc is missing its version requirement, use \">= 0.0.0\"" <> _]}
+
+      assert_received {:mix_shell, :info,
+                       ["\e[33mex_doc dependency is using unknown options: :dir, :typo\e[0m"]}
+    end)
+  end
+
   defp old_lock_tuple(lock_tuple) do
     {elem(lock_tuple, 0), elem(lock_tuple, 1), elem(lock_tuple, 2), elem(lock_tuple, 3)}
   end