4 commits

Author	SHA1	Message	Date
Andrew Nesbitt	5315883c3b	Bump registries to v0.6.0 and replace internal/cooldown (#120) ... - Bump github.com/git-pkgs/registries to v0.6.0: the fetcher now honours HTTP_PROXY, gates dialled IPs against the safehttp block list, and Version.Integrity is populated for pub, julia and nuget - Replace internal/cooldown with github.com/git-pkgs/cooldown v0.1.1 (identical surface, lifted from this repo) - Update docs/architecture.md to point at the external package	2026-05-13 06:45:33 +01:00
Andrew Nesbitt	5e04182bbd	Add upstream URL tests for all ecosystem download handlers (#51) ... Adds regression test for the PyPI double-packages bug fixed in #50, and adds fetchedURL assertions to every ecosystem that constructs upstream download URLs (Conda, CRAN, Maven, NuGet, Conan, Debian, RPM).	2026-04-01 15:22:52 +01:00
Andrew Nesbitt	4f8f63f354	Add version cooldown to filter recently published packages ... Hides package versions published too recently from metadata responses, giving the community time to spot malicious releases. Configurable per-ecosystem and per-package with duration overrides. Supported for npm, PyPI, pub.dev, and Composer.	2026-03-04 19:00:31 +00:00
Andrew Nesbitt	7b22638ef7	Hello world	2026-01-20 22:00:31 +00:00