174 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Andrew Nesbitt	c50bfc45f7	Update Dockerfile to Go 1.25 to match go.mod	2026-03-19 10:17:08 +00:00
Andrew Nesbitt	6d0204cc7d	Fix Docker publish workflow to trigger on tag push ... The release event created by GITHUB_TOKEN does not trigger downstream workflows. Use tag push trigger instead, and add workflow_dispatch for manual runs.	2026-03-19 10:11:44 +00:00
Andrew Nesbitt	f23e0cb51d	Add workflow to publish Docker image to GHCR on release (#35) v0.1.0	2026-03-19 09:58:31 +00:00
Andrew Nesbitt	9368d5c84c	Update README to reflect current CLI flags, Postgres, and S3 support (#33) ... The README still referenced old flag names (-storage, -database) and was missing documentation for Postgres and S3 storage backends that have since been added. Also bumps the listed Go version from 1.23 to 1.25.	2026-03-18 11:15:45 +00:00
Andrew Nesbitt	599fe9e254	Fix all golangci-lint issues across the codebase (#32) ... * Fix all golangci-lint issues across the codebase Resolve 77 lint issues reported by golangci-lint with gocritic, gocognit, gocyclo, maintidx, dupl, mnd, unparam, ireturn, goconst, and errcheck enabled. Net reduction of ~175 lines through shared helpers and deduplication. * Suppress staticcheck SA1019 for intentional deprecated field usage The Storage.Path field is deprecated but still read for backwards compatibility with existing configs that haven't migrated to the URL field.	2026-03-18 10:59:29 +00:00
Andrew Nesbitt	1308242a1b	Merge pull request #31 from git-pkgs/add-coverage-tests-2 ... Add handler download flow and server utility tests	2026-03-18 09:00:22 +00:00
Andrew Nesbitt	3afa5e050d	Add handler download flow and server utility tests ... Covers HTTP download paths for gem, hex, go, conda, cran, and maven handlers with cache hit, invalid input, and upstream proxy scenarios. Adds server tests for formatTimeAgo, formatSize, categorizeLicense, LoggerMiddleware, search/pagination, and API packages list endpoint.	2026-03-17 20:31:54 +00:00
Andrew Nesbitt	f6ed4adea5	Merge pull request #30 from git-pkgs/add-coverage-tests ... Add tests for handler core, template rendering, and query validation	2026-03-17 13:18:19 +01:00
Andrew Nesbitt	d820f75fa6	Add direct tests for handler core methods, template rendering, and query validation	2026-03-13 17:05:14 +00:00
Andrew Nesbitt	240a61c537	Merge pull request #28 from git-pkgs/add-handler-tests ... Add tests for Conan and NuGet handlers	2026-03-13 08:23:20 +00:00
Andrew Nesbitt	07e5831949	Merge pull request #29 from git-pkgs/fix-metadata-http-client ... Use shared HTTP client for upstream metadata requests	2026-03-13 08:23:13 +00:00
Andrew Nesbitt	e2a683c7a6	Route handler metadata requests through Proxy.HTTPClient instead of http.DefaultClient ... All handler metadata and proxy requests were using http.DefaultClient directly, bypassing any timeout or transport configuration. Added an HTTPClient field to the Proxy struct with a 30-second default timeout, and updated every handler to use it for upstream HTTP requests.	2026-03-13 07:46:28 +00:00
Andrew Nesbitt	06483d2d5c	Add tests for Conan and NuGet handlers ... Tests cover ping endpoints, upstream proxying, service index rewriting, URL rewriting, file caching decisions, header forwarding, error handling, query string preservation, status code passthrough, and input validation.	2026-03-13 07:43:28 +00:00
Andrew Nesbitt	73b9633078	Merge pull request #25 from git-pkgs/add-body-size-limits ... Add size limits on request bodies and upstream metadata reads	2026-03-13 07:30:56 +00:00
Andrew Nesbitt	0e1a06c5e6	Add size limits on request bodies and upstream metadata reads ... POST endpoints (/api/outdated, /api/bulk) now reject bodies over 1 MB using http.MaxBytesReader. Upstream metadata reads (npm, pypi, composer, nuget, pub) now use io.LimitReader capped at 50 MB to prevent OOM from unexpectedly large responses.	2026-03-13 07:28:20 +00:00
Andrew Nesbitt	38213d9631	Merge pull request #23 from git-pkgs/fix-browse-xss ... Fix XSS in browse source file tree	2026-03-13 07:25:57 +00:00
Andrew Nesbitt	3ec353c624	Merge pull request #24 from git-pkgs/fix-error-disclosure ... Stop leaking internal error details to clients	2026-03-13 07:25:44 +00:00
Andrew Nesbitt	68a8af56d4	Merge pull request #26 from git-pkgs/fix-path-traversal ... Reject path traversal in debian and rpm handlers	2026-03-13 07:24:43 +00:00
Andrew Nesbitt	c46535bbef	Merge pull request #27 from git-pkgs/docs-improvements ... Document web UI, monitoring, and database schema	2026-03-13 07:22:57 +00:00
Andrew Nesbitt	ade64386a6	Document web UI, monitoring, database schema, and cooldown support ... Add web interface section to README describing all pages (dashboard, package browser, source browser, version diff). Add monitoring section with the full Prometheus metrics table and scrape config. Add cooldown column to the registry support table. Update architecture doc with accurate database schema including all columns and indexes, and add entries for metrics, cooldown, and enrichment packages.	2026-03-12 12:18:27 +00:00
Andrew Nesbitt	bf7e83efe3	Reject path traversal in debian and rpm handlers ... The debian and rpm handlers take the request path and pass it directly to the upstream URL without checking for ".." segments. This could let a client craft a request that reaches unintended upstream paths. Add a containsPathTraversal check at the entry point of both handlers and return 400 for any path containing ".." segments.	2026-03-12 12:05:52 +00:00
Andrew Nesbitt	3d6ebc9522	Stop leaking internal error messages in API and health responses ... Replace err.Error() in HTTP error responses with generic messages. Internal details like database driver errors and enrichment failures were being sent directly to clients.	2026-03-12 12:01:29 +00:00
Andrew Nesbitt	9e97a3316a	Escape user-controlled strings in browse source JavaScript ... File paths from archive contents were interpolated directly into onclick handlers and innerHTML via template literals. A crafted filename containing quotes could break out of the string context and execute arbitrary JS. Add an escapeHTML helper and use it on all interpolated path and URL values in the browse source page.	2026-03-12 11:59:14 +00:00
Andrew Nesbitt	9b321eaaa6	Merge pull request #21 from git-pkgs/openapi-docs ... Add generated OpenAPI docs support	2026-03-12 11:54:55 +00:00
Andrew Nesbitt	82443e137f	Add generated OpenAPI docs support	2026-03-12 11:49:31 +00:00
Andrew Nesbitt	9c0f1bc58d	Merge pull request #22 from git-pkgs/template-ecosystem-cleanup ... Remove hard-coded ecosystems from templates	2026-03-11 17:55:42 +00:00
Andrew Nesbitt	fe32236a57	Remove hard-coded ecosystems from templates	2026-03-11 17:25:47 +00:00
Andrew Nesbitt	4858286778	Merge pull request #17 from git-pkgs/cooldown-feature ... Add version cooldown to filter recently published packages	2026-03-11 16:04:56 +00:00
Andrew Nesbitt	befc4493a2	Merge pull request #19 from git-pkgs/dependabot/github_actions/actions/setup-go-6.3.0 ... Bump actions/setup-go from 6.2.0 to 6.3.0	2026-03-05 15:42:22 +00:00
dependabot[bot]	bd99f3dd82	Bump actions/setup-go from 6.2.0 to 6.3.0 ... Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](7a3fe6cf4c...4b73464bb3) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-05 15:27:53 +00:00
Andrew Nesbitt	dd4595ddc5	Add version cooldown section to README ... Explains the motivation (supply chain attacks rely on speed), shows a concrete config example, and walks through what happens when a new version is published.	2026-03-04 19:07:53 +00:00
Andrew Nesbitt	4f8f63f354	Add version cooldown to filter recently published packages ... Hides package versions published too recently from metadata responses, giving the community time to spot malicious releases. Configurable per-ecosystem and per-package with duration overrides. Supported for npm, PyPI, pub.dev, and Composer.	2026-03-04 19:00:31 +00:00
Andrew Nesbitt	5f4c57693e	Merge pull request #15 from git-pkgs/use-purl-library ... Replace inline PURL construction with purl library	2026-03-04 09:23:10 +00:00
Andrew Nesbitt	364549ad14	Replace inline PURL construction with purl library ... Uses purl.MakePURLString() instead of fmt.Sprintf("pkg:...") for correct namespace handling (npm scopes, Go module paths, Maven group IDs) and percent-encoding. Replaces hand-rolled extractEcosystem and inline PURL parsing in the bulk lookup fallback with purl.Parse().	2026-03-04 09:20:16 +00:00
Andrew Nesbitt	40cfd7798e	Merge pull request #14 from git-pkgs/update-dependencies ... Update all dependencies	2026-03-04 09:15:43 +00:00
Andrew Nesbitt	1618d6deca	Update all dependencies	2026-03-04 09:09:13 +00:00
Andrew Nesbitt	bd123e298e	Merge pull request #13 from git-pkgs/use-archives-diff ... Replace internal/diff with archives/diff	2026-02-27 12:18:38 +00:00
Andrew Nesbitt	a93eb4da5e	Update archives to v0.2.0	2026-02-27 12:14:00 +00:00
Andrew Nesbitt	07778d9727	Replace internal/diff with archives/diff ... The diff package has been extracted into the archives module where it belongs, since it operates on archives.Reader. This removes the internal copy and imports from github.com/git-pkgs/archives/diff instead.	2026-02-27 10:55:10 +00:00
Andrew Nesbitt	1897f2f44f	Merge pull request #11 from git-pkgs/dependabot/github_actions/goreleaser/goreleaser-action-7.0.0 ... Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0	2026-02-26 16:19:44 +00:00
dependabot[bot]	5b16012ab3	Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 ... Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](e435ccd777...ec59f474b9) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-02-26 15:34:49 +00:00
Andrew Nesbitt	2e9dc1a6b3	Merge pull request #10 from git-pkgs/use-registries-fetch ... Replace internal/upstream with registries/fetch	2026-02-20 20:26:23 +00:00
Andrew Nesbitt	be8c4b9860	Replace internal/upstream with registries/fetch ... Use the new client/ and fetch/ sub-packages from git-pkgs/registries instead of the local upstream package. The fetcher, circuit breaker, and resolver now live in registries where they can be shared across projects. Depends on git-pkgs/registries#8.	2026-02-20 17:31:12 +00:00
Andrew Nesbitt	f10610fc15	Use go tool directive for golangci-lint instead of GitHub Action	2026-02-20 07:59:32 +00:00
Andrew Nesbitt	e6645f38c9	Fix staticcheck QF1012 lint warnings in diff package	2026-02-20 07:53:24 +00:00
Andrew Nesbitt	70dd557184	Update Go dependencies	2026-02-20 07:41:00 +00:00
Andrew Nesbitt	48ae3898c2	Merge pull request #3 from git-pkgs/dependabot/go_modules/github.com/go-chi/chi/v5-5.2.5 ... Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5	2026-02-16 11:25:21 +00:00
Andrew Nesbitt	337159d3cd	Merge pull request #2 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.5.0 ... Bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0	2026-02-16 11:25:10 +00:00
Andrew Nesbitt	4d5098e044	Remove internal/archive package, replaced by git-pkgs/archives dependency	2026-02-16 11:11:48 +00:00
dependabot[bot]	c50bf725b7	Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5 ... Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.4 to 5.2.5. - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.2.4...v5.2.5) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.2.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-02-16 10:54:33 +00:00