dependabot[bot]
06dd126211
Bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.12
...
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2 ) from 1.33.9 to 1.33.12.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.9...config/v1.33.12 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.33.12
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-11-05 15:15:18 +00:00
dependabot[bot]
d5dbd7a95a
Bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.7.1 to 0.8.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](85b2b9fb8e...53290badfa
2026-11-05 15:14:03 +00:00
dependabot[bot]
12c5cc9e4c
Bump docker/login-action from 4.6.0 to 4.7.0
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.6.0 to 4.7.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](dbcb813823...81c6f93d4b
2026-11-05 15:14:00 +00:00
dependabot[bot]
17355d2227
Bump alpine from 3.24.2 to 3.24.3
...
Bumps alpine from 3.24.2 to 3.24.3.
---
updated-dependencies:
- dependency-name: alpine
dependency-version: 3.24.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-11-05 15:13:42 +00:00
Andrew Nesbitt
308cc133ab
Remove connection details from stats response
2026-11-05 15:09:16 +00:00
Andrew Nesbitt
6c8fb35ab7
Merge pull request #626 from simonchrz/feat/project-inventory
...
Add a project inventory built from uploaded SBOMs
2026-11-05 12:36:54 +00:00
Simon Chrzanowski
903fd94df9
Test that apk index errors leave out the URL
2026-11-05 12:34:32 +01:00
Simon Chrzanowski
eb34a1ac6f
Name the apk repository, not its URL, in index errors
2026-11-05 12:33:46 +01:00
Simon Chrzanowski
4d70793351
Name the apk repository in mirror errors
2026-11-05 11:56:42 +01:00
Simon Chrzanowski
c20f64ebaa
Keep the apk namespace for the mirror's repository lookup
...
The inventory drops the namespace from apk names so they match the
handler's, but the apk mirror picks the upstream.apk repository from it.
2026-11-05 10:48:44 +01:00
Simon Chrzanowski
1e916bf334
Merge remote-tracking branch 'origin/main' into feat/project-inventory
2026-11-05 10:47:14 +01:00
Simon Chrzanowski
60872fe990
Use sbom v0.1.9
2026-11-05 09:34:02 +01:00
Andrew Nesbitt
fba9e036df
Merge pull request #656 from simonchrz/feat/mirror-apk
...
Mirror Alpine packages
2026-11-05 08:24:32 +00:00
Simon Chrzanowski
c3f0c23dc3
Name the repository segment of the APK path in the mirror docs
2026-11-04 16:31:50 +01:00
Simon Chrzanowski
e4e14696d0
Say which edge packages the APK mirror can't recognise
2026-11-04 16:20:30 +01:00
Simon Chrzanowski
7095ab67ef
Keep the Projects link on an empty projects page
...
ProjectsListData.Projects hid Layout.Projects, so the header left the
link out when no project had been uploaded.
2026-11-04 16:16:35 +01:00
Simon Chrzanowski
4e25396331
Refuse distro qualifiers that aren't an Alpine release
2026-11-04 16:09:00 +01:00
Simon Chrzanowski
6d3410df41
Use sbom's ProjectRoots for the project's own packages
...
Drop projectRoots and readFromLockFile; sbom now decides which inferred
roots are the project. sbom is on the merge commit of git-pkgs/sbom#27
until it is tagged.
2026-11-04 16:05:16 +01:00
Simon Chrzanowski
adcda6ca8b
Read APKINDEX.tar.gz also where Packages.adb is served beside it
2026-11-04 15:54:10 +01:00
Simon Chrzanowski
3e2a84a88a
Mirror Alpine packages
...
The PURL namespace names the upstream.apk repository, and the distro and
arch qualifiers syft writes give the release and architecture. The package
is looked up in the main and community indexes of that release and cached
under the path the APK handler serves it from.
2026-11-04 15:44:01 +01:00
Andrew Nesbitt
1912deba6c
Merge pull request #620 from simonchrz/feat/composer-advisories
...
Pass Composer security advisories and filter lists through
2026-11-04 12:38:40 +00:00
Simon Chrzanowski
88c0ba8ab3
Use sbom's root detection for the project's own packages
...
Bump sbom to v0.1.8 and replace lockFileRoots with sbom.Roots. Inferred
roots count as the project only when read from a lock file, so an image's
packages that nothing depends on are kept.
2026-11-04 13:20:29 +01:00
Simon Chrzanowski
e358666482
Merge remote-tracking branch 'origin/main' into feat/project-inventory
...
# Conflicts:
# internal/database/database_test.go
# internal/database/schema.go
# internal/server/server.go
2026-11-04 13:19:09 +01:00
Simon Chrzanowski
82b45cbb1b
Merge remote-tracking branch 'origin/main' into feat/composer-advisories
...
# Conflicts:
# README.md
2026-11-04 13:05:10 +01:00
Andrew Nesbitt
5b10559636
Merge pull request #639 from simonchrz/feat/cooldown-withheld-versions
...
Show versions held back by cooldown on the package page and in the API
2026-11-04 12:01:24 +00:00
Andrew Nesbitt
ee6cac700c
Merge pull request #655 from simonchrz/fix/composer-download-lookup-status
...
Answer 502 when a Composer download's metadata lookup fails upstream
2026-11-04 11:59:55 +00:00
Simon Chrzanowski
cb330a5cbf
Answer 502 when a Composer download's metadata lookup fails upstream
...
The lookup took any non-200 metadata response for a version that isn't
listed, so a Packagist outage or rate limit answered the archive request
with 404. Composer treats that as the version being gone.
Only 404 and 410 now mean the document is missing. A 429 is passed on as
503 with Retry-After while the upstream is held, and any other status
answers 502.
2026-11-03 20:10:24 +01:00
Simon Chrzanowski
683455aecb
Test available_at through the API and drop FillVersionPublishedAt
...
The API handler takes the enrichment calls it uses as an interface, so
the test can answer them without reaching a registry.
Remove FillVersionPublishedAt until the shared cooldown filter calls it.
2026-11-03 14:39:36 +01:00
Andrew Nesbitt
9777f4b9bc
Merge pull request #625 from simonchrz/feat/change-feeds
...
Follow npm and Packagist change feeds to revalidate changed metadata
2026-11-03 11:36:58 +00:00
Simon Chrzanowski
8aebf94f5d
Merge remote-tracking branch 'origin/main' into feat/change-feeds
...
# Conflicts:
# go.mod
# go.sum
2026-11-03 11:23:40 +01:00
Simon Chrzanowski
83524b7485
Merge remote-tracking branch 'origin/main' into feat/cooldown-withheld-versions
2026-11-03 11:23:22 +01:00
Andrew Nesbitt
c1a1149bd8
Merge pull request #622 from simonchrz/feat/apk-snapshots
...
Serve dated snapshots of Alpine APK indexes
2026-11-03 09:36:40 +00:00
Andrew Nesbitt
abee8ef879
Merge pull request #640 from simonchrz/feat/npm-stream-rewrite
...
Stream npm packuments through storage when rewriting them
2026-11-03 09:33:36 +00:00
Andrew Nesbitt
7cb905638c
Keep proxyCachedWithEncoding doc on the function it describes
2026-11-03 09:28:29 +00:00
Andrew Nesbitt
47ed4b4194
Merge pull request #649 from simonchrz/fix/truncated-upstream-metadata
...
Fail metadata reads when upstream cuts a document off
2026-11-03 09:22:25 +00:00
Andrew Nesbitt
83a0822979
Merge pull request #644 from simonchrz/mirror-parallel-blobs
...
Fetch an image's blobs concurrently when mirroring
2026-11-03 09:15:16 +00:00
Andrew Nesbitt
d139d190de
Merge pull request #643 from simonchrz/docker-healthcheck
...
Document the published container image and add a Docker health check
2026-11-03 08:59:28 +00:00
Andrew Nesbitt
0a961584af
Merge pull request #653 from simonchrz/docs/sqlite-local-disk
...
Document that SQLite needs a local disk or block volume
2026-11-02 18:07:05 +00:00
simon chrzanowski
07c740737f
Merge pull request #651 from kokes/kokes/ui-version-commit
2026-11-02 18:17:22 +01:00
Simon Chrzanowski
dd987f2de7
Document that SQLite needs a local disk or block volume
2026-11-02 16:56:33 +01:00
Ondrej Kokes
f35d152be0
expose commit sha in UI footer
2026-11-02 11:37:28 +01:00
Simon Chrzanowski
26cae44e41
Bump cooldown to v0.3.1 and set cooldown directly in stream tests
...
v0.3.1 parses a Config once when it is first used concurrently, so the
stream tests no longer need cooldown.NewPolicy.
2026-11-02 11:33:11 +01:00
Andrew Nesbitt
cc8f50cfb4
Merge pull request #646 from simonchrz/fix/version-publish-time-package
...
Count stored publish times under their ecosystem in the stats
2026-11-02 10:16:34 +00:00
Simon Chrzanowski
98ff4fd4a2
Merge remote-tracking branch 'origin/main' into feat/npm-stream-rewrite
...
# Conflicts:
# cmd/proxy/main.go
2026-11-01 12:54:47 +01:00
Simon Chrzanowski
b08cebf9e4
Cap npm packuments streamed into storage
...
metadata_max_size bounds what is read into memory, but a packument
streamed from upstream into storage had no limit, and with cooldown was
stored twice. It is now capped by metadata_stream_max_size, 1 GB by
default. A document over the cap fails as an upstream failure: nothing is
stored, and the stored copy, if any, is served instead.
The metadata settings move into configureMetadata to keep serve under
the maintidx limit.
2026-11-01 12:53:00 +01:00
Simon Chrzanowski
6dbda21faf
Move the in-memory truncation fix to its own pull request
...
The change to ReadMetadataSized and fetchUpstreamMetadata, with its tests,
is now #649 . upstreamBodyReader stays for storeUpstreamMetadata, in a file
of its own that #649 adds with the same content.
2026-11-01 12:49:09 +01:00
Simon Chrzanowski
143eef7f05
Test snapshots on cache hits and record them through proxyCachedWithEncoding
...
TestAPKSnapshots_CacheHit covers the cache-hit branch with a metadata TTL
above 0. proxyCachedWithEncoding takes optional hooks for a cache hit and a
fetched body, so the APK handler no longer keeps a copy of it.
2026-11-01 12:48:37 +01:00
Simon Chrzanowski
358b1355a9
Fail metadata reads when upstream cuts a document off
...
ReadMetadataSized took the transport's io.ErrUnexpectedEOF for the end of
a body shorter than its size hint. A document upstream closed before its
Content-Length was served with a 200 and cached, or failed the cooldown
filter with a 502, instead of the cached copy being served. Upstream
bodies are now read through a reader that marks their read errors, and
such a body fails the read as an upstream failure.
2026-11-01 12:48:04 +01:00
Simon Chrzanowski
7b91897fbb
Merge remote-tracking branch 'origin/main' into feat/apk-snapshots
...
# Conflicts:
# internal/server/server.go
2026-11-01 12:44:35 +01:00
simon chrzanowski
15789d40bb
Update golang.org/x/net to v0.62.0 ( #647 )
...
Fixes CVE-2026-78661 and CVE-2026-97045 in x/net/html, which parses
upstream PyPI simple pages for the denylist.
2026-10-31 20:14:53 +00:00
