mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-08-01 01:58:09 -04:00
Code Issues Releases Packages Wiki Activity
265 commits 23 branches 10 tags 2.2 MiB
Commit graph

265 commits

This branch
This branch
All branches
Author SHA1 Message Date
Andrew Nesbitt
240a61c537
 		Merge pull request #28 from git-pkgs/add-handler-tests 
Add tests for Conan and NuGet handlers
 2026-03-13 08:23:20 +00:00
Andrew Nesbitt
07e5831949
 		Merge pull request #29 from git-pkgs/fix-metadata-http-client 
Use shared HTTP client for upstream metadata requests
 2026-03-13 08:23:13 +00:00
Andrew Nesbitt
e2a683c7a6
 		Route handler metadata requests through Proxy.HTTPClient instead of http.DefaultClient 
All handler metadata and proxy requests were using http.DefaultClient directly,
bypassing any timeout or transport configuration. Added an HTTPClient field to
the Proxy struct with a 30-second default timeout, and updated every handler
to use it for upstream HTTP requests.
 2026-03-13 07:46:28 +00:00
Andrew Nesbitt
06483d2d5c
 		Add tests for Conan and NuGet handlers 
Tests cover ping endpoints, upstream proxying, service index rewriting,
URL rewriting, file caching decisions, header forwarding, error handling,
query string preservation, status code passthrough, and input validation.
 2026-03-13 07:43:28 +00:00
Andrew Nesbitt
73b9633078
 		Merge pull request #25 from git-pkgs/add-body-size-limits 
Add size limits on request bodies and upstream metadata reads
 2026-03-13 07:30:56 +00:00
Andrew Nesbitt
0e1a06c5e6
 		Add size limits on request bodies and upstream metadata reads 
POST endpoints (/api/outdated, /api/bulk) now reject bodies over 1 MB
using http.MaxBytesReader. Upstream metadata reads (npm, pypi, composer,
nuget, pub) now use io.LimitReader capped at 50 MB to prevent OOM from
unexpectedly large responses.
 2026-03-13 07:28:20 +00:00
Andrew Nesbitt
38213d9631
 		Merge pull request #23 from git-pkgs/fix-browse-xss 
Fix XSS in browse source file tree
 2026-03-13 07:25:57 +00:00
Andrew Nesbitt
3ec353c624
 		Merge pull request #24 from git-pkgs/fix-error-disclosure 
Stop leaking internal error details to clients
 2026-03-13 07:25:44 +00:00
Andrew Nesbitt
68a8af56d4
 		Merge pull request #26 from git-pkgs/fix-path-traversal 
Reject path traversal in debian and rpm handlers
 2026-03-13 07:24:43 +00:00
Andrew Nesbitt
c46535bbef
 		Merge pull request #27 from git-pkgs/docs-improvements 
Document web UI, monitoring, and database schema
 2026-03-13 07:22:57 +00:00
Andrew Nesbitt
ade64386a6
 		Document web UI, monitoring, database schema, and cooldown support 
Add web interface section to README describing all pages (dashboard,
package browser, source browser, version diff). Add monitoring section
with the full Prometheus metrics table and scrape config. Add cooldown
column to the registry support table. Update architecture doc with
accurate database schema including all columns and indexes, and add
entries for metrics, cooldown, and enrichment packages.
 2026-03-12 12:18:27 +00:00
Andrew Nesbitt
bf7e83efe3
 		Reject path traversal in debian and rpm handlers 
The debian and rpm handlers take the request path and pass it directly
to the upstream URL without checking for ".." segments. This could let
a client craft a request that reaches unintended upstream paths.

Add a containsPathTraversal check at the entry point of both handlers
and return 400 for any path containing ".." segments.
 2026-03-12 12:05:52 +00:00
Andrew Nesbitt
3d6ebc9522
 		Stop leaking internal error messages in API and health responses 
Replace err.Error() in HTTP error responses with generic messages.
Internal details like database driver errors and enrichment failures
were being sent directly to clients.
 2026-03-12 12:01:29 +00:00
Andrew Nesbitt
9e97a3316a
 		Escape user-controlled strings in browse source JavaScript 
File paths from archive contents were interpolated directly into onclick
handlers and innerHTML via template literals. A crafted filename containing
quotes could break out of the string context and execute arbitrary JS.

Add an escapeHTML helper and use it on all interpolated path and URL values
in the browse source page.
 2026-03-12 11:59:14 +00:00
Andrew Nesbitt
9b321eaaa6
 		Merge pull request #21 from git-pkgs/openapi-docs 
Add generated OpenAPI docs support
 2026-03-12 11:54:55 +00:00
Andrew Nesbitt
82443e137f
 		Add generated OpenAPI docs support 2026-03-12 11:49:31 +00:00
Andrew Nesbitt
9c0f1bc58d
 		Merge pull request #22 from git-pkgs/template-ecosystem-cleanup 
Remove hard-coded ecosystems from templates
 2026-03-11 17:55:42 +00:00
Andrew Nesbitt
fe32236a57
 		Remove hard-coded ecosystems from templates 2026-03-11 17:25:47 +00:00
Andrew Nesbitt
4858286778
 		Merge pull request #17 from git-pkgs/cooldown-feature 
Add version cooldown to filter recently published packages
 2026-03-11 16:04:56 +00:00
Andrew Nesbitt
befc4493a2
 		Merge pull request #19 from git-pkgs/dependabot/github_actions/actions/setup-go-6.3.0 
Bump actions/setup-go from 6.2.0 to 6.3.0
 2026-03-05 15:42:22 +00:00
dependabot[bot]
bd99f3dd82
 		Bump actions/setup-go from 6.2.0 to 6.3.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.2.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](7a3fe6cf4c...4b73464bb3)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-05 15:27:53 +00:00
Andrew Nesbitt
dd4595ddc5
 		Add version cooldown section to README 
Explains the motivation (supply chain attacks rely on speed), shows a
concrete config example, and walks through what happens when a new
version is published.
 2026-03-04 19:07:53 +00:00
Andrew Nesbitt
4f8f63f354
 		Add version cooldown to filter recently published packages 
Hides package versions published too recently from metadata responses,
giving the community time to spot malicious releases. Configurable
per-ecosystem and per-package with duration overrides. Supported for
npm, PyPI, pub.dev, and Composer.
 2026-03-04 19:00:31 +00:00
Andrew Nesbitt
5f4c57693e
 		Merge pull request #15 from git-pkgs/use-purl-library 
Replace inline PURL construction with purl library
 2026-03-04 09:23:10 +00:00
Andrew Nesbitt
364549ad14
 		Replace inline PURL construction with purl library 
Uses purl.MakePURLString() instead of fmt.Sprintf("pkg:...") for
correct namespace handling (npm scopes, Go module paths, Maven group
IDs) and percent-encoding. Replaces hand-rolled extractEcosystem and
inline PURL parsing in the bulk lookup fallback with purl.Parse().
 2026-03-04 09:20:16 +00:00
Andrew Nesbitt
40cfd7798e
 		Merge pull request #14 from git-pkgs/update-dependencies 
Update all dependencies
 2026-03-04 09:15:43 +00:00
Andrew Nesbitt
1618d6deca
 		Update all dependencies 2026-03-04 09:09:13 +00:00
Andrew Nesbitt
bd123e298e
 		Merge pull request #13 from git-pkgs/use-archives-diff 
Replace internal/diff with archives/diff
 2026-02-27 12:18:38 +00:00
Andrew Nesbitt
a93eb4da5e
 		Update archives to v0.2.0 2026-02-27 12:14:00 +00:00
Andrew Nesbitt
07778d9727
 		Replace internal/diff with archives/diff 
The diff package has been extracted into the archives module where it
belongs, since it operates on archives.Reader. This removes the internal
copy and imports from github.com/git-pkgs/archives/diff instead.
 2026-02-27 10:55:10 +00:00
Andrew Nesbitt
1897f2f44f
 		Merge pull request #11 from git-pkgs/dependabot/github_actions/goreleaser/goreleaser-action-7.0.0 
Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0
 2026-02-26 16:19:44 +00:00
dependabot[bot]
5b16012ab3
 		Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](e435ccd777...ec59f474b9)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-26 15:34:49 +00:00
Andrew Nesbitt
2e9dc1a6b3
 		Merge pull request #10 from git-pkgs/use-registries-fetch 
Replace internal/upstream with registries/fetch
 2026-02-20 20:26:23 +00:00
Andrew Nesbitt
be8c4b9860
 		Replace internal/upstream with registries/fetch 
Use the new client/ and fetch/ sub-packages from git-pkgs/registries
instead of the local upstream package. The fetcher, circuit breaker, and
resolver now live in registries where they can be shared across projects.

Depends on git-pkgs/registries#8.
 2026-02-20 17:31:12 +00:00
Andrew Nesbitt
f10610fc15
 		Use go tool directive for golangci-lint instead of GitHub Action 2026-02-20 07:59:32 +00:00
Andrew Nesbitt
e6645f38c9
 		Fix staticcheck QF1012 lint warnings in diff package 2026-02-20 07:53:24 +00:00
Andrew Nesbitt
70dd557184
 		Update Go dependencies 2026-02-20 07:41:00 +00:00
Andrew Nesbitt
48ae3898c2
 		Merge pull request #3 from git-pkgs/dependabot/go_modules/github.com/go-chi/chi/v5-5.2.5 
Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5
 2026-02-16 11:25:21 +00:00
Andrew Nesbitt
337159d3cd
 		Merge pull request #2 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.5.0 
Bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0
 2026-02-16 11:25:10 +00:00
Andrew Nesbitt
4d5098e044
 		Remove internal/archive package, replaced by git-pkgs/archives dependency 2026-02-16 11:11:48 +00:00
dependabot[bot]
c50bf725b7
 		Bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5 
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.4 to 5.2.5.
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.2.4...v5.2.5)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-16 10:54:33 +00:00
dependabot[bot]
b86c8be81d
 		Bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.4.1 to 0.5.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](135698455d...0dce2577a4)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-16 10:54:32 +00:00
Andrew Nesbitt
8ddf07587c
 		Fix golangci-lint errors (errcheck, staticcheck, unused) 2026-02-16 10:53:21 +00:00
Andrew Nesbitt
e35394bee3
 		Use shared github.com/git-pkgs/enrichment module 2026-02-06 10:37:00 +00:00
Andrew Nesbitt
c7106922c8
 		go mod tidy 2026-02-04 08:49:17 +00:00
Andrew Nesbitt
8c7928cf31
 		Update dependencies 2026-02-03 22:53:40 +00:00
Andrew Nesbitt
96ff2731e5
 		Update ecosystems-go dependency version in go.mod 2026-02-03 22:41:13 +00:00
Andrew Nesbitt
2d7cb8eae5
 		Refactoring and features 2026-02-03 22:40:40 +00:00
Andrew Nesbitt
bbd88fcca1
 		Update .gitignore 2026-02-03 22:40:26 +00:00
Andrew Nesbitt
0901aa082b
 		ignore binary 2026-02-03 22:40:26 +00:00