mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-08-01 01:58:09 -04:00
Code Issues Releases Packages Wiki Activity
260 commits 23 branches 10 tags 2.2 MiB
Commit graph

260 commits

This branch
This branch
All branches
Author SHA1 Message Date
dependabot[bot]
90422697b8
 		Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#216) v0.6.0 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-27 12:16:27 +01:00
Andrew Nesbitt
44041d07a9
 		Bump git-pkgs archives, enrichment, purl, registries, vulns (#215) 2026-07-27 12:15:57 +01:00
Andrew Nesbitt
cf3741162f
 		fix(upstream): honor npm and Cargo overrides (#200) 
* fix(upstream): honor npm and cargo overrides

* Preserve npm scope separators in download URLs

* Apply upstream auth to metadata requests
 2026-07-26 19:11:24 +01:00
Tilian Honig
532e4925fe
 		fix: proper handling of upstream registry 404s (#209) 
* fix: proper handling of upstream registry 404s

* fix: consistently return 404s for all artifact types
 2026-07-26 19:07:46 +01:00
Andrew Nesbitt
6b767d0128
 		Merge pull request #211 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vers-0.3.0 
Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
 2026-07-23 17:01:32 +01:00
Andrew Nesbitt
4737777e80
 		Merge pull request #212 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.6.0 
Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
 2026-07-23 16:52:51 +01:00
Andrew Nesbitt
238c628b31
 		Merge pull request #213 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.54.0 
Bump modernc.org/sqlite from 1.53.0 to 1.54.0
 2026-07-23 16:47:03 +01:00
Andrew Nesbitt
ced9c1198b
 		Merge pull request #210 from git-pkgs/dependabot/github_actions/actions/setup-go-7.0.0 
Bump actions/setup-go from 6.5.0 to 7.0.0
 2026-07-23 16:45:51 +01:00
dependabot[bot]
13ae3970e9
 		Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0 
Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers) from 0.2.6 to 0.3.0.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.2.6...v0.3.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:42:03 +00:00
Andrew Nesbitt
7071d4fb0e
 		Merge pull request #214 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vulns-0.2.0 
Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
 2026-07-23 16:39:43 +01:00
dependabot[bot]
5ae5eab031
 		Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0 
Bumps [github.com/git-pkgs/vulns](https://github.com/git-pkgs/vulns) from 0.1.6 to 0.2.0.
- [Commits](https://github.com/git-pkgs/vulns/compare/v0.1.6...v0.2.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vulns
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:14:10 +00:00
dependabot[bot]
c3f1577017
 		Bump modernc.org/sqlite from 1.53.0 to 1.54.0 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.53.0 to 1.54.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.54.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:14:01 +00:00
dependabot[bot]
d9b7a30294
 		Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.7 to 0.6.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](192e21d79a...6599ee8b7a)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:13:53 +00:00
dependabot[bot]
60c72be65e
 		Bump actions/setup-go from 6.5.0 to 7.0.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](924ae3a1cd...b7ad1dad31)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:13:49 +00:00
Andrew Nesbitt
0a3b9e58f2
 		Merge pull request #201 from git-pkgs/fix-197-cooldown-scoped-purls 
Normalize cooldown package PURL overrides
 2026-07-17 18:18:54 -07:00
Andrew Nesbitt
cdbd1a9369 Canonicalize cooldown lookup PURLs to match config 
NormalizedPackages runs config keys through purl.Parse().String(), which
applies per-type rules like lowercasing pypi names. The handler side was
building lookup keys with MakePURLString, which does not, so a config
entry for pkg:pypi/Django would be normalized to pkg:pypi/django and
never match the runtime key pkg:pypi/Django.

Route both sides through the same canonical form: a new
canonicalPackagePURL helper calls Normalize() on the constructed PURL
before stringifying, and all cooldown IsAllowed call sites use it.
 2026-07-17 18:11:47 -07:00
Andrew Nesbitt
785c989f12
 		Merge pull request #206 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/enrichment-0.5.0 
Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
 2026-07-17 10:23:03 -07:00
dependabot[bot]
41ef27907e
 		Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0 
Bumps [github.com/git-pkgs/enrichment](https://github.com/git-pkgs/enrichment) from 0.4.1 to 0.6.0.
- [Commits](https://github.com/git-pkgs/enrichment/compare/v0.4.1...v0.6.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/enrichment
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-17 15:20:18 +00:00
Andrew Nesbitt
95b4e34ebe
 		Merge pull request #204 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/purl-0.1.14 
Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
 2026-07-17 08:19:09 -07:00
Andrew Nesbitt
61b91fbebb
 		Merge pull request #203 from git-pkgs/dependabot/go_modules/github.com/go-chi/chi/v5-5.3.1 
Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
 2026-07-17 08:18:12 -07:00
Andrew Nesbitt
4e0575a3ab
 		Merge pull request #202 from git-pkgs/dependabot/docker/golang-1.26.5-alpine 
Bump golang from 1.26.4-alpine to 1.26.5-alpine
 2026-07-17 08:15:36 -07:00
Andrew Nesbitt
a79ec25bc9
 		Merge pull request #205 from git-pkgs/dependabot/github_actions/docker/login-action-4.4.0 
Bump docker/login-action from 4.3.0 to 4.4.0
 2026-07-16 09:50:50 -07:00
dependabot[bot]
df997e5825
 		Bump docker/login-action from 4.3.0 to 4.4.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](c99871dec2...af1e73f918)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 15:14:14 +00:00
dependabot[bot]
96e113213d
 		Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14 
Bumps [github.com/git-pkgs/purl](https://github.com/git-pkgs/purl) from 0.1.13 to 0.1.14.
- [Commits](https://github.com/git-pkgs/purl/compare/v0.1.13...v0.1.14)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/purl
  dependency-version: 0.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 15:14:12 +00:00
dependabot[bot]
ec3cc35795
 		Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1 
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.0 to 5.3.1.
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 15:14:06 +00:00
dependabot[bot]
cdf075695f
 		Bump golang from 1.26.4-alpine to 1.26.5-alpine 
Bumps golang from 1.26.4-alpine to 1.26.5-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.5-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-16 15:14:00 +00:00
Andrew Nesbitt
be15a0f826 Fix cooldown overrides for scoped package PURLs 2026-07-13 17:11:04 -07:00
Andrew Nesbitt
23364bd44a
 		Merge pull request #196 from ychampion/fix-go-proxy-not-found-status 
fix(go): return 404 for missing modules
 2026-07-12 23:32:24 +01:00
ychampion
5b959d14b9 Preserve Go proxy fallback for missing modules 
Return the repository-standard not-found response when an upstream module is absent.

Constraint: GOPROXY advances to direct only after 404 or 410 responses.
Rejected: Preserve a handler-specific response body | sibling handlers consistently use not found.
Confidence: high
Scope-risk: narrow
Directive: Keep missing-artifact responses consistent across registry handlers.
Tested: go test ./internal/handler -run TestGoModuleDownloadUpstreamErrors -count=1; prior go test -race ./...; go build ./...; golangci-lint; go vet.
 2026-07-12 18:48:39 +00:00
Andrew Nesbitt
18c711b4d3
 		Merge pull request #195 from git-pkgs/fix-filesystem-storage-path-validation 
Validate filesystem storage paths
 2026-07-09 17:46:32 +01:00
Andrew Nesbitt
98150ea576
 		Name empty path validation subtest 2026-07-09 17:41:05 +01:00
Andrew Nesbitt
41465968cb
 		Validate filesystem storage paths 2026-07-09 17:36:18 +01:00
Andrew Nesbitt
95bb9d897a
 		Merge pull request #193 from git-pkgs/dependabot/github_actions/goreleaser/goreleaser-action-7.2.3 
Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
 2026-07-09 17:19:29 +01:00
Andrew Nesbitt
16e778970f
 		Merge pull request #192 from git-pkgs/dependabot/github_actions/docker/login-action-4.3.0 
Bump docker/login-action from 4.2.0 to 4.3.0
 2026-07-09 16:41:34 +01:00
Andrew Nesbitt
a13e3ecaf1
 		Merge pull request #191 from git-pkgs/dependabot/go_modules/golang.org/x/sync-0.22.0 
Bump golang.org/x/sync from 0.21.0 to 0.22.0
 2026-07-09 16:41:08 +01:00
Andrew Nesbitt
c4f2b89290
 		Merge pull request #190 from git-pkgs/dependabot/github_actions/docker/build-push-action-7.3.0 
Bump docker/build-push-action from 7.2.0 to 7.3.0
 2026-07-09 16:40:19 +01:00
Andrew Nesbitt
bb9e560b46
 		Merge pull request #194 from git-pkgs/dependabot/github_actions/docker/metadata-action-6.2.0 
Bump docker/metadata-action from 6.1.0 to 6.2.0
 2026-07-09 16:39:00 +01:00
dependabot[bot]
383d2089cf
 		Bump docker/metadata-action from 6.1.0 to 6.2.0 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](80c7e94dd9...dc80280410)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 15:14:26 +00:00
dependabot[bot]
defe1ec96d
 		Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 7.2.2 to 7.2.3.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](5daf1e915a...f06c13b6b1)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 7.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 15:14:16 +00:00
dependabot[bot]
ea4eea4b11
 		Bump docker/login-action from 4.2.0 to 4.3.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.3.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](650006c6eb...c99871dec2)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 15:14:07 +00:00
dependabot[bot]
f7b5dd2028
 		Bump golang.org/x/sync from 0.21.0 to 0.22.0 
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.21.0 to 0.22.0.
- [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 15:14:04 +00:00
dependabot[bot]
df3ad91848
 		Bump docker/build-push-action from 7.2.0 to 7.3.0 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.2.0 to 7.3.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](f9f3042f7e...53b7df96c9)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-09 15:13:56 +00:00
Andrew Nesbitt
38e2ff4ae4
 		Merge pull request #188 from git-pkgs/http-timeout-config 
Make upstream HTTP timeout configurable
 2026-07-07 18:38:18 +01:00
Andrew Nesbitt
cb8caa81d2
 		Merge pull request #189 from git-pkgs/bump-x-net 
Bump golang.org/x/net to v0.56.0
 2026-07-07 18:38:03 +01:00
Andrew Nesbitt
1a18dd4635
 		Bump golang.org/x/net to v0.56.0 
Clears GHSA-5cv4-jp36-h3mw / CVE-2026-25680 (HTML parser DoS, only
reachable via golangci-lint tooling deps) and GO-2026-5026 (idna
Punycode validation, reachable via http.Client.Do). Also pulls
x/crypto, x/sys and x/text forward as required by x/net.
 2026-07-07 17:53:35 +01:00
Andrew Nesbitt
0ae63066e2
 		Make upstream HTTP timeout configurable 
Add http_timeout config option (and PROXY_HTTP_TIMEOUT env var) to set
the per-request timeout on the shared HTTP client used by protocol
handlers for upstream metadata fetches and pass-through file requests.
Defaults to the previous hardcoded 30s; "0" disables the timeout.

Fixes #187
 2026-07-07 17:48:36 +01:00
Andrew Nesbitt
95318dedff
 		Merge pull request #181 from git-pkgs/dependabot/github_actions/actions/setup-go-6.5.0 
Bump actions/setup-go from 6.4.0 to 6.5.0
 2026-07-02 16:44:01 +01:00
Andrew Nesbitt
b45757ea86
 		Merge pull request #180 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.5.7 
Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
 2026-07-02 16:41:52 +01:00
dependabot[bot]
a8c0562c97
 		Bump actions/setup-go from 6.4.0 to 6.5.0 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](4a3601121d...924ae3a1cd)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 15:13:48 +00:00
dependabot[bot]
81d19b7632
 		Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.6 to 0.5.7.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](5f14fd08f7...192e21d79a)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 15:13:19 +00:00