Andrew Nesbitt
76db94552f
Install development tools directly in CI ( #398 )
2026-10-01 19:48:27 +01:00
Andrew Nesbitt
51caa17d5e
Update git-pkgs dependencies ( #396 )
2026-10-01 16:06:12 +01:00
Andrew Nesbitt
5f0f3b034a
Update enrichment to v0.7.2 ( #394 )
...
* Update ecosystems-go to v0.5.0
* Update enrichment to v0.7.2
2026-10-01 15:25:11 +01:00
dependabot[bot]
eedc2908df
build(deps): bump github.com/git-pkgs/archives from 0.7.0 to 0.7.1
...
Bumps [github.com/git-pkgs/archives](https://github.com/git-pkgs/archives ) from 0.7.0 to 0.7.1.
- [Commits](https://github.com/git-pkgs/archives/compare/v0.7.0...v0.7.1 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/archives
dependency-version: 0.7.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 16:22:59 +00:00
Andrew Nesbitt
36556945ed
Merge pull request #378 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.5
...
build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.4 to 1.33.5
2026-09-24 17:20:57 +01:00
dependabot[bot]
ccc80f8449
build(deps): bump github.com/aws/aws-sdk-go-v2/config
...
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2 ) from 1.33.4 to 1.33.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.4...config/v1.33.5 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.33.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 16:01:35 +00:00
Andrew Nesbitt
7379f4721e
Merge pull request #376 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.59.0
...
build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0
2026-09-24 16:59:53 +01:00
Andrew Nesbitt
43a91ec20d
Merge pull request #374 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/magic-0.4.0
...
build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0
2026-09-24 16:59:08 +01:00
Andrew Nesbitt
4f80102529
Merge pull request #373 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/registries-0.9.2
...
build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
2026-09-24 16:58:40 +01:00
Andrew Nesbitt
e4682c8ec1
Merge pull request #372 from git-pkgs/dependabot/go_modules/golang.org/x/net-0.59.0
...
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
2026-09-24 16:58:01 +01:00
dependabot[bot]
fbb89c9d78
build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.58.0 to 1.59.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.58.0...v1.59.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.59.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:15:14 +00:00
dependabot[bot]
2a35d3df90
build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0
...
Bumps [github.com/git-pkgs/magic](https://github.com/git-pkgs/magic ) from 0.3.1 to 0.4.0.
- [Release notes](https://github.com/git-pkgs/magic/releases )
- [Commits](https://github.com/git-pkgs/magic/compare/v0.3.1...v0.4.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/magic
dependency-version: 0.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:15:01 +00:00
dependabot[bot]
ceee79f123
build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
...
Bumps [github.com/git-pkgs/registries](https://github.com/git-pkgs/registries ) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/git-pkgs/registries/releases )
- [Commits](https://github.com/git-pkgs/registries/compare/v0.9.1...v0.9.2 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/registries
dependency-version: 0.9.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:14:57 +00:00
dependabot[bot]
468e9e564d
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.58.0 to 0.59.0.
- [Commits](https://github.com/golang/net/compare/v0.58.0...v0.59.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.59.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:14:52 +00:00
dependabot[bot]
8bbe117e84
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr
...
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2 ) from 1.65.0 to 1.66.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.65.0...service/s3/v1.66.0 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
dependency-version: 1.66.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:14:48 +00:00
dependabot[bot]
442b591349
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0
...
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.45.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-22 07:38:12 +00:00
abhinavgautam01
548a50d56e
feat: add exact-version package denylist
2026-09-20 14:42:30 +05:30
dependabot[bot]
b2817dc213
Bump github.com/aws/aws-sdk-go-v2/config from 1.33.2 to 1.33.4 ( #356 )
...
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2 ) from 1.33.2 to 1.33.4.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.2...config/v1.33.4 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.33.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-17 21:08:14 +01:00
dependabot[bot]
2aad8bfcec
Bump github.com/git-pkgs/spdx from 0.3.1 to 0.3.2 ( #355 )
...
Bumps [github.com/git-pkgs/spdx](https://github.com/git-pkgs/spdx ) from 0.3.1 to 0.3.2.
- [Commits](https://github.com/git-pkgs/spdx/compare/v0.3.1...v0.3.2 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/spdx
dependency-version: 0.3.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-17 19:59:47 +01:00
dependabot[bot]
2ae6213d3b
Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.64.0 to 1.65.0 ( #357 )
...
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2 ) from 1.64.0 to 1.65.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.64.0...service/s3/v1.65.0 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
dependency-version: 1.65.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-17 19:59:27 +01:00
dependabot[bot]
44361300d3
Bump google.golang.org/grpc from 1.83.1 to 1.83.2 ( #346 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.83.1 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-15 20:05:41 +01:00
dependabot[bot]
f29c9166b5
Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.61.0 to 1.64.0 ( #334 )
...
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2 ) from 1.61.0 to 1.64.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.61.0...service/s3/v1.64.0 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
dependency-version: 1.63.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 23:05:55 -04:00
dependabot[bot]
83e7e8047e
Bump golang.org/x/sync from 0.22.0 to 0.23.0 ( #335 )
...
Bumps [golang.org/x/sync](https://github.com/golang/sync ) from 0.22.0 to 0.23.0.
- [Commits](https://github.com/golang/sync/compare/v0.22.0...v0.23.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/sync
dependency-version: 0.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 23:05:38 -04:00
dependabot[bot]
66a6d812cc
Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 ( #330 )
...
Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model ) from 0.6.2 to 0.6.3.
- [Release notes](https://github.com/prometheus/client_model/releases )
- [Commits](https://github.com/prometheus/client_model/compare/v0.6.2...v0.6.3 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/client_model
dependency-version: 0.6.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 22:38:31 -04:00
dependabot[bot]
0935c1561a
Bump github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.2 ( #336 )
...
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2 ) from 1.32.40 to 1.33.2.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.40...config/v1.33.2 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.33.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 22:37:54 -04:00
dependabot[bot]
dc1ce8d8fc
Bump modernc.org/sqlite from 1.57.0 to 1.58.0 ( #337 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.57.0 to 1.58.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.57.0...v1.58.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.58.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 22:36:45 -04:00
Andrew Nesbitt
eb6e280df7
Bump intra-org dependencies for v0.8.0 ( #314 )
2026-09-04 13:13:09 +01:00
Andrew Nesbitt
d950919608
Use shared artifacts at cache boundaries ( #267 )
...
* Use shared artifacts at cache boundaries
* Address artifact cache review
* Defer cached artifact validation to checkCache
Construct artifacts.Artifact from the row without validation so a
malformed content hash reaches newIntegrityChecks in checkCache, which
clears the row and treats the request as a miss. Erroring at the DB
boundary instead surfaced a 500 and left the bad row in place.
* Build stored Artifact after digest and scan checks
Construct the shared artifact struct from trusted storage output as a
literal, after the hash-mismatch and scanner paths that delete failed
downloads, so no path between Store and updateCacheDB can leave bytes
in storage without a database row.
2026-09-04 10:58:22 +01:00
dependabot[bot]
ca9eed97ff
Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.32.40 ( #310 )
...
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2 ) from 1.32.38 to 1.32.40.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.32.38...config/v1.32.40 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.40
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 17:01:38 +01:00
dependabot[bot]
5492ab5da8
Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.60.7 to 1.61.0 ( #308 )
...
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2 ) from 1.60.7 to 1.61.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ecr/v1.60.7...service/s3/v1.61.0 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
dependency-version: 1.61.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 16:47:51 +01:00
dependabot[bot]
06baf439d3
Bump github.com/CycloneDX/cyclonedx-go from 0.11.0 to 0.12.0 ( #311 )
...
Bumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) from 0.11.0 to 0.12.0.
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.11.0...v0.12.0 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-version: 0.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 16:36:36 +01:00
wickedOne
cad1a9226a
Report upstream circuit breaker state in /health and /metrics ( #275 )
...
* Report upstream circuit breaker state in /health and /metrics
* applied requested changes
* apply review changes
* Bumped github.com/git-pkgs/registries to v0.9.0
2026-09-02 12:52:32 +01:00
Andrew Nesbitt
b5ee6dd96c
Add ECR auto-refreshing upstream authentication ( #278 )
...
* Add ECR auto-refreshing upstream authentication
- Add "ecr" auth type to upstream.auth config with optional region
- Cache ecr:GetAuthorizationToken results per region and refresh
shortly before expiry via the AWS SDK default credential chain
- Route type: ecr through the token cache in Server.authForURL
- Document the new type in config.example.yaml and docs/configuration.md
Fixes #276
* Collapse ecrTokens.header to a single return path
Drops the internal/server package below the goconst min-occurrences
threshold for the Authorization literal.
* Coalesce concurrent ECR token fetches with singleflight
Concurrent cache misses for the same region now share a single
GetAuthorizationToken call instead of each issuing their own, avoiding
a request burst against the ECR API at cold start and at each 12-hour
refresh. golang.org/x/sync is already a direct dependency.
* Improve ECR token refresh and region inference
* Back off failed ECR token refreshes
2026-09-02 12:43:43 +01:00
dependabot[bot]
a0b87bc045
Bump google.golang.org/grpc from 1.82.1 to 1.83.1 ( #299 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.82.1 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.82.1...v1.83.1 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 12:13:30 +01:00
Andrew Nesbitt
41ae7d6520
Add GCS storage backend with lighter dependencies ( #179 )
...
* Add GCS storage backend with Workload Identity support
Register gocloud.dev/blob/gcsblob so gs:// URLs are accepted as a storage
backend. Authentication uses Application Default Credentials, which makes
GKE Workload Identity work out of the box; signed URLs (direct_serve)
fall back to the IAM Credentials signBlob API when no private key is
available.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* Replace gcsblob with lightweight GCS backend
* Extract GCS client into standalone module
---------
Co-authored-by: Anthony A. <github@anthony-arnaud.fr>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-08-29 11:23:07 +01:00
Andrew Nesbitt
cd0aaf00e7
Bump github.com/git-pkgs/purl to v0.1.19 ( #291 )
2026-08-27 18:33:02 +01:00
dependabot[bot]
a1011827b6
Bump github.com/git-pkgs/cooldown from 0.1.1 to 0.2.0 ( #287 )
...
Bumps [github.com/git-pkgs/cooldown](https://github.com/git-pkgs/cooldown ) from 0.1.1 to 0.2.0.
- [Release notes](https://github.com/git-pkgs/cooldown/releases )
- [Commits](https://github.com/git-pkgs/cooldown/compare/v0.1.1...v0.2.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/cooldown
dependency-version: 0.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-27 18:30:58 +01:00
dependabot[bot]
50f5561cc6
Bump github.com/git-pkgs/enrichment from 0.6.5 to 0.7.0 ( #285 )
...
Bumps [github.com/git-pkgs/enrichment](https://github.com/git-pkgs/enrichment ) from 0.6.5 to 0.7.0.
- [Commits](https://github.com/git-pkgs/enrichment/compare/v0.6.5...v0.7.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/enrichment
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-27 16:27:03 +01:00
dependabot[bot]
062d616dac
Bump modernc.org/sqlite from 1.56.0 to 1.57.0 ( #289 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.56.0 to 1.57.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.56.0...v1.57.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-27 16:25:43 +01:00
dependabot[bot]
5508872cbf
Bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 ( #286 )
...
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi ) from 5.3.1 to 5.3.2.
- [Release notes](https://github.com/go-chi/chi/releases )
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md )
- [Commits](https://github.com/go-chi/chi/compare/v5.3.1...v5.3.2 )
---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
dependency-version: 5.3.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-27 16:24:19 +01:00
Andrew Nesbitt
272e6d9040
Lint and dead-code cleanup ( #279 )
...
* Bump go tool golangci-lint to v2.13.1
The .golangci.yml goconst.ignore-tests setting was added in v2.12.0
(golangci/golangci-lint#6480). On the previously pinned v2.10.1,
config verify fails with "additional properties 'ignore-tests' not
allowed" and the setting is silently ignored at run time, so goconst
counts test-file literals toward min-occurrences.
* Apply gofmt and CutSuffix simplification
- gofmt -w internal/server/health_test.go
- Replace HasSuffix+TrimSuffix with CutSuffix in ParseSize
* Remove dead code and migrate tests off legacy Filesystem storage
Migrate the three test call sites of storage.NewFilesystem to
storage.OpenBucket("file://...") and drop the deprecated
StorageConfig.Path field from test configs, then delete code that
deadcode reports as unreachable from cmd/proxy:
- internal/storage/filesystem.go and its tests
- storage.HashingReader
- enrichment.Service.BulkCheckVulnerabilities and NormalizeLicense
- server.ActiveRequestsMiddleware (no-op body; the real tracking
is the inline r.Use at server.go:226)
- mirror.RegistrySource (unimplemented stub)
metrics.UpdateCircuitBreakerState and RecordCircuitBreakerTrip are
kept because #275 wires them.
Update the CONTRIBUTING.md storage section to reflect blob.go.
2026-08-21 09:26:27 +01:00
Andrew Nesbitt
17446b419f
Bump registries to v0.8.1 ( #277 )
2026-08-20 15:38:38 +01:00
Andrew Nesbitt
1a814c7e1f
Use shared integrity verification ( #260 )
...
* Use shared integrity verification
* Finish integrity migration
2026-08-17 09:20:11 +01:00
Andrew Nesbitt
12ad4ecefc
Bump github.com/git-pkgs/purl to v0.1.17 ( #273 )
...
MakePURL/MakePURLString/New now apply the same per-type normalization as
Parse (git-pkgs/purl#30), so canonicalPackagePURL no longer needs its own
Normalize call and DB writes/lookups produce canonical keys.
Existing rows written under a non-canonical purl (mixed-case pypi,
composer, etc) become cache misses on lookup and re-populate under the
canonical key on the next fetch; the old rows are left in place.
Closes #207
2026-08-17 08:36:20 +01:00
Andrew Nesbitt
f0e6e11e8c
Upgrade to Go 1.26.6 ( #246 )
...
* Upgrade to Go 1.26.5
* Use go.mod to select Go 1.26.6
2026-08-16 18:22:26 +01:00
Andrew Nesbitt
3e534690d7
Bump git-pkgs dependencies ( #253 )
2026-08-14 12:17:14 +01:00
Andrew Nesbitt
41c033a1e8
Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 ( #252 )
2026-08-14 11:44:00 +01:00
Andrew Nesbitt
d0f93196a3
Bump dependencies ahead of v0.7.0 ( #235 )
...
- github.com/git-pkgs/archives v0.4.0 -> v0.5.0
- github.com/git-pkgs/magic v0.1.0 -> v0.2.0
- github.com/git-pkgs/spdx v0.1.4 -> v0.3.0
- github.com/prometheus/client_golang v1.24.0 -> v1.24.1
- modernc.org/sqlite v1.55.0 -> v1.56.0
- golang.org/x/text v0.38.0 -> v0.40.0 (fixes GO-2026-5970)
2026-08-06 22:14:51 +01:00
Andrew Nesbitt
36f3a51c65
Detect content types when browsing files
2026-07-31 17:04:01 +01:00
dependabot[bot]
9a9a82176d
Bump modernc.org/sqlite from 1.54.0 to 1.55.0 ( #219 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.54.0 to 1.55.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 09:32:38 +01:00
