From f8f475a65d2a6555a81d1f69779dd8a0f9926ae5 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Mon, 13 Jul 2026 16:17:52 -0700
Subject: [PATCH 01/25] upstream: apply authentication through shared transport

---
 config.example.yaml                   |   3 +-
 docs/architecture.md                  |   2 +
 docs/configuration.md                 |   6 +-
 internal/config/config.go             |  51 +++-
 internal/config/config_test.go        |  42 +++
 internal/httpclient/transport.go      | 418 ++++++++++++++++++++++++++
 internal/httpclient/transport_test.go | 151 ++++++++++
 internal/server/server.go             |  32 +-
 8 files changed, 689 insertions(+), 16 deletions(-)
 create mode 100644 internal/httpclient/transport.go
 create mode 100644 internal/httpclient/transport_test.go

diff --git a/config.example.yaml b/config.example.yaml
index d1ed9a1..2124e48 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -96,7 +96,8 @@ upstream:
   cargo_download: "https://static.crates.io/crates"
 
   # Authentication for upstream registries
-  # Keys are URL prefixes matched against request URLs.
+  # Keys are absolute URL scopes. Scheme, host, effective port, and path
+  # segment boundaries must match; the longest matching scope wins.
   # Values can reference environment variables using ${VAR_NAME} syntax.
   #
   # Supported auth types:
diff --git a/docs/architecture.md b/docs/architecture.md
index f04d548..cf8b0e2 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -240,6 +240,8 @@ Fetches artifacts from upstream registries.
 - Exponential backoff retry on 429 (rate limit) and 5xx errors
 - Returns streaming reader (doesn't load into memory)
 - Configurable user-agent
+- Shares an authentication-aware transport with metadata requests so URL-scoped credentials apply consistently
+- Discovers and caches scoped OCI Bearer tokens from registry challenges
 
 **Resolver:**
 - Determines download URL for a package/version
diff --git a/docs/configuration.md b/docs/configuration.md
index dcdec24..02d426f 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -123,7 +123,9 @@ upstream:
 
 ## Authentication
 
-Configure authentication for private upstream registries. Auth is matched by URL prefix, and credentials can reference environment variables using `${VAR_NAME}` syntax.
+Configure authentication for private upstream registries. The same authentication-aware client is used for metadata and artifact downloads, and credentials can reference environment variables using `${VAR_NAME}` syntax.
+
+OCI registries that return a Bearer challenge from a `/v2/{repository}/…` endpoint are handled automatically. The proxy discovers the token realm from `WWW-Authenticate`, applies any configured credentials for the token URL, and reuses the scoped token until shortly before it expires.
 
 ### Bearer Token
 
@@ -172,7 +174,7 @@ upstream:
 
 ### URL Matching
 
-Auth configs are matched by URL prefix. The longest matching prefix wins, so you can configure different credentials for different paths:
+Auth keys must be absolute URLs. Matching compares the scheme, host, effective port, and path-segment prefix, preventing credentials for `registry.example.com` from being sent to a lookalike host such as `registry.example.com.evil.test`. The longest matching scope wins, so you can configure different credentials for different paths:
 
 ```yaml
 upstream:
diff --git a/internal/config/config.go b/internal/config/config.go
index 2d275c7..a54d50c 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -274,23 +274,29 @@ type UpstreamConfig struct {
 	CargoDownload string `json:"cargo_download" yaml:"cargo_download"`
 
 	// Auth configures authentication for upstream registries.
-	// Keys are URL prefixes that are matched against request URLs.
+	// Keys are absolute URL scopes matched by scheme, host, effective port,
+	// and path-segment prefix.
 	// Example: "https://npm.pkg.github.com" matches all requests to that host.
 	Auth map[string]AuthConfig `json:"auth" yaml:"auth"`
 }
 
 // AuthForURL returns the auth config that matches the given URL.
-// Matches are based on URL prefix - the longest matching prefix wins.
+// The longest matching URL scope wins.
 func (u *UpstreamConfig) AuthForURL(url string) *AuthConfig {
 	if u.Auth == nil {
 		return nil
 	}
+	target, err := parseAuthURL(url)
+	if err != nil {
+		return nil
+	}
 
 	var bestMatch *AuthConfig
 	var bestLen int
 
 	for pattern, auth := range u.Auth {
-		if strings.HasPrefix(url, pattern) && len(pattern) > bestLen {
+		configured, err := parseAuthURL(pattern)
+		if err == nil && authURLMatches(configured, target) && len(pattern) > bestLen {
 			a := auth // copy to avoid loop variable capture
 			bestMatch = &a
 			bestLen = len(pattern)
@@ -300,6 +306,45 @@ func (u *UpstreamConfig) AuthForURL(url string) *AuthConfig {
 	return bestMatch
 }
 
+func parseAuthURL(value string) (*url.URL, error) {
+	parsed, err := url.Parse(value)
+	if err != nil || !parsed.IsAbs() || parsed.Hostname() == "" || parsed.Opaque != "" {
+		return nil, fmt.Errorf("invalid authentication URL")
+	}
+	return parsed, nil
+}
+
+func authURLMatches(configured, target *url.URL) bool {
+	if !strings.EqualFold(configured.Scheme, target.Scheme) ||
+		!strings.EqualFold(configured.Hostname(), target.Hostname()) ||
+		authURLPort(configured) != authURLPort(target) {
+		return false
+	}
+	if configured.RawQuery != "" && configured.RawQuery != target.RawQuery {
+		return false
+	}
+
+	configuredPath := strings.TrimSuffix(configured.EscapedPath(), "/")
+	if configuredPath == "" {
+		return true
+	}
+	targetPath := strings.TrimSuffix(target.EscapedPath(), "/")
+	return targetPath == configuredPath || strings.HasPrefix(targetPath, configuredPath+"/")
+}
+
+func authURLPort(value *url.URL) string {
+	if port := value.Port(); port != "" {
+		return port
+	}
+	if strings.EqualFold(value.Scheme, "https") {
+		return "443"
+	}
+	if strings.EqualFold(value.Scheme, "http") {
+		return "80"
+	}
+	return ""
+}
+
 // AuthConfig configures authentication for an upstream registry.
 type AuthConfig struct {
 	// Type is the authentication type: "bearer", "basic", or "header".
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 9c34023..63520a2 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -760,3 +760,45 @@ func TestDatabaseConfigString(t *testing.T) {
 		}
 	}
 }
+
+func TestUpstreamAuthForURLMatchesURLComponents(t *testing.T) {
+	registryAuth := AuthConfig{Type: "bearer", Token: "registry-token"}
+	privateAuth := AuthConfig{Type: "bearer", Token: "private-token"}
+	config := UpstreamConfig{Auth: map[string]AuthConfig{
+		"https://registry.example.com":         registryAuth,
+		"https://registry.example.com/private": privateAuth,
+	}}
+
+	tests := []struct {
+		name      string
+		url       string
+		wantToken string
+	}{
+		{name: "registry root", url: "https://registry.example.com/package", wantToken: "registry-token"},
+		{name: "host is case insensitive", url: "https://REGISTRY.EXAMPLE.COM/package", wantToken: "registry-token"},
+		{name: "longest path match", url: "https://registry.example.com/private/package", wantToken: "private-token"},
+		{name: "exact path match", url: "https://registry.example.com/private", wantToken: "private-token"},
+		{name: "path segment boundary", url: "https://registry.example.com/private-other/package", wantToken: "registry-token"},
+		{name: "lookalike host rejected", url: "https://registry.example.com.evil.test/package"},
+		{name: "different scheme rejected", url: "http://registry.example.com/package"},
+		{name: "different port rejected", url: "https://registry.example.com:8443/package"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			auth := config.AuthForURL(tt.url)
+			if tt.wantToken == "" {
+				if auth != nil {
+					t.Fatalf("AuthForURL() = %+v, want nil", auth)
+				}
+				return
+			}
+			if auth == nil {
+				t.Fatal("AuthForURL() = nil, want authentication")
+			}
+			if auth.Token != tt.wantToken {
+				t.Errorf("token = %q, want %q", auth.Token, tt.wantToken)
+			}
+		})
+	}
+}
diff --git a/internal/httpclient/transport.go b/internal/httpclient/transport.go
new file mode 100644
index 0000000..1cdb457
--- /dev/null
+++ b/internal/httpclient/transport.go
@@ -0,0 +1,418 @@
+// Package httpclient provides authentication-aware HTTP transports for upstream requests.
+package httpclient
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	defaultTokenLifetime  = 60 * time.Second
+	tokenExpirySkew       = 5 * time.Second
+	maxTokenResponseSize  = 1 << 20
+	shortTokenSkewDivisor = 10
+)
+
+// AuthFunc returns a configured authentication header for a URL.
+type AuthFunc func(url string) (headerName, headerValue string)
+
+// Transport adds configured authentication and follows OCI Bearer challenges.
+type Transport struct {
+	base       http.RoundTripper
+	authForURL AuthFunc
+
+	mu         sync.Mutex
+	tokens     map[string]cachedToken
+	challenges map[string]bearerChallenge
+}
+
+type cachedToken struct {
+	value     string
+	expiresAt time.Time
+}
+
+type bearerChallenge struct {
+	realm   string
+	service string
+	scopes  []string
+}
+
+type tokenResponse struct {
+	Token       string `json:"token"`
+	AccessToken string `json:"access_token"`
+	ExpiresIn   int64  `json:"expires_in"`
+	IssuedAt    string `json:"issued_at"`
+}
+
+// NewTransport creates an authentication-aware transport around base.
+func NewTransport(base http.RoundTripper, authForURL AuthFunc) *Transport {
+	if base == nil {
+		base = http.DefaultTransport
+	}
+	return &Transport{
+		base:       base,
+		authForURL: authForURL,
+		tokens:     make(map[string]cachedToken),
+		challenges: make(map[string]bearerChallenge),
+	}
+}
+
+// RoundTrip implements http.RoundTripper.
+func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	outbound := cloneRequest(req)
+	t.applyAuthentication(outbound, req.Header.Get("Authorization") != "")
+
+	resp, err := t.base.RoundTrip(outbound)
+	if err != nil || resp.StatusCode != http.StatusUnauthorized {
+		return resp, err
+	}
+	if registryProtectionSpace(req.URL) == "" {
+		return resp, nil
+	}
+
+	challenge, ok := parseBearerChallenge(resp.Header.Values("WWW-Authenticate"))
+	if !ok || !canReplay(req) {
+		return resp, nil
+	}
+
+	drainAndClose(resp.Body)
+	token, err := t.token(req.Context(), challenge)
+	if err != nil {
+		return nil, fmt.Errorf("registry authentication: %w", err)
+	}
+	t.rememberChallenge(req.URL, challenge)
+
+	retry, err := cloneRequestForRetry(req)
+	if err != nil {
+		return nil, err
+	}
+	t.applyConfiguredAuthentication(retry)
+	retry.Header.Set("Authorization", "Bearer "+token)
+	return t.base.RoundTrip(retry)
+}
+
+func (t *Transport) applyAuthentication(req *http.Request, hasExplicitAuthorization bool) {
+	t.applyConfiguredAuthentication(req)
+	if hasExplicitAuthorization {
+		return
+	}
+	if token := t.cachedTokenForRequest(req.URL); token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+}
+
+func (t *Transport) applyConfiguredAuthentication(req *http.Request) {
+	if t.authForURL == nil {
+		return
+	}
+	name, value := t.authForURL(req.URL.String())
+	if name != "" && value != "" && req.Header.Get(name) == "" {
+		req.Header.Set(name, value)
+	}
+}
+
+func (t *Transport) token(ctx context.Context, challenge bearerChallenge) (string, error) {
+	key := challenge.key()
+	if token := t.cachedToken(key); token != "" {
+		return token, nil
+	}
+
+	token, expiresAt, err := t.fetchToken(ctx, challenge)
+	if err != nil {
+		return "", err
+	}
+
+	t.mu.Lock()
+	t.tokens[key] = cachedToken{value: token, expiresAt: expiresAt}
+	t.mu.Unlock()
+	return token, nil
+}
+
+func (t *Transport) fetchToken(ctx context.Context, challenge bearerChallenge) (string, time.Time, error) {
+	tokenURL, err := url.Parse(challenge.realm)
+	if err != nil || !tokenURL.IsAbs() || (tokenURL.Scheme != "https" && tokenURL.Scheme != "http") {
+		return "", time.Time{}, fmt.Errorf("invalid token realm %q", challenge.realm)
+	}
+
+	query := tokenURL.Query()
+	if challenge.service != "" {
+		query.Set("service", challenge.service)
+	}
+	for _, scope := range challenge.scopes {
+		query.Add("scope", scope)
+	}
+	query.Set("client_id", "git-pkgs-proxy")
+	tokenURL.RawQuery = query.Encode()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, tokenURL.String(), nil)
+	if err != nil {
+		return "", time.Time{}, err
+	}
+
+	client := &http.Client{Transport: configuredTransport{parent: t}}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("requesting token: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, maxTokenResponseSize))
+		return "", time.Time{}, fmt.Errorf("token service returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+
+	var payload tokenResponse
+	if err := json.NewDecoder(io.LimitReader(resp.Body, maxTokenResponseSize)).Decode(&payload); err != nil {
+		return "", time.Time{}, fmt.Errorf("decoding token response: %w", err)
+	}
+	token := payload.Token
+	if token == "" {
+		token = payload.AccessToken
+	}
+	if token == "" {
+		return "", time.Time{}, fmt.Errorf("token response did not contain a token")
+	}
+
+	issuedAt := time.Now()
+	if payload.IssuedAt != "" {
+		if parsed, parseErr := time.Parse(time.RFC3339, payload.IssuedAt); parseErr == nil {
+			issuedAt = parsed
+		}
+	}
+	lifetime := time.Duration(payload.ExpiresIn) * time.Second
+	if lifetime <= 0 {
+		lifetime = defaultTokenLifetime
+	}
+	expiresAt := issuedAt.Add(lifetime).Add(-expirySkew(lifetime))
+	return token, expiresAt, nil
+}
+
+type configuredTransport struct {
+	parent *Transport
+}
+
+func (t configuredTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	outbound := cloneRequest(req)
+	t.parent.applyConfiguredAuthentication(outbound)
+	return t.parent.base.RoundTrip(outbound)
+}
+
+func (t *Transport) cachedTokenForRequest(requestURL *url.URL) string {
+	space := registryProtectionSpace(requestURL)
+	if space == "" {
+		return ""
+	}
+
+	t.mu.Lock()
+	challenge, ok := t.challenges[space]
+	t.mu.Unlock()
+	if !ok {
+		return ""
+	}
+	return t.cachedToken(challenge.key())
+}
+
+func (t *Transport) cachedToken(key string) string {
+	now := time.Now()
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	token, ok := t.tokens[key]
+	if !ok {
+		return ""
+	}
+	if !now.Before(token.expiresAt) {
+		delete(t.tokens, key)
+		return ""
+	}
+	return token.value
+}
+
+func (t *Transport) rememberChallenge(requestURL *url.URL, challenge bearerChallenge) {
+	space := registryProtectionSpace(requestURL)
+	if space == "" {
+		return
+	}
+	t.mu.Lock()
+	t.challenges[space] = challenge
+	t.mu.Unlock()
+}
+
+func (c bearerChallenge) key() string {
+	return c.realm + "\x00" + c.service + "\x00" + strings.Join(c.scopes, "\x00")
+}
+
+func registryProtectionSpace(u *url.URL) string {
+	const registryPrefix = "/v2/"
+	if u == nil || !strings.HasPrefix(u.Path, registryPrefix) {
+		return ""
+	}
+	rest := strings.TrimPrefix(u.Path, registryPrefix)
+	end := len(rest)
+	for _, marker := range []string{"/blobs/", "/manifests/", "/tags/", "/referrers/"} {
+		if index := strings.Index(rest, marker); index >= 0 && index < end {
+			end = index
+		}
+	}
+	if end == len(rest) || end == 0 {
+		return ""
+	}
+	return u.Scheme + "://" + u.Host + registryPrefix + rest[:end]
+}
+
+func parseBearerChallenge(values []string) (bearerChallenge, bool) {
+	for _, value := range values {
+		params, ok := bearerParameters(value)
+		if !ok || params["realm"] == "" {
+			continue
+		}
+		challenge := bearerChallenge{
+			realm:   params["realm"],
+			service: params["service"],
+		}
+		if scope := params["scope"]; scope != "" {
+			challenge.scopes = append(challenge.scopes, scope)
+		}
+		return challenge, true
+	}
+	return bearerChallenge{}, false
+}
+
+func bearerParameters(value string) (map[string]string, bool) {
+	start := findAuthScheme(value, "Bearer")
+	if start < 0 {
+		return nil, false
+	}
+	rest := value[start+len("Bearer"):]
+	params := make(map[string]string)
+	for {
+		rest = strings.TrimLeft(rest, " \t,")
+		if rest == "" {
+			break
+		}
+
+		keyEnd := strings.IndexAny(rest, "= \t,")
+		if keyEnd <= 0 {
+			break
+		}
+		key := strings.ToLower(rest[:keyEnd])
+		rest = strings.TrimLeft(rest[keyEnd:], " \t")
+		if rest == "" || rest[0] != '=' {
+			break
+		}
+		rest = strings.TrimLeft(rest[1:], " \t")
+
+		parsed, remaining, ok := parseAuthValue(rest)
+		if !ok {
+			return nil, false
+		}
+		params[key] = parsed
+		rest = remaining
+	}
+	return params, true
+}
+
+func findAuthScheme(value, scheme string) int {
+	inQuote := false
+	escaped := false
+	for index := 0; index+len(scheme) <= len(value); index++ {
+		char := value[index]
+		if escaped {
+			escaped = false
+			continue
+		}
+		if char == '\\' && inQuote {
+			escaped = true
+			continue
+		}
+		if char == '"' {
+			inQuote = !inQuote
+			continue
+		}
+		if inQuote || !strings.EqualFold(value[index:index+len(scheme)], scheme) {
+			continue
+		}
+		beforeOK := index == 0 || value[index-1] == ',' || value[index-1] == ' ' || value[index-1] == '\t'
+		after := index + len(scheme)
+		afterOK := after < len(value) && (value[after] == ' ' || value[after] == '\t')
+		if beforeOK && afterOK {
+			return index
+		}
+	}
+	return -1
+}
+
+func parseAuthValue(value string) (parsed, remaining string, ok bool) {
+	if value == "" {
+		return "", "", false
+	}
+	if value[0] != '"' {
+		end := strings.IndexAny(value, " \t,")
+		if end < 0 {
+			return value, "", true
+		}
+		return value[:end], value[end:], end > 0
+	}
+
+	var builder strings.Builder
+	escaped := false
+	for index := 1; index < len(value); index++ {
+		char := value[index]
+		if escaped {
+			builder.WriteByte(char)
+			escaped = false
+			continue
+		}
+		if char == '\\' {
+			escaped = true
+			continue
+		}
+		if char == '"' {
+			return builder.String(), value[index+1:], true
+		}
+		builder.WriteByte(char)
+	}
+	return "", "", false
+}
+
+func cloneRequest(req *http.Request) *http.Request {
+	clone := req.Clone(req.Context())
+	clone.Header = req.Header.Clone()
+	return clone
+}
+
+func canReplay(req *http.Request) bool {
+	return req.Body == nil || req.GetBody != nil
+}
+
+func cloneRequestForRetry(req *http.Request) (*http.Request, error) {
+	clone := cloneRequest(req)
+	if req.Body == nil {
+		return clone, nil
+	}
+	body, err := req.GetBody()
+	if err != nil {
+		return nil, fmt.Errorf("replaying authenticated request: %w", err)
+	}
+	clone.Body = body
+	return clone, nil
+}
+
+func expirySkew(lifetime time.Duration) time.Duration {
+	if lifetime < tokenExpirySkew*2 {
+		return lifetime / shortTokenSkewDivisor
+	}
+	return tokenExpirySkew
+}
+
+func drainAndClose(body io.ReadCloser) {
+	_, _ = io.Copy(io.Discard, io.LimitReader(body, maxTokenResponseSize))
+	_ = body.Close()
+}
diff --git a/internal/httpclient/transport_test.go b/internal/httpclient/transport_test.go
new file mode 100644
index 0000000..027a378
--- /dev/null
+++ b/internal/httpclient/transport_test.go
@@ -0,0 +1,151 @@
+package httpclient
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestTransportFollowsBearerChallengeAndCachesToken(t *testing.T) {
+	var registryRequests int
+	var tokenRequests int
+	var server *httptest.Server
+
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/token":
+			tokenRequests++
+			if got := r.URL.Query().Get("service"); got != "registry.test" {
+				t.Errorf("service = %q, want %q", got, "registry.test")
+			}
+			if got := r.URL.Query().Get("scope"); got != "repository:library/test:pull" {
+				t.Errorf("scope = %q, want %q", got, "repository:library/test:pull")
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = io.WriteString(w, `{"token":"registry-token","expires_in":3600}`)
+		case "/v2/library/test/blobs/sha256:first", "/v2/library/test/blobs/sha256:second":
+			registryRequests++
+			if r.Header.Get("Authorization") != "Bearer registry-token" {
+				w.Header().Set("WWW-Authenticate", `Bearer realm="`+server.URL+`/token",service="registry.test",scope="repository:library/test:pull"`)
+				http.Error(w, "authentication required", http.StatusUnauthorized)
+				return
+			}
+			_, _ = io.WriteString(w, "blob")
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	client := &http.Client{Transport: NewTransport(http.DefaultTransport, nil)}
+	for _, digest := range []string{"sha256:first", "sha256:second"} {
+		resp, err := client.Get(server.URL + "/v2/library/test/blobs/" + digest)
+		if err != nil {
+			t.Fatalf("GET %s: %v", digest, err)
+		}
+		body, readErr := io.ReadAll(resp.Body)
+		_ = resp.Body.Close()
+		if readErr != nil {
+			t.Fatalf("read %s response: %v", digest, readErr)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("GET %s status = %d, want %d", digest, resp.StatusCode, http.StatusOK)
+		}
+		if string(body) != "blob" {
+			t.Errorf("GET %s body = %q, want %q", digest, body, "blob")
+		}
+	}
+
+	if tokenRequests != 1 {
+		t.Errorf("token requests = %d, want 1", tokenRequests)
+	}
+	if registryRequests != 3 {
+		t.Errorf("registry requests = %d, want 3", registryRequests)
+	}
+}
+
+func TestTransportAddsConfiguredAuthentication(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-Registry-Token"); got != "configured-token" {
+			t.Errorf("X-Registry-Token = %q, want %q", got, "configured-token")
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	authForURL := func(url string) (string, string) {
+		if strings.HasPrefix(url, server.URL) {
+			return "X-Registry-Token", "configured-token"
+		}
+		return "", ""
+	}
+	client := &http.Client{Transport: NewTransport(http.DefaultTransport, authForURL)}
+
+	resp, err := client.Get(server.URL + "/metadata")
+	if err != nil {
+		t.Fatalf("GET metadata: %v", err)
+	}
+	_ = resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Errorf("status = %d, want %d", resp.StatusCode, http.StatusNoContent)
+	}
+}
+
+func TestTransportPreservesExplicitAuthentication(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer explicit-token" {
+			t.Errorf("Authorization = %q, want %q", got, "Bearer explicit-token")
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	authForURL := func(string) (string, string) {
+		return "Authorization", "Bearer configured-token"
+	}
+	client := &http.Client{Transport: NewTransport(http.DefaultTransport, authForURL)}
+	req, err := http.NewRequest(http.MethodGet, server.URL+"/artifact", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Bearer explicit-token")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("GET artifact: %v", err)
+	}
+	_ = resp.Body.Close()
+	if resp.StatusCode != http.StatusNoContent {
+		t.Errorf("status = %d, want %d", resp.StatusCode, http.StatusNoContent)
+	}
+}
+
+func TestTransportDoesNotFollowBearerChallengeOutsideOCIRegistry(t *testing.T) {
+	tokenRequests := 0
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/token" {
+			tokenRequests++
+			_, _ = io.WriteString(w, `{"token":"unexpected"}`)
+			return
+		}
+		w.Header().Set("WWW-Authenticate", `Bearer realm="`+server.URL+`/token"`)
+		http.Error(w, "authentication required", http.StatusUnauthorized)
+	}))
+	defer server.Close()
+
+	client := &http.Client{Transport: NewTransport(http.DefaultTransport, nil)}
+	resp, err := client.Get(server.URL + "/api/packages")
+	if err != nil {
+		t.Fatalf("GET API: %v", err)
+	}
+	_ = resp.Body.Close()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("status = %d, want %d", resp.StatusCode, http.StatusUnauthorized)
+	}
+	if tokenRequests != 0 {
+		t.Errorf("token requests = %d, want 0", tokenRequests)
+	}
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index 5aac4db..b763278 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -58,17 +58,19 @@ import (
 	"strings"
 	"time"
 
+	"github.com/git-pkgs/cooldown"
 	swaggerdoc "github.com/git-pkgs/proxy/docs/swagger"
 	"github.com/git-pkgs/proxy/internal/config"
-	"github.com/git-pkgs/cooldown"
 	"github.com/git-pkgs/proxy/internal/database"
 	"github.com/git-pkgs/proxy/internal/enrichment"
 	"github.com/git-pkgs/proxy/internal/handler"
+	upstreamhttp "github.com/git-pkgs/proxy/internal/httpclient"
 	"github.com/git-pkgs/proxy/internal/metrics"
 	"github.com/git-pkgs/proxy/internal/mirror"
 	"github.com/git-pkgs/proxy/internal/storage"
 	"github.com/git-pkgs/purl"
 	"github.com/git-pkgs/registries/fetch"
+	"github.com/git-pkgs/registries/safehttp"
 	"github.com/git-pkgs/spdx"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
@@ -84,12 +86,12 @@ const (
 
 // Server is the main proxy server.
 type Server struct {
-	cfg       *config.Config
-	db        *database.DB
-	storage   storage.Storage
-	logger    *slog.Logger
-	http      *http.Server
-	templates *Templates
+	cfg         *config.Config
+	db          *database.DB
+	storage     storage.Storage
+	logger      *slog.Logger
+	http        *http.Server
+	templates   *Templates
 	cancel      context.CancelFunc
 	healthCache *healthCache
 }
@@ -156,8 +158,18 @@ func New(cfg *config.Config, logger *slog.Logger) (*Server, error) {
 
 // Start starts the HTTP server.
 func (s *Server) Start() error {
-	// Create shared components with circuit breaker
-	baseFetcher := fetch.NewFetcher(fetch.WithAuthFunc(s.authForURL))
+	// Use one authentication-aware transport for metadata and artifacts so
+	// configured credentials and cached OCI challenges apply consistently.
+	safeClient := safehttp.New(nil, safehttp.Options{})
+	authTransport := upstreamhttp.NewTransport(safeClient.Transport, upstreamhttp.AuthFunc(s.authForURL))
+	metadataClient := *safeClient
+	metadataClient.Timeout = s.cfg.ParseHTTPTimeout()
+	metadataClient.Transport = authTransport
+	artifactClient := metadataClient
+	artifactClient.Timeout = serverWriteTimeout
+
+	// Create shared components with circuit breaker.
+	baseFetcher := fetch.NewFetcher(fetch.WithHTTPClient(&artifactClient))
 	fetcher := fetch.NewCircuitBreakerFetcher(baseFetcher)
 	resolver := fetch.NewResolver()
 	cd := &cooldown.Config{
@@ -166,7 +178,7 @@ func (s *Server) Start() error {
 		Packages:   s.cfg.Cooldown.Packages,
 	}
 	proxy := handler.NewProxy(s.db, s.storage, fetcher, resolver, s.logger)
-	proxy.HTTPClient.Timeout = s.cfg.ParseHTTPTimeout()
+	proxy.HTTPClient = &metadataClient
 	proxy.Cooldown = cd
 	proxy.CacheMetadata = s.cfg.CacheMetadata
 	proxy.MetadataTTL = s.cfg.ParseMetadataTTL()

From be15a0f826333d8eba32f9a34b7fcaed67d150c0 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Mon, 13 Jul 2026 17:11:04 -0700
Subject: [PATCH 02/25] Fix cooldown overrides for scoped package PURLs

---
 config.example.yaml            |  3 ++-
 docs/configuration.md          |  2 ++
 internal/config/config.go      | 31 +++++++++++++++++++++++++++++++
 internal/config/config_test.go | 28 ++++++++++++++++++++++++++++
 internal/server/server.go      |  2 +-
 5 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/config.example.yaml b/config.example.yaml
index d1ed9a1..1176f5b 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -168,7 +168,8 @@ cooldown:
   #   npm: "7d"
   #   cargo: "0"
 
-  # Per-package overrides (keyed by PURL)
+  # Per-package overrides (keyed by PURL). Keys are normalized, so npm scopes
+  # may use either @scope or the canonical %40scope form.
   # packages:
   #   "pkg:npm/lodash": "0"
   #   "pkg:npm/@babel/core": "14d"
diff --git a/docs/configuration.md b/docs/configuration.md
index dcdec24..b103253 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -234,6 +234,8 @@ cooldown:
 
 Durations support days (`7d`), hours (`48h`), and minutes (`30m`). Set to `0` to disable.
 
+Package PURL keys are normalized automatically. For npm scopes, both the readable form (`pkg:npm/@babel/core`) and canonical form (`pkg:npm/%40babel/core`) are accepted. If both forms configure the same package, the canonical entry wins.
+
 Resolution order: package override, then ecosystem override, then global default. This lets you set a conservative default while exempting trusted packages.
 
 Currently supported for npm, PyPI, pub.dev, Composer, Cargo, NuGet, Conda, RubyGems, and Hex. These ecosystems include publish timestamps in their metadata.
diff --git a/internal/config/config.go b/internal/config/config.go
index 2d275c7..ec510d2 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -54,10 +54,12 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/git-pkgs/purl"
 	"gopkg.in/yaml.v3"
 )
 
@@ -137,9 +139,38 @@ type CooldownConfig struct {
 	Ecosystems map[string]string `json:"ecosystems" yaml:"ecosystems"`
 
 	// Packages overrides the cooldown for specific packages (keyed by PURL).
+	// Valid PURL keys are normalized to canonical form before use.
 	Packages map[string]string `json:"packages" yaml:"packages"`
 }
 
+// NormalizedPackages returns a copy of the package overrides with valid PURL
+// keys in canonical form. An explicitly canonical key wins over an equivalent
+// noncanonical key, and invalid keys are preserved unchanged.
+func (c *CooldownConfig) NormalizedPackages() map[string]string {
+	if c == nil || c.Packages == nil {
+		return nil
+	}
+
+	keys := make([]string, 0, len(c.Packages))
+	for key := range c.Packages {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	normalized := make(map[string]string, len(c.Packages))
+	for _, key := range keys {
+		canonical := key
+		if parsed, err := purl.Parse(key); err == nil {
+			canonical = parsed.String()
+		}
+		if _, exists := normalized[canonical]; exists && key != canonical {
+			continue
+		}
+		normalized[canonical] = c.Packages[key]
+	}
+	return normalized
+}
+
 // StorageConfig configures artifact storage.
 type StorageConfig struct {
 	// URL is the storage backend URL.
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 9c34023..decc18f 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -363,6 +363,34 @@ cooldown:
 	if cfg.Cooldown.Packages["pkg:npm/@babel/core"] != "14d" {
 		t.Errorf("Cooldown.Packages[@babel/core] = %q, want %q", cfg.Cooldown.Packages["pkg:npm/@babel/core"], "14d")
 	}
+	if got := cfg.Cooldown.NormalizedPackages()["pkg:npm/%40babel/core"]; got != "14d" {
+		t.Errorf("normalized Cooldown.Packages[@babel/core] = %q, want %q", got, "14d")
+	}
+}
+
+func TestCooldownConfigNormalizedPackages(t *testing.T) {
+	rawScoped := "pkg:npm/@typescript/typescript-darwin-arm64"
+	canonicalScoped := "pkg:npm/%40typescript/typescript-darwin-arm64"
+	cfg := CooldownConfig{Packages: map[string]string{
+		rawScoped:       "2d",
+		canonicalScoped: "3d",
+		"not-a-purl":    "4d",
+	}}
+
+	got := cfg.NormalizedPackages()
+
+	if got[canonicalScoped] != "3d" {
+		t.Errorf("canonical scoped package duration = %q, want %q", got[canonicalScoped], "3d")
+	}
+	if _, exists := got[rawScoped]; exists {
+		t.Errorf("raw scoped package key %q was not canonicalized", rawScoped)
+	}
+	if got["not-a-purl"] != "4d" {
+		t.Errorf("invalid PURL duration = %q, want preserved value %q", got["not-a-purl"], "4d")
+	}
+	if cfg.Packages[rawScoped] != "2d" {
+		t.Error("NormalizedPackages mutated the source map")
+	}
 }
 
 func TestLoadCooldownFromEnv(t *testing.T) {
diff --git a/internal/server/server.go b/internal/server/server.go
index 5aac4db..74c82c7 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -163,7 +163,7 @@ func (s *Server) Start() error {
 	cd := &cooldown.Config{
 		Default:    s.cfg.Cooldown.Default,
 		Ecosystems: s.cfg.Cooldown.Ecosystems,
-		Packages:   s.cfg.Cooldown.Packages,
+		Packages:   s.cfg.Cooldown.NormalizedPackages(),
 	}
 	proxy := handler.NewProxy(s.db, s.storage, fetcher, resolver, s.logger)
 	proxy.HTTPClient.Timeout = s.cfg.ParseHTTPTimeout()

From 2717f216a445be29d68b9b5a644eaa46ccdf03aa Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Mon, 13 Jul 2026 17:18:26 -0700
Subject: [PATCH 03/25] Address upstream authentication review findings

---
 internal/config/config.go             |  24 +++++--
 internal/config/config_test.go        |  29 ++++++++
 internal/httpclient/transport.go      |  23 ++++--
 internal/httpclient/transport_test.go | 100 ++++++++++++++++++++++++++
 4 files changed, 167 insertions(+), 9 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index a54d50c..cd43831 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -306,6 +306,16 @@ func (u *UpstreamConfig) AuthForURL(url string) *AuthConfig {
 	return bestMatch
 }
 
+// Validate checks upstream authentication URL scopes.
+func (u *UpstreamConfig) Validate() error {
+	for pattern := range u.Auth {
+		if _, err := parseAuthURL(pattern); err != nil {
+			return fmt.Errorf("invalid upstream.auth URL %q: %w", pattern, err)
+		}
+	}
+	return nil
+}
+
 func parseAuthURL(value string) (*url.URL, error) {
 	parsed, err := url.Parse(value)
 	if err != nil || !parsed.IsAbs() || parsed.Hostname() == "" || parsed.Opaque != "" {
@@ -625,15 +635,19 @@ func (c *Config) Validate() error {
 		return err
 	}
 
+	return c.validateComponents()
+}
+
+func (c *Config) validateComponents() error {
+	if err := c.Upstream.Validate(); err != nil {
+		return err
+	}
+
 	if err := c.Health.Validate(); err != nil {
 		return err
 	}
 
-	if err := c.Gradle.BuildCache.Validate(); err != nil {
-		return err
-	}
-
-	return nil
+	return c.Gradle.BuildCache.Validate()
 }
 
 // Validate checks the /health configuration. An unset interval is allowed
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 63520a2..e615f55 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -3,6 +3,7 @@ package config
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -802,3 +803,31 @@ func TestUpstreamAuthForURLMatchesURLComponents(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateUpstreamAuthURLs(t *testing.T) {
+	t.Run("valid absolute URL", func(t *testing.T) {
+		cfg := Default()
+		cfg.Upstream.Auth = map[string]AuthConfig{
+			"https://registry.example.com/private": {Type: "bearer", Token: "token"},
+		}
+
+		if err := cfg.Validate(); err != nil {
+			t.Fatalf("Validate() error = %v", err)
+		}
+	})
+
+	t.Run("invalid URL", func(t *testing.T) {
+		cfg := Default()
+		cfg.Upstream.Auth = map[string]AuthConfig{
+			"registry.example.com": {Type: "bearer", Token: "token"},
+		}
+
+		err := cfg.Validate()
+		if err == nil {
+			t.Fatal("Validate() error = nil, want invalid upstream.auth URL error")
+		}
+		if !strings.Contains(err.Error(), "upstream.auth") || !strings.Contains(err.Error(), "registry.example.com") {
+			t.Errorf("Validate() error = %q, want field and URL", err)
+		}
+	})
+}
diff --git a/internal/httpclient/transport.go b/internal/httpclient/transport.go
index 1cdb457..d96c827 100644
--- a/internal/httpclient/transport.go
+++ b/internal/httpclient/transport.go
@@ -66,13 +66,17 @@ func NewTransport(base http.RoundTripper, authForURL AuthFunc) *Transport {
 
 // RoundTrip implements http.RoundTripper.
 func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
+	hasExplicitAuthorization := req.Header.Get("Authorization") != ""
 	outbound := cloneRequest(req)
-	t.applyAuthentication(outbound, req.Header.Get("Authorization") != "")
+	t.applyAuthentication(outbound, hasExplicitAuthorization)
 
 	resp, err := t.base.RoundTrip(outbound)
 	if err != nil || resp.StatusCode != http.StatusUnauthorized {
 		return resp, err
 	}
+	if hasExplicitAuthorization {
+		return resp, nil
+	}
 	if registryProtectionSpace(req.URL) == "" {
 		return resp, nil
 	}
@@ -129,12 +133,23 @@ func (t *Transport) token(ctx context.Context, challenge bearerChallenge) (strin
 		return "", err
 	}
 
-	t.mu.Lock()
-	t.tokens[key] = cachedToken{value: token, expiresAt: expiresAt}
-	t.mu.Unlock()
+	t.cacheToken(key, cachedToken{value: token, expiresAt: expiresAt})
 	return token, nil
 }
 
+func (t *Transport) cacheToken(key string, token cachedToken) {
+	now := time.Now()
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	for cachedKey, cached := range t.tokens {
+		if !now.Before(cached.expiresAt) {
+			delete(t.tokens, cachedKey)
+		}
+	}
+	t.tokens[key] = token
+}
+
 func (t *Transport) fetchToken(ctx context.Context, challenge bearerChallenge) (string, time.Time, error) {
 	tokenURL, err := url.Parse(challenge.realm)
 	if err != nil || !tokenURL.IsAbs() || (tokenURL.Scheme != "https" && tokenURL.Scheme != "http") {
diff --git a/internal/httpclient/transport_test.go b/internal/httpclient/transport_test.go
index 027a378..bd1f266 100644
--- a/internal/httpclient/transport_test.go
+++ b/internal/httpclient/transport_test.go
@@ -1,11 +1,13 @@
 package httpclient
 
 import (
+	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestTransportFollowsBearerChallengeAndCachesToken(t *testing.T) {
@@ -122,6 +124,104 @@ func TestTransportPreservesExplicitAuthentication(t *testing.T) {
 	}
 }
 
+func TestTransportDoesNotReplaceExplicitAuthenticationAfterBearerChallenge(t *testing.T) {
+	var registryRequests int
+	var tokenRequests int
+	var server *httptest.Server
+
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/token":
+			tokenRequests++
+			_, _ = io.WriteString(w, `{"token":"registry-token"}`)
+		case "/v2/library/test/blobs/sha256:test":
+			registryRequests++
+			if got := r.Header.Get("Authorization"); got != "Bearer explicit-token" {
+				t.Errorf("Authorization = %q, want %q", got, "Bearer explicit-token")
+			}
+			w.Header().Set("WWW-Authenticate", `Bearer realm="`+server.URL+`/token"`)
+			http.Error(w, "authentication required", http.StatusUnauthorized)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+
+	client := &http.Client{Transport: NewTransport(http.DefaultTransport, nil)}
+	req, err := http.NewRequest(http.MethodGet, server.URL+"/v2/library/test/blobs/sha256:test", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Authorization", "Bearer explicit-token")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("GET blob: %v", err)
+	}
+	_ = resp.Body.Close()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Errorf("status = %d, want %d", resp.StatusCode, http.StatusUnauthorized)
+	}
+	if registryRequests != 1 {
+		t.Errorf("registry requests = %d, want 1", registryRequests)
+	}
+	if tokenRequests != 0 {
+		t.Errorf("token requests = %d, want 0", tokenRequests)
+	}
+}
+
+func TestTransportDoesNotForwardConfiguredAuthenticationOnTokenRedirect(t *testing.T) {
+	destination := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-Registry-Token"); got != "" {
+			t.Errorf("redirected X-Registry-Token = %q, want empty", got)
+		}
+		_, _ = io.WriteString(w, `{"token":"registry-token"}`)
+	}))
+	defer destination.Close()
+
+	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-Registry-Token"); got != "configured-token" {
+			t.Errorf("source X-Registry-Token = %q, want %q", got, "configured-token")
+		}
+		http.Redirect(w, r, destination.URL+"/token", http.StatusFound)
+	}))
+	defer source.Close()
+
+	authForURL := func(rawURL string) (string, string) {
+		if strings.HasPrefix(rawURL, source.URL) {
+			return "X-Registry-Token", "configured-token"
+		}
+		return "", ""
+	}
+	transport := NewTransport(http.DefaultTransport, authForURL)
+	token, _, err := transport.fetchToken(context.Background(), bearerChallenge{realm: source.URL + "/token"})
+	if err != nil {
+		t.Fatalf("fetchToken: %v", err)
+	}
+	if token != "registry-token" {
+		t.Errorf("token = %q, want %q", token, "registry-token")
+	}
+}
+
+func TestTransportPrunesExpiredTokens(t *testing.T) {
+	transport := NewTransport(http.DefaultTransport, nil)
+	transport.tokens["expired-unused"] = cachedToken{
+		value:     "expired-token",
+		expiresAt: time.Now().Add(-time.Minute),
+	}
+	transport.cacheToken("current", cachedToken{
+		value:     "current-token",
+		expiresAt: time.Now().Add(time.Minute),
+	})
+
+	if got := transport.cachedToken("current"); got != "current-token" {
+		t.Errorf("cachedToken(current) = %q, want %q", got, "current-token")
+	}
+	if _, ok := transport.tokens["expired-unused"]; ok {
+		t.Error("expired unused token was not pruned")
+	}
+}
+
 func TestTransportDoesNotFollowBearerChallengeOutsideOCIRegistry(t *testing.T) {
 	tokenRequests := 0
 	var server *httptest.Server

From cdf075695f00be2fc187068875b759e872218e63 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:14:00 +0000
Subject: [PATCH 04/25] Bump golang from 1.26.4-alpine to 1.26.5-alpine

Bumps golang from 1.26.4-alpine to 1.26.5-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.5-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 7b2795c..c2e197f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.4-alpine AS builder
+FROM golang:1.26.5-alpine AS builder
 
 WORKDIR /src
 

From ec3cc3579599246742c022bbec9157330eb30129 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:14:06 +0000
Subject: [PATCH 05/25] Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.0 to 5.3.1.
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index b063dba..bae89fb 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/git-pkgs/spdx v0.1.4
 	github.com/git-pkgs/vers v0.2.6
 	github.com/git-pkgs/vulns v0.1.6
-	github.com/go-chi/chi/v5 v5.3.0
+	github.com/go-chi/chi/v5 v5.3.1
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lib/pq v1.12.3
 	github.com/prometheus/client_golang v1.23.2
diff --git a/go.sum b/go.sum
index b1d35f6..e9d1e26 100644
--- a/go.sum
+++ b/go.sum
@@ -266,8 +266,8 @@ github.com/git-pkgs/vulns v0.1.6 h1:8RRSgdlxp4JMU0Zykr63XTOMo5CyZKwt/PwaQxrx9Yg=
 github.com/git-pkgs/vulns v0.1.6/go.mod h1:TsZC4MjoCkKJslgmbcmRCnytwnFcjESC2N8b0a2xDWc=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=
 github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0=
-github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
-github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
+github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=
 github.com/go-critic/go-critic v0.14.3/go.mod h1:xwntfW6SYAd7h1OqDzmN6hBX/JxsEKl5up/Y2bsxgVQ=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

From 96e113213de527dd9834e233dd77b71558030d38 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:14:12 +0000
Subject: [PATCH 06/25] Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14

Bumps [github.com/git-pkgs/purl](https://github.com/git-pkgs/purl) from 0.1.13 to 0.1.14.
- [Commits](https://github.com/git-pkgs/purl/compare/v0.1.13...v0.1.14)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/purl
  dependency-version: 0.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index b063dba..35079fb 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/git-pkgs/archives v0.3.0
 	github.com/git-pkgs/cooldown v0.1.1
 	github.com/git-pkgs/enrichment v0.4.1
-	github.com/git-pkgs/purl v0.1.13
+	github.com/git-pkgs/purl v0.1.14
 	github.com/git-pkgs/registries v0.6.2
 	github.com/git-pkgs/spdx v0.1.4
 	github.com/git-pkgs/vers v0.2.6
diff --git a/go.sum b/go.sum
index b1d35f6..f38a797 100644
--- a/go.sum
+++ b/go.sum
@@ -254,8 +254,8 @@ github.com/git-pkgs/packageurl-go v0.3.1 h1:WM3RBABQZLaRBxgKyYughc3cVBE8KyQxbSC6
 github.com/git-pkgs/packageurl-go v0.3.1/go.mod h1:rcIxiG37BlQLB6FZfgdj9Fm7yjhRQd3l+5o7J0QPAk4=
 github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY=
 github.com/git-pkgs/pom v0.1.5/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk=
-github.com/git-pkgs/purl v0.1.13 h1:at8BU6vnP5oonHFHAPA064BzgRqij+SZcOUDgNT2DC8=
-github.com/git-pkgs/purl v0.1.13/go.mod h1:8oCcdcYZA/e1B33e7Ylju6azboTKjdqf3ybcbQj6I/o=
+github.com/git-pkgs/purl v0.1.14 h1:GgqwiBNS0eKJqJ/gabUBEC10Xhpj6UX12kfNzujaeYc=
+github.com/git-pkgs/purl v0.1.14/go.mod h1:8oCcdcYZA/e1B33e7Ylju6azboTKjdqf3ybcbQj6I/o=
 github.com/git-pkgs/registries v0.6.2 h1:26G5zW6Q7x1CSfNkaEqEjRMJiA4JwfdKOCJ7Qm+u0a8=
 github.com/git-pkgs/registries v0.6.2/go.mod h1:GR0Bu6nC3NQe6f7lfDoEVqAnoQkMocf4M98B12a7B3E=
 github.com/git-pkgs/spdx v0.1.4 h1:eQ0waEV3uUeItpWAOvdN1K1rL9hTgsU7fF74r1mDXMs=

From df997e5825ee0e30ec38452be4da42260ec65e36 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:14:14 +0000
Subject: [PATCH 07/25] Bump docker/login-action from 4.3.0 to 4.4.0

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c99871dec2022cc055c062a10cc1a1310835ceb4...af1e73f918a031802d376d3c8bbc3fe56130a9b0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5f459b6..9c99e5d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Log in to the Container registry
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From 41ef27907e99ee9c214ece7731ea96f25708873d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:20:18 +0000
Subject: [PATCH 08/25] Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0

Bumps [github.com/git-pkgs/enrichment](https://github.com/git-pkgs/enrichment) from 0.4.1 to 0.6.0.
- [Commits](https://github.com/git-pkgs/enrichment/compare/v0.4.1...v0.6.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/enrichment
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod |  6 +++---
 go.sum | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/go.mod b/go.mod
index 0db3f6b..b84d213 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/CycloneDX/cyclonedx-go v0.11.0
 	github.com/git-pkgs/archives v0.3.0
 	github.com/git-pkgs/cooldown v0.1.1
-	github.com/git-pkgs/enrichment v0.4.1
+	github.com/git-pkgs/enrichment v0.6.0
 	github.com/git-pkgs/purl v0.1.14
 	github.com/git-pkgs/registries v0.6.2
 	github.com/git-pkgs/spdx v0.1.4
@@ -115,7 +115,7 @@ require (
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ecosyste-ms/ecosystems-go v0.2.0 // indirect
+	github.com/ecosyste-ms/ecosystems-go v0.3.0 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
 	github.com/fatih/color v1.18.0 // indirect
@@ -217,7 +217,7 @@ require (
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
 	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
-	github.com/oapi-codegen/runtime v1.4.1 // indirect
+	github.com/oapi-codegen/runtime v1.4.2 // indirect
 	github.com/package-url/packageurl-go v0.1.6 // indirect
 	github.com/pandatix/go-cvss v0.6.2 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
diff --git a/go.sum b/go.sum
index 9a93f6d..6da21d4 100644
--- a/go.sum
+++ b/go.sum
@@ -217,8 +217,8 @@ github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZ
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ecosyste-ms/ecosystems-go v0.2.0 h1:Nhpg54C+St8Sd/mf8bNJmQqx35ZgHw33TfFoxaXMQI8=
-github.com/ecosyste-ms/ecosystems-go v0.2.0/go.mod h1:CCdzT1iAZirbEZAbFSnWpK88eKKaIWex7gjtZ0UudXA=
+github.com/ecosyste-ms/ecosystems-go v0.3.0 h1:eVTNKQ3PyVNkSAnk1934958Vg4rR7ho5B5MWEQaMLi4=
+github.com/ecosyste-ms/ecosystems-go v0.3.0/go.mod h1:bkjiI8WoTFB1Jw0M3h8yn3KXCD/+LdETsQ3m2BNLMHQ=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
@@ -248,8 +248,8 @@ github.com/git-pkgs/archives v0.3.0 h1:iXKyO83jEFub1PGEDlHmk2tQ7XeV5LySTc0sEkH3x
 github.com/git-pkgs/archives v0.3.0/go.mod h1:LTJ1iQVFA7otizWMOyiI82NYVmyBWAPRzwu/e30rcXU=
 github.com/git-pkgs/cooldown v0.1.1 h1:9OqqzCB8gANz/y44SmqGD0Jp8Qtu81D1sCbKl6Ehg7w=
 github.com/git-pkgs/cooldown v0.1.1/go.mod h1:v7APuK/UouTiu8mWQZbdDmj7DfxxkGUeuhjaRB5gv9E=
-github.com/git-pkgs/enrichment v0.4.1 h1:A8BKs0XwvpF1sF5qviZy4fkJAe18qB9OgpbRnmwnT34=
-github.com/git-pkgs/enrichment v0.4.1/go.mod h1:stHqZUitV9ZkwACqHzBysLMSe6T4QZn81hxTdSroNhM=
+github.com/git-pkgs/enrichment v0.6.0 h1:npV6N+eFZnI64uw/B0s+WJPn6Fu6Be08bexAViZFjMg=
+github.com/git-pkgs/enrichment v0.6.0/go.mod h1:ov2WDaiNoIXViqdnE1FlUjNTnB5RnkUH4et9BWPhUDY=
 github.com/git-pkgs/packageurl-go v0.3.1 h1:WM3RBABQZLaRBxgKyYughc3cVBE8KyQxbSC6Jt5ak7M=
 github.com/git-pkgs/packageurl-go v0.3.1/go.mod h1:rcIxiG37BlQLB6FZfgdj9Fm7yjhRQd3l+5o7J0QPAk4=
 github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY=
@@ -512,8 +512,8 @@ github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr
 github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
 github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
 github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
-github.com/oapi-codegen/runtime v1.4.1 h1:9nwLoI+KrWxzbBcp0jO/R8uXqbik/HUyCvPeU68Y/qo=
-github.com/oapi-codegen/runtime v1.4.1/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
+github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
 github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

From cdbd1a93697b1b97a50d68c7d67c89063be86ef0 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Fri, 17 Jul 2026 18:11:47 -0700
Subject: [PATCH 09/25] Canonicalize cooldown lookup PURLs to match config

NormalizedPackages runs config keys through purl.Parse().String(), which
applies per-type rules like lowercasing pypi names. The handler side was
building lookup keys with MakePURLString, which does not, so a config
entry for pkg:pypi/Django would be normalized to pkg:pypi/django and
never match the runtime key pkg:pypi/Django.

Route both sides through the same canonical form: a new
canonicalPackagePURL helper calls Normalize() on the constructed PURL
before stringifying, and all cooldown IsAllowed call sites use it.
---
 docs/configuration.md            |  2 +-
 internal/handler/cargo.go        |  4 +---
 internal/handler/composer.go     |  4 +---
 internal/handler/conda.go        |  4 +---
 internal/handler/gem.go          |  4 +---
 internal/handler/handler.go      |  8 ++++++++
 internal/handler/handler_test.go | 31 +++++++++++++++++++++++++++++++
 internal/handler/hex.go          |  3 +--
 internal/handler/npm.go          |  4 +---
 internal/handler/nuget.go        |  4 +---
 internal/handler/pub.go          |  4 +---
 internal/handler/pypi.go         |  6 ++----
 12 files changed, 50 insertions(+), 28 deletions(-)

diff --git a/docs/configuration.md b/docs/configuration.md
index b103253..8998ac2 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -234,7 +234,7 @@ cooldown:
 
 Durations support days (`7d`), hours (`48h`), and minutes (`30m`). Set to `0` to disable.
 
-Package PURL keys are normalized automatically. For npm scopes, both the readable form (`pkg:npm/@babel/core`) and canonical form (`pkg:npm/%40babel/core`) are accepted. If both forms configure the same package, the canonical entry wins.
+Package PURL keys are normalized to canonical form before matching, so `pkg:npm/@babel/core` and `pkg:npm/%40babel/core` are equivalent, as are `pkg:pypi/Django` and `pkg:pypi/django`. If both forms configure the same package, the canonical entry wins.
 
 Resolution order: package override, then ecosystem override, then global default. This lets you set a conservative default while exempting trusted packages.
 
diff --git a/internal/handler/cargo.go b/internal/handler/cargo.go
index 5d7810c..bf424e2 100644
--- a/internal/handler/cargo.go
+++ b/internal/handler/cargo.go
@@ -8,8 +8,6 @@ import (
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -143,7 +141,7 @@ func (h *CargoHandler) applyCooldownFiltering(downstreamResponse http.ResponseWr
 			continue
 		}
 
-		cratePURL := purl.MakePURLString("cargo", crate.Name, "")
+		cratePURL := canonicalPackagePURL("cargo", crate.Name)
 
 		if !h.proxy.Cooldown.IsAllowed("cargo", cratePURL, publishedAt) {
 			h.proxy.Logger.Info("cooldown: filtering cargo version",
diff --git a/internal/handler/composer.go b/internal/handler/composer.go
index bc3bc1d..23deba5 100644
--- a/internal/handler/composer.go
+++ b/internal/handler/composer.go
@@ -10,8 +10,6 @@ import (
 	"path"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -216,7 +214,7 @@ func deepCopyValue(v any) any {
 // filterAndRewriteVersions applies cooldown filtering and rewrites dist URLs
 // for a single package's version list.
 func (h *ComposerHandler) filterAndRewriteVersions(packageName string, versionList []any) []any {
-	packagePURL := purl.MakePURLString("composer", packageName, "")
+	packagePURL := canonicalPackagePURL("composer", packageName)
 
 	filtered := versionList[:0]
 	for _, v := range versionList {
diff --git a/internal/handler/conda.go b/internal/handler/conda.go
index cfa20c8..a8632e8 100644
--- a/internal/handler/conda.go
+++ b/internal/handler/conda.go
@@ -6,8 +6,6 @@ import (
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -218,7 +216,7 @@ func (h *CondaHandler) applyCooldownFiltering(body []byte) ([]byte, error) {
 				continue
 			}
 
-			packagePURL := purl.MakePURLString("conda", name, "")
+			packagePURL := canonicalPackagePURL("conda", name)
 
 			if !h.proxy.Cooldown.IsAllowed("conda", packagePURL, publishedAt) {
 				version, _ := entryMap["version"].(string)
diff --git a/internal/handler/gem.go b/internal/handler/gem.go
index 9ec57e3..a3714d6 100644
--- a/internal/handler/gem.go
+++ b/internal/handler/gem.go
@@ -8,8 +8,6 @@ import (
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -266,7 +264,7 @@ func (h *GemHandler) fetchFilteredVersions(r *http.Request, name string) (map[st
 		return nil, err
 	}
 
-	packagePURL := purl.MakePURLString("gem", name, "")
+	packagePURL := canonicalPackagePURL("gem", name)
 	filtered := make(map[string]bool)
 
 	for _, v := range versions {
diff --git a/internal/handler/handler.go b/internal/handler/handler.go
index d06ca83..202426d 100644
--- a/internal/handler/handler.go
+++ b/internal/handler/handler.go
@@ -48,6 +48,14 @@ func hasDotDotSegment(path string) bool {
 
 const defaultHTTPTimeout = 30 * time.Second
 
+// canonicalPackagePURL returns a versionless PURL in canonical form so cooldown
+// lookups match keys produced by config.CooldownConfig.NormalizedPackages.
+func canonicalPackagePURL(ecosystem, name string) string {
+	p := purl.MakePURL(ecosystem, name, "")
+	_ = p.Normalize()
+	return p.String()
+}
+
 const contentTypeJSON = "application/json"
 
 const headerAcceptEncoding = "Accept-Encoding"
diff --git a/internal/handler/handler_test.go b/internal/handler/handler_test.go
index bbcab72..9a2b329 100644
--- a/internal/handler/handler_test.go
+++ b/internal/handler/handler_test.go
@@ -14,6 +14,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/git-pkgs/proxy/internal/config"
 	"github.com/git-pkgs/proxy/internal/database"
 	"github.com/git-pkgs/proxy/internal/storage"
 	"github.com/git-pkgs/registries/fetch"
@@ -1010,3 +1011,33 @@ func TestProxyCached_FreshResponse_NoWarningHeader(t *testing.T) {
 		t.Errorf("Warning should be empty for fresh response, got %q", got)
 	}
 }
+
+// TestCanonicalPackagePURLMatchesConfig ensures the runtime cooldown lookup key
+// agrees with config.CooldownConfig.NormalizedPackages for the same package,
+// so a configured override is actually found regardless of how the user wrote it.
+func TestCanonicalPackagePURLMatchesConfig(t *testing.T) {
+	tests := []struct {
+		ecosystem   string
+		requestName string
+		configKey   string
+	}{
+		{"npm", "@babel/core", "pkg:npm/@babel/core"},
+		{"npm", "@babel/core", "pkg:npm/%40babel/core"},
+		{"npm", "@typescript/typescript-darwin-arm64", "pkg:npm/@typescript/typescript-darwin-arm64"},
+		{"pypi", "Django", "pkg:pypi/Django"},
+		{"pypi", "django", "pkg:pypi/Django"},
+		{"composer", "symfony/console", "pkg:composer/Symfony/Console"},
+		{"cargo", "serde", "pkg:cargo/serde"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.ecosystem+"/"+tt.requestName+"<="+tt.configKey, func(t *testing.T) {
+			cfg := config.CooldownConfig{Packages: map[string]string{tt.configKey: "1d"}}
+			normalized := cfg.NormalizedPackages()
+
+			lookup := canonicalPackagePURL(tt.ecosystem, tt.requestName)
+			if _, ok := normalized[lookup]; !ok {
+				t.Errorf("lookup key %q not found in normalized config %v", lookup, normalized)
+			}
+		})
+	}
+}
diff --git a/internal/handler/hex.go b/internal/handler/hex.go
index 0f0c72e..6ebc176 100644
--- a/internal/handler/hex.go
+++ b/internal/handler/hex.go
@@ -10,7 +10,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/git-pkgs/purl"
 	"google.golang.org/protobuf/encoding/protowire"
 )
 
@@ -237,7 +236,7 @@ func (h *HexHandler) fetchFilteredVersions(r *http.Request, name string) (map[st
 		return nil, err
 	}
 
-	packagePURL := purl.MakePURLString("hex", name, "")
+	packagePURL := canonicalPackagePURL("hex", name)
 	filtered := make(map[string]bool)
 
 	for _, release := range pkg.Releases {
diff --git a/internal/handler/npm.go b/internal/handler/npm.go
index 0585eda..06f539e 100644
--- a/internal/handler/npm.go
+++ b/internal/handler/npm.go
@@ -9,8 +9,6 @@ import (
 	"sort"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -134,7 +132,7 @@ func (h *NPMHandler) applyCooldownFiltering(metadata map[string]any, versions ma
 		return
 	}
 
-	packagePURL := purl.MakePURLString("npm", packageName, "")
+	packagePURL := canonicalPackagePURL("npm", packageName)
 
 	for version := range versions {
 		publishedStr, ok := timeMap[version].(string)
diff --git a/internal/handler/nuget.go b/internal/handler/nuget.go
index 40b8b5f..3e6373a 100644
--- a/internal/handler/nuget.go
+++ b/internal/handler/nuget.go
@@ -8,8 +8,6 @@ import (
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -271,7 +269,7 @@ func (h *NuGetHandler) applyCooldownFiltering(body []byte) ([]byte, error) {
 				}
 			}
 
-			packagePURL := purl.MakePURLString("nuget", strings.ToLower(id), "")
+			packagePURL := canonicalPackagePURL("nuget", strings.ToLower(id))
 
 			if !h.proxy.Cooldown.IsAllowed("nuget", packagePURL, publishedAt) {
 				h.proxy.Logger.Info("cooldown: filtering nuget version",
diff --git a/internal/handler/pub.go b/internal/handler/pub.go
index 60bbbad..2971ddf 100644
--- a/internal/handler/pub.go
+++ b/internal/handler/pub.go
@@ -7,8 +7,6 @@ import (
 	"net/http"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -127,7 +125,7 @@ func (h *PubHandler) rewriteMetadata(name string, body []byte) ([]byte, error) {
 		return body, nil
 	}
 
-	packagePURL := purl.MakePURLString("pub", name, "")
+	packagePURL := canonicalPackagePURL("pub", name)
 	filtered := h.filterAndRewriteVersions(name, packagePURL, versions)
 	metadata["versions"] = filtered
 
diff --git a/internal/handler/pypi.go b/internal/handler/pypi.go
index 3021d2b..0cf39fb 100644
--- a/internal/handler/pypi.go
+++ b/internal/handler/pypi.go
@@ -12,8 +12,6 @@ import (
 	"regexp"
 	"strings"
 	"time"
-
-	"github.com/git-pkgs/purl"
 )
 
 const (
@@ -131,7 +129,7 @@ func (h *PyPIHandler) fetchFilteredVersions(r *http.Request, name string) map[st
 		return nil
 	}
 
-	packagePURL := purl.MakePURLString("pypi", name, "")
+	packagePURL := canonicalPackagePURL("pypi", name)
 	filtered := make(map[string]bool)
 
 	for version, files := range releases {
@@ -262,7 +260,7 @@ func (h *PyPIHandler) rewriteJSONMetadata(body []byte) ([]byte, error) {
 	packageName, _ := extractPyPIName(metadata)
 	packagePURL := ""
 	if packageName != "" {
-		packagePURL = purl.MakePURLString("pypi", packageName, "")
+		packagePURL = canonicalPackagePURL("pypi", packageName)
 	}
 
 	h.filterAndRewriteReleases(metadata, packageName, packagePURL)

From 60c72be65e6f0d45593dbecdeba2f1e3ded533fb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 15:13:49 +0000
Subject: [PATCH 10/25] Bump actions/setup-go from 6.5.0 to 7.0.0

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/release.yml | 2 +-
 .github/workflows/swagger.yml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 700f28e..c405f5d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.25'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4d4d0b5..f06cecd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: false
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index f947c7e..e99aecf 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -17,7 +17,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.25'
 

From d9b7a30294582b3a3c8939457805a4a2c8d3c688 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 15:13:53 +0000
Subject: [PATCH 11/25] Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0

Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.7 to 0.6.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/192e21d79ab29983730a13d1382995c2307fbcaa...6599ee8b7a49aef6a770f63d261d214911a7ce02)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index cce6e4f..df06c5f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -26,4 +26,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0

From c3f1577017e76dadf040d7ab225869052513bc29 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 15:14:01 +0000
Subject: [PATCH 12/25] Bump modernc.org/sqlite from 1.53.0 to 1.54.0

Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.53.0 to 1.54.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.54.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod |  8 ++++----
 go.sum | 28 ++++++++++++++--------------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/go.mod b/go.mod
index b84d213..384fba3 100644
--- a/go.mod
+++ b/go.mod
@@ -24,7 +24,7 @@ require (
 	golang.org/x/sync v0.22.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.53.0
+	modernc.org/sqlite v1.54.0
 )
 
 require (
@@ -294,12 +294,12 @@ require (
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
 	golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
-	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.272.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
@@ -307,7 +307,7 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	honnef.co/go/tools v0.7.0 // indirect
-	modernc.org/libc v1.73.4 // indirect
+	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	mvdan.cc/gofumpt v0.9.2 // indirect
diff --git a/go.sum b/go.sum
index 6da21d4..301a00d 100644
--- a/go.sum
+++ b/go.sum
@@ -755,8 +755,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -839,8 +839,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
 golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
@@ -882,20 +882,20 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.7.0 h1:w6WUp1VbkqPEgLz4rkBzH/CSU6HkoqNLp6GstyTx3lU=
 honnef.co/go/tools v0.7.0/go.mod h1:pm29oPxeP3P82ISxZDgIYeOaf9ta6Pi0EWvCFoLG2vc=
-modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c=
-modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws=
-modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE=
+modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
+modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
+modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
-modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA=
-modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
+modernc.org/libc v1.74.1 h1:bdR4VTKFMC4966QSNZ05XLGI/VwzVa2kTUX51Dm0riQ=
+modernc.org/libc v1.74.1/go.mod h1:uH4t5bOx3G3g9Xcmj10YKlTcVISlRDwv8VoQJG9n8Os=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -904,8 +904,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
-modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
+modernc.org/sqlite v1.54.0 h1:JCxR4qwkJvOaqAoYcgDoO25Nc+ROg6EJ2LfBVzdrgog=
+modernc.org/sqlite v1.54.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

From 5ae5eab0311d4f3cfab5ec5465523bcd402fbd1c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 15:14:10 +0000
Subject: [PATCH 13/25] Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0

Bumps [github.com/git-pkgs/vulns](https://github.com/git-pkgs/vulns) from 0.1.6 to 0.2.0.
- [Commits](https://github.com/git-pkgs/vulns/compare/v0.1.6...v0.2.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vulns
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index b84d213..7b7701d 100644
--- a/go.mod
+++ b/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/git-pkgs/registries v0.6.2
 	github.com/git-pkgs/spdx v0.1.4
 	github.com/git-pkgs/vers v0.2.6
-	github.com/git-pkgs/vulns v0.1.6
+	github.com/git-pkgs/vulns v0.2.0
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lib/pq v1.12.3
diff --git a/go.sum b/go.sum
index 6da21d4..4427b92 100644
--- a/go.sum
+++ b/go.sum
@@ -262,8 +262,8 @@ github.com/git-pkgs/spdx v0.1.4 h1:eQ0waEV3uUeItpWAOvdN1K1rL9hTgsU7fF74r1mDXMs=
 github.com/git-pkgs/spdx v0.1.4/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
 github.com/git-pkgs/vers v0.2.6 h1:IelZd7BP/JhzTloUTDY67nehUgoYva3g9viqAMCHJg8=
 github.com/git-pkgs/vers v0.2.6/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
-github.com/git-pkgs/vulns v0.1.6 h1:8RRSgdlxp4JMU0Zykr63XTOMo5CyZKwt/PwaQxrx9Yg=
-github.com/git-pkgs/vulns v0.1.6/go.mod h1:TsZC4MjoCkKJslgmbcmRCnytwnFcjESC2N8b0a2xDWc=
+github.com/git-pkgs/vulns v0.2.0 h1:S1sA0ObQ/IKW0vqK+lK+HAY37AdDHEfhaIja/fLptwg=
+github.com/git-pkgs/vulns v0.2.0/go.mod h1:mjVquLlunsAFPltqjf6mbvbI4tQ1iIa1NuhKIOPKt/4=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=
 github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0=
 github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=

From 13ae3970e9b09b14cb9fbf90a136ae081db4222e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 15:42:03 +0000
Subject: [PATCH 14/25] Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0

Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers) from 0.2.6 to 0.3.0.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.2.6...v0.3.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 7b7701d..563b518 100644
--- a/go.mod
+++ b/go.mod
@@ -11,7 +11,7 @@ require (
 	github.com/git-pkgs/purl v0.1.14
 	github.com/git-pkgs/registries v0.6.2
 	github.com/git-pkgs/spdx v0.1.4
-	github.com/git-pkgs/vers v0.2.6
+	github.com/git-pkgs/vers v0.3.0
 	github.com/git-pkgs/vulns v0.2.0
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/jmoiron/sqlx v1.4.0
diff --git a/go.sum b/go.sum
index 4427b92..ec10b3c 100644
--- a/go.sum
+++ b/go.sum
@@ -260,8 +260,8 @@ github.com/git-pkgs/registries v0.6.2 h1:26G5zW6Q7x1CSfNkaEqEjRMJiA4JwfdKOCJ7Qm+
 github.com/git-pkgs/registries v0.6.2/go.mod h1:GR0Bu6nC3NQe6f7lfDoEVqAnoQkMocf4M98B12a7B3E=
 github.com/git-pkgs/spdx v0.1.4 h1:eQ0waEV3uUeItpWAOvdN1K1rL9hTgsU7fF74r1mDXMs=
 github.com/git-pkgs/spdx v0.1.4/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
-github.com/git-pkgs/vers v0.2.6 h1:IelZd7BP/JhzTloUTDY67nehUgoYva3g9viqAMCHJg8=
-github.com/git-pkgs/vers v0.2.6/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
+github.com/git-pkgs/vers v0.3.0 h1:xM4LLUCRmqzdDfe+/pVQUx4SRyFXRVth6tOsJ14wMKU=
+github.com/git-pkgs/vers v0.3.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
 github.com/git-pkgs/vulns v0.2.0 h1:S1sA0ObQ/IKW0vqK+lK+HAY37AdDHEfhaIja/fLptwg=
 github.com/git-pkgs/vulns v0.2.0/go.mod h1:mjVquLlunsAFPltqjf6mbvbI4tQ1iIa1NuhKIOPKt/4=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=

From 532e4925fef3c7cbbd8d6d276e8444971d23c98b Mon Sep 17 00:00:00 2001
From: Tilian Honig <Tilian@wave.sx>
Date: Sun, 26 Jul 2026 20:07:46 +0200
Subject: [PATCH 15/25] fix: proper handling of upstream registry 404s (#209)

* fix: proper handling of upstream registry 404s

* fix: consistently return 404s for all artifact types
---
 go.mod                                       |   2 +-
 go.sum                                       |   4 +-
 internal/handler/cargo.go                    |   3 +-
 internal/handler/composer.go                 |   3 +-
 internal/handler/conan.go                    |   6 +-
 internal/handler/conda.go                    |   3 +-
 internal/handler/container.go                |   7 +-
 internal/handler/cran.go                     |   6 +-
 internal/handler/debian.go                   |   3 +-
 internal/handler/filename_download.go        |  39 +++++
 internal/handler/gem.go                      |  31 +---
 internal/handler/handler.go                  |  22 ++-
 internal/handler/hex.go                      |  31 +---
 internal/handler/julia.go                    |   9 +-
 internal/handler/maven.go                    |   7 +-
 internal/handler/notfound_ecosystems_test.go | 151 +++++++++++++++++++
 internal/handler/notfound_test.go            |  83 ++++++++++
 internal/handler/npm.go                      |   4 +
 internal/handler/nuget.go                    |   3 +-
 internal/handler/pub.go                      |   3 +-
 internal/handler/pypi.go                     |   3 +-
 internal/handler/rpm.go                      |   3 +-
 22 files changed, 337 insertions(+), 89 deletions(-)
 create mode 100644 internal/handler/filename_download.go
 create mode 100644 internal/handler/notfound_ecosystems_test.go
 create mode 100644 internal/handler/notfound_test.go

diff --git a/go.mod b/go.mod
index 1f2c073..6d81076 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/git-pkgs/cooldown v0.1.1
 	github.com/git-pkgs/enrichment v0.6.0
 	github.com/git-pkgs/purl v0.1.14
-	github.com/git-pkgs/registries v0.6.2
+	github.com/git-pkgs/registries v0.6.3
 	github.com/git-pkgs/spdx v0.1.4
 	github.com/git-pkgs/vers v0.3.0
 	github.com/git-pkgs/vulns v0.2.0
diff --git a/go.sum b/go.sum
index 17b0651..5d16d31 100644
--- a/go.sum
+++ b/go.sum
@@ -256,8 +256,8 @@ github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY=
 github.com/git-pkgs/pom v0.1.5/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk=
 github.com/git-pkgs/purl v0.1.14 h1:GgqwiBNS0eKJqJ/gabUBEC10Xhpj6UX12kfNzujaeYc=
 github.com/git-pkgs/purl v0.1.14/go.mod h1:8oCcdcYZA/e1B33e7Ylju6azboTKjdqf3ybcbQj6I/o=
-github.com/git-pkgs/registries v0.6.2 h1:26G5zW6Q7x1CSfNkaEqEjRMJiA4JwfdKOCJ7Qm+u0a8=
-github.com/git-pkgs/registries v0.6.2/go.mod h1:GR0Bu6nC3NQe6f7lfDoEVqAnoQkMocf4M98B12a7B3E=
+github.com/git-pkgs/registries v0.6.3 h1:7sveeeMS2lgXtcqNYAA3bwaT7H9CQs0uhy6wQSxz3Js=
+github.com/git-pkgs/registries v0.6.3/go.mod h1:j4o50ii/vD9Z42/nFeQASt15BPolADIejeFmmqK4njo=
 github.com/git-pkgs/spdx v0.1.4 h1:eQ0waEV3uUeItpWAOvdN1K1rL9hTgsU7fF74r1mDXMs=
 github.com/git-pkgs/spdx v0.1.4/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
 github.com/git-pkgs/vers v0.3.0 h1:xM4LLUCRmqzdDfe+/pVQUx4SRyFXRVth6tOsJ14wMKU=
diff --git a/internal/handler/cargo.go b/internal/handler/cargo.go
index bf424e2..abc0d1f 100644
--- a/internal/handler/cargo.go
+++ b/internal/handler/cargo.go
@@ -191,8 +191,7 @@ func (h *CargoHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 
 	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "cargo", name, version, filename)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch crate", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch crate")
 		return
 	}
 
diff --git a/internal/handler/composer.go b/internal/handler/composer.go
index 23deba5..45935b7 100644
--- a/internal/handler/composer.go
+++ b/internal/handler/composer.go
@@ -346,8 +346,7 @@ func (h *ComposerHandler) handleDownload(w http.ResponseWriter, r *http.Request)
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "composer", packageName, version, filename, downloadURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/conan.go b/internal/handler/conan.go
index 53f6428..c0476f9 100644
--- a/internal/handler/conan.go
+++ b/internal/handler/conan.go
@@ -84,8 +84,7 @@ func (h *ConanHandler) handleRecipeFile(w http.ResponseWriter, r *http.Request)
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "conan", packageName, storageVersion, storageFilename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch file", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch file")
 		return
 	}
 
@@ -122,8 +121,7 @@ func (h *ConanHandler) handlePackageFile(w http.ResponseWriter, r *http.Request)
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "conan", packageName, storageVersion, storageFilename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch file", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch file")
 		return
 	}
 
diff --git a/internal/handler/conda.go b/internal/handler/conda.go
index a8632e8..224c25f 100644
--- a/internal/handler/conda.go
+++ b/internal/handler/conda.go
@@ -72,8 +72,7 @@ func (h *CondaHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "conda", packageName, version, filename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/container.go b/internal/handler/container.go
index 8ba5e97..0710ed1 100644
--- a/internal/handler/container.go
+++ b/internal/handler/container.go
@@ -2,6 +2,7 @@ package handler
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -117,8 +118,12 @@ func (h *ContainerHandler) handleBlobDownload(w http.ResponseWriter, r *http.Req
 	)
 
 	if err != nil {
+		if errors.Is(err, ErrUpstreamNotFound) {
+			h.containerError(w, http.StatusNotFound, "BLOB_UNKNOWN", "blob unknown to registry")
+			return
+		}
 		h.proxy.Logger.Error("failed to fetch blob", "error", err)
-		h.containerError(w, http.StatusBadGateway, "BLOB_UNKNOWN", "failed to fetch blob")
+		h.containerError(w, http.StatusBadGateway, "INTERNAL_ERROR", "failed to fetch blob")
 		return
 	}
 
diff --git a/internal/handler/cran.go b/internal/handler/cran.go
index 0ecd2a3..2fc4fab 100644
--- a/internal/handler/cran.go
+++ b/internal/handler/cran.go
@@ -72,8 +72,7 @@ func (h *CRANHandler) handleSourceDownload(w http.ResponseWriter, r *http.Reques
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "cran", name, version, filename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
@@ -107,8 +106,7 @@ func (h *CRANHandler) handleBinaryDownload(w http.ResponseWriter, r *http.Reques
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "cran", name, storageVersion, filename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/debian.go b/internal/handler/debian.go
index b767f6d..9a4aaab 100644
--- a/internal/handler/debian.go
+++ b/internal/handler/debian.go
@@ -81,8 +81,7 @@ func (h *DebianHandler) handlePackageDownload(w http.ResponseWriter, r *http.Req
 	result, err := h.proxy.GetOrFetchArtifactFromURL(
 		r.Context(), "deb", name, version, filename, downloadURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get debian package", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/filename_download.go b/internal/handler/filename_download.go
new file mode 100644
index 0000000..bedec16
--- /dev/null
+++ b/internal/handler/filename_download.go
@@ -0,0 +1,39 @@
+package handler
+
+import (
+	"net/http"
+	"strings"
+)
+
+type filenameDownload struct {
+	ecosystem string
+	suffix    string
+	parseErr  string
+	fetchErr  string
+	parse     func(string) (name, version string)
+}
+
+func (p *Proxy) handleFilenameDownload(w http.ResponseWriter, r *http.Request, d filenameDownload) {
+	filename := r.PathValue("filename")
+	if filename == "" || !strings.HasSuffix(filename, d.suffix) {
+		http.Error(w, "invalid filename", http.StatusBadRequest)
+		return
+	}
+
+	name, version := d.parse(filename)
+	if name == "" || version == "" {
+		http.Error(w, d.parseErr, http.StatusBadRequest)
+		return
+	}
+
+	p.Logger.Info(d.ecosystem+" download request",
+		"name", name, "version", version, "filename", filename)
+
+	result, err := p.GetOrFetchArtifact(r.Context(), d.ecosystem, name, version, filename)
+	if err != nil {
+		p.serveArtifactError(w, err, d.fetchErr)
+		return
+	}
+
+	ServeArtifact(w, result)
+}
diff --git a/internal/handler/gem.go b/internal/handler/gem.go
index a3714d6..260568a 100644
--- a/internal/handler/gem.go
+++ b/internal/handler/gem.go
@@ -58,30 +58,13 @@ func (h *GemHandler) Routes() http.Handler {
 
 // handleDownload serves a gem file, fetching and caching from upstream if needed.
 func (h *GemHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
-	filename := r.PathValue("filename")
-	if filename == "" || !strings.HasSuffix(filename, ".gem") {
-		http.Error(w, "invalid filename", http.StatusBadRequest)
-		return
-	}
-
-	// Extract name and version from filename (e.g., "rails-7.1.0.gem")
-	name, version := h.parseGemFilename(filename)
-	if name == "" || version == "" {
-		http.Error(w, "could not parse gem filename", http.StatusBadRequest)
-		return
-	}
-
-	h.proxy.Logger.Info("gem download request",
-		"name", name, "version", version, "filename", filename)
-
-	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "gem", name, version, filename)
-	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch gem", http.StatusBadGateway)
-		return
-	}
-
-	ServeArtifact(w, result)
+	h.proxy.handleFilenameDownload(w, r, filenameDownload{
+		ecosystem: "gem",
+		suffix:    ".gem",
+		parseErr:  "could not parse gem filename",
+		fetchErr:  "failed to fetch gem",
+		parse:     h.parseGemFilename,
+	})
 }
 
 // parseGemFilename extracts name and version from a gem filename.
diff --git a/internal/handler/handler.go b/internal/handler/handler.go
index 202426d..e62292f 100644
--- a/internal/handler/handler.go
+++ b/internal/handler/handler.go
@@ -251,6 +251,9 @@ func (p *Proxy) fetchAndCache(ctx context.Context, ecosystem, name, version, fil
 	// Resolve download URL
 	info, err := p.Resolver.Resolve(ctx, ecosystem, name, version)
 	if err != nil {
+		if errors.Is(err, fetch.ErrNotFound) {
+			return nil, ErrUpstreamNotFound
+		}
 		return nil, fmt.Errorf("resolving download URL: %w", err)
 	}
 
@@ -270,6 +273,9 @@ func (p *Proxy) fetchAndCache(ctx context.Context, ecosystem, name, version, fil
 	if err != nil {
 		metrics.RecordUpstreamFetch(ecosystem, fetchDuration)
 		metrics.RecordUpstreamError(ecosystem, "fetch_failed")
+		if errors.Is(err, fetch.ErrNotFound) {
+			return nil, ErrUpstreamNotFound
+		}
 		return nil, fmt.Errorf("fetching from upstream: %w", err)
 	}
 	metrics.RecordUpstreamFetch(ecosystem, fetchDuration)
@@ -451,7 +457,18 @@ func JSONError(w http.ResponseWriter, status int, message string) {
 }
 
 // ErrUpstreamNotFound indicates the upstream returned 404.
-var ErrUpstreamNotFound = fmt.Errorf("upstream: not found")
+var ErrUpstreamNotFound = fmt.Errorf("upstream: %w", fetch.ErrNotFound)
+
+// serveArtifactError writes response for a failed fetch:
+// 404 when upstream reports artifact missing, 502 otherwise.
+func (p *Proxy) serveArtifactError(w http.ResponseWriter, err error, clientMsg string) {
+	if errors.Is(err, ErrUpstreamNotFound) {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	p.Logger.Error("failed to get artifact", "error", err)
+	http.Error(w, clientMsg, http.StatusBadGateway)
+}
 
 // errStale304 is returned when upstream sends 304 but the cached file is missing.
 var errStale304 = fmt.Errorf("upstream returned 304 but cached file is missing")
@@ -795,6 +812,9 @@ func (p *Proxy) fetchAndCacheFromURL(ctx context.Context, ecosystem, name, versi
 
 	artifact, err := p.Fetcher.FetchWithHeaders(ctx, downloadURL, headers)
 	if err != nil {
+		if errors.Is(err, fetch.ErrNotFound) {
+			return nil, ErrUpstreamNotFound
+		}
 		return nil, fmt.Errorf("fetching from upstream: %w", err)
 	}
 
diff --git a/internal/handler/hex.go b/internal/handler/hex.go
index 6ebc176..2ff4f0f 100644
--- a/internal/handler/hex.go
+++ b/internal/handler/hex.go
@@ -53,30 +53,13 @@ func (h *HexHandler) Routes() http.Handler {
 
 // handleDownload serves a package tarball, fetching and caching from upstream if needed.
 func (h *HexHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
-	filename := r.PathValue("filename")
-	if filename == "" || !strings.HasSuffix(filename, ".tar") {
-		http.Error(w, "invalid filename", http.StatusBadRequest)
-		return
-	}
-
-	// Extract name and version from filename (e.g., "phoenix-1.7.10.tar")
-	name, version := h.parseTarballFilename(filename)
-	if name == "" || version == "" {
-		http.Error(w, "could not parse tarball filename", http.StatusBadRequest)
-		return
-	}
-
-	h.proxy.Logger.Info("hex download request",
-		"name", name, "version", version, "filename", filename)
-
-	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "hex", name, version, filename)
-	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
-		return
-	}
-
-	ServeArtifact(w, result)
+	h.proxy.handleFilenameDownload(w, r, filenameDownload{
+		ecosystem: "hex",
+		suffix:    ".tar",
+		parseErr:  "could not parse tarball filename",
+		fetchErr:  "failed to fetch package",
+		parse:     h.parseTarballFilename,
+	})
 }
 
 // parseTarballFilename extracts name and version from a hex tarball filename.
diff --git a/internal/handler/julia.go b/internal/handler/julia.go
index 08b1fdf..0fed8c9 100644
--- a/internal/handler/julia.go
+++ b/internal/handler/julia.go
@@ -90,8 +90,7 @@ func (h *JuliaHandler) handleRegistry(w http.ResponseWriter, r *http.Request) {
 	upstreamURL := h.upstreamURL + r.URL.Path
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "julia", juliaRegistryName, hash, hash+".tar.gz", upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get registry", "error", err)
-		http.Error(w, "failed to fetch registry", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch registry")
 		return
 	}
 
@@ -119,8 +118,7 @@ func (h *JuliaHandler) handlePackage(w http.ResponseWriter, r *http.Request) {
 	upstreamURL := h.upstreamURL + r.URL.Path
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "julia", name, hash, hash+".tar.gz", upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get package", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
@@ -141,8 +139,7 @@ func (h *JuliaHandler) handleArtifact(w http.ResponseWriter, r *http.Request) {
 	upstreamURL := h.upstreamURL + r.URL.Path
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "julia", juliaArtifactName, hash, hash+".tar.gz", upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch artifact", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch artifact")
 		return
 	}
 
diff --git a/internal/handler/maven.go b/internal/handler/maven.go
index c423645..10e551e 100644
--- a/internal/handler/maven.go
+++ b/internal/handler/maven.go
@@ -130,12 +130,7 @@ func (h *MavenHandler) handleDownload(w http.ResponseWriter, r *http.Request, ur
 		}
 	}
 	if err != nil {
-		if errors.Is(err, ErrUpstreamNotFound) {
-			http.Error(w, "not found", http.StatusNotFound)
-			return
-		}
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch artifact", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch artifact")
 		return
 	}
 
diff --git a/internal/handler/notfound_ecosystems_test.go b/internal/handler/notfound_ecosystems_test.go
new file mode 100644
index 0000000..3c2cecf
--- /dev/null
+++ b/internal/handler/notfound_ecosystems_test.go
@@ -0,0 +1,151 @@
+package handler
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/git-pkgs/registries/fetch"
+)
+
+func TestArtifactDownloadUpstreamNotFoundReturns404(t *testing.T) {
+	tests := []struct {
+		name    string
+		path    string
+		handler func(p *Proxy) http.Handler
+	}{
+		{"debian", "/pool/main/n/nginx/nginx_1.18.0-6_amd64.deb",
+			func(p *Proxy) http.Handler { return NewDebianHandler(p, "http://localhost").Routes() }},
+		{"rpm", "/releases/39/Everything/x86_64/os/Packages/n/nginx-1.24.0-1.fc39.x86_64.rpm",
+			func(p *Proxy) http.Handler { return NewRPMHandler(p, "http://localhost").Routes() }},
+		{"nuget", "/v3-flatcontainer/newtonsoft.json/13.0.3/newtonsoft.json.13.0.3.nupkg",
+			func(p *Proxy) http.Handler { return NewNuGetHandler(p, "http://localhost").Routes() }},
+		{"pypi", "/packages/packages/ab/cd/ef0123456789/requests-2.31.0-py3-none-any.whl",
+			func(p *Proxy) http.Handler { return NewPyPIHandler(p, "http://localhost").Routes() }},
+		{"cran", "/src/contrib/ggplot2_3.4.4.tar.gz",
+			func(p *Proxy) http.Handler { return NewCRANHandler(p, "http://localhost").Routes() }},
+		{"conda", "/conda-forge/linux-64/numpy-1.26.0-py311_0.tar.bz2",
+			func(p *Proxy) http.Handler { return NewCondaHandler(p, "http://localhost").Routes() }},
+		{"conan", "/v1/files/zlib/1.3.1/_/_/0/recipe/conan_sources.tgz",
+			func(p *Proxy) http.Handler { return NewConanHandler(p, "http://localhost").Routes() }},
+		{"gem", "/gems/rails-7.1.0.gem",
+			func(p *Proxy) http.Handler { return NewGemHandler(p, "http://localhost").Routes() }},
+		{"hex", "/tarballs/phoenix-1.7.10.tar",
+			func(p *Proxy) http.Handler { return NewHexHandler(p, "http://localhost").Routes() }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			proxy, _, _, fetcher := setupTestProxy(t)
+			fetcher.fetchErr = fetch.ErrNotFound
+
+			srv := httptest.NewServer(tt.handler(proxy))
+			defer srv.Close()
+
+			resp, err := http.Get(srv.URL + tt.path)
+			if err != nil {
+				t.Fatalf("request failed: %v", err)
+			}
+			defer func() { _ = resp.Body.Close() }()
+
+			if resp.StatusCode != http.StatusNotFound {
+				t.Errorf("want 404 for missing upstream artifact, got %d", resp.StatusCode)
+			}
+		})
+	}
+}
+
+func TestJuliaPackageUpstreamNotFoundReturns404(t *testing.T) {
+	proxy, _, _, fetcher := setupTestProxy(t)
+	fetcher.fetchErr = fetch.ErrNotFound
+
+	dead := httptest.NewServer(http.NotFoundHandler())
+	defer dead.Close()
+
+	h := NewJuliaHandler(proxy, "http://localhost")
+	h.upstreamURL = dead.URL
+
+	srv := httptest.NewServer(h.Routes())
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL +
+		"/package/7876af07-990d-54b4-ab0e-23690620f79a/0123456789abcdef0123456789abcdef01234567")
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("want 404 for missing upstream package, got %d", resp.StatusCode)
+	}
+}
+
+func TestComposerDownloadUpstreamNotFoundReturns404(t *testing.T) {
+	proxy, _, _, fetcher := setupTestProxy(t)
+	fetcher.fetchErr = fetch.ErrNotFound
+
+	meta := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/p2/monolog/monolog.json" {
+			_, _ = w.Write([]byte(`{
+				"packages": {
+					"monolog/monolog": [
+						{"version": "2.9.1", "dist": {"url": "https://example.com/monolog-2.9.1.zip", "type": "zip"}}
+					]
+				}
+			}`))
+			return
+		}
+		http.NotFound(w, r)
+	}))
+	defer meta.Close()
+
+	h := &ComposerHandler{proxy: proxy, repoURL: meta.URL, proxyURL: "http://localhost"}
+	srv := httptest.NewServer(h.Routes())
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/files/monolog/monolog/2.9.1/monolog-2.9.1.zip")
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("want 404 for missing upstream dist, got %d", resp.StatusCode)
+	}
+}
+
+func TestContainerBlobUpstreamNotFoundReturns404(t *testing.T) {
+	authServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"token": "test-token-123"}`))
+	}))
+	defer authServer.Close()
+
+	proxy, _, _, _ := setupTestProxy(t)
+	proxy.Fetcher = &mockFetcherWithHeaders{
+		fetchFn: func(_ context.Context, _ string, _ http.Header) (*fetch.Artifact, error) {
+			return nil, fetch.ErrNotFound
+		},
+	}
+
+	h := &ContainerHandler{
+		proxy:       proxy,
+		registryURL: "https://registry-1.docker.io",
+		authURL:     authServer.URL,
+		proxyURL:    "http://localhost:8080",
+	}
+
+	req := httptest.NewRequest(http.MethodGet,
+		"/library/nginx/blobs/sha256:abc123def456abc123def456abc123def456abc123def456abc123def456abcd", nil)
+	w := httptest.NewRecorder()
+	h.Routes().ServeHTTP(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Errorf("want 404 for missing upstream blob, got %d; body: %s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "BLOB_UNKNOWN") {
+		t.Errorf("want BLOB_UNKNOWN error code in body, got: %s", w.Body.String())
+	}
+}
diff --git a/internal/handler/notfound_test.go b/internal/handler/notfound_test.go
new file mode 100644
index 0000000..9ea38ac
--- /dev/null
+++ b/internal/handler/notfound_test.go
@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/git-pkgs/registries/fetch"
+)
+
+func TestErrUpstreamNotFoundWrapsFetchErrNotFound(t *testing.T) {
+	if !errors.Is(ErrUpstreamNotFound, fetch.ErrNotFound) {
+		t.Fatal("ErrUpstreamNotFound does not wrap fetch.ErrNotFound")
+	}
+}
+
+func TestGetOrFetchArtifactFromURL_NotFound(t *testing.T) {
+	proxy, _, _, fetcher := setupTestProxy(t)
+	fetcher.fetchErr = fetch.ErrNotFound
+
+	_, err := proxy.GetOrFetchArtifactFromURL(context.Background(),
+		"maven", "org.example:missing", "1.0", "missing-1.0.jar",
+		"http://upstream.test/org/example/missing/1.0/missing-1.0.jar")
+
+	if !errors.Is(err, ErrUpstreamNotFound) {
+		t.Fatalf("want ErrUpstreamNotFound, got %v", err)
+	}
+}
+
+func TestMavenHandler_UpstreamNotFoundReturns404(t *testing.T) {
+	proxy, _, _, fetcher := setupTestProxy(t)
+	fetcher.fetchErr = fetch.ErrNotFound
+
+	h := NewMavenHandler(proxy, "http://localhost", "http://upstream.test", "http://portal.test")
+	srv := httptest.NewServer(h.Routes())
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/org/example/missing/1.0/missing-1.0.jar")
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusNotFound {
+		t.Errorf("want 404 for missing upstream artifact, got %d", resp.StatusCode)
+	}
+}
+
+func TestMavenHandler_PluginPortalFallback(t *testing.T) {
+	proxy, _, _, fetcher := setupTestProxy(t)
+	fetcher.fetchErrByURL = map[string]error{
+		"http://upstream.test/org/example/plugin/1.0/plugin-1.0.jar": fetch.ErrNotFound,
+	}
+	fetcher.artifact = &fetch.Artifact{
+		Body:        io.NopCloser(strings.NewReader("portal artifact")),
+		ContentType: "application/java-archive",
+	}
+
+	h := NewMavenHandler(proxy, "http://localhost", "http://upstream.test", "http://portal.test")
+	srv := httptest.NewServer(h.Routes())
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/org/example/plugin/1.0/plugin-1.0.jar")
+	if err != nil {
+		t.Fatalf("request failed: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("want 200 via plugin portal fallback, got %d", resp.StatusCode)
+	}
+	body, _ := io.ReadAll(resp.Body)
+	if string(body) != "portal artifact" {
+		t.Errorf("want portal artifact body, got %q", body)
+	}
+	if fetcher.fetchedURL != "http://portal.test/org/example/plugin/1.0/plugin-1.0.jar" {
+		t.Errorf("fallback did not hit plugin portal, last URL: %s", fetcher.fetchedURL)
+	}
+}
diff --git a/internal/handler/npm.go b/internal/handler/npm.go
index 06f539e..a3ed910 100644
--- a/internal/handler/npm.go
+++ b/internal/handler/npm.go
@@ -263,6 +263,10 @@ func (h *NPMHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 
 	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "npm", packageName, version, filename)
 	if err != nil {
+		if errors.Is(err, ErrUpstreamNotFound) {
+			JSONError(w, http.StatusNotFound, "package not found")
+			return
+		}
 		h.proxy.Logger.Error("failed to get artifact", "error", err)
 		JSONError(w, http.StatusBadGateway, "failed to fetch package")
 		return
diff --git a/internal/handler/nuget.go b/internal/handler/nuget.go
index 3e6373a..4785e40 100644
--- a/internal/handler/nuget.go
+++ b/internal/handler/nuget.go
@@ -314,8 +314,7 @@ func (h *NuGetHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "nuget", name, version, filename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/pub.go b/internal/handler/pub.go
index 2971ddf..e5ca199 100644
--- a/internal/handler/pub.go
+++ b/internal/handler/pub.go
@@ -67,8 +67,7 @@ func (h *PubHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 
 	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "pub", name, version, filename)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/pypi.go b/internal/handler/pypi.go
index 0cf39fb..f5a0232 100644
--- a/internal/handler/pypi.go
+++ b/internal/handler/pypi.go
@@ -426,8 +426,7 @@ func (h *PyPIHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "pypi", name, version, filename, upstreamURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get artifact", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 
diff --git a/internal/handler/rpm.go b/internal/handler/rpm.go
index 6440d0f..a5752ec 100644
--- a/internal/handler/rpm.go
+++ b/internal/handler/rpm.go
@@ -83,8 +83,7 @@ func (h *RPMHandler) handlePackageDownload(w http.ResponseWriter, r *http.Reques
 	result, err := h.proxy.GetOrFetchArtifactFromURL(
 		r.Context(), "rpm", name, version, filename, downloadURL)
 	if err != nil {
-		h.proxy.Logger.Error("failed to get rpm package", "error", err)
-		http.Error(w, "failed to fetch package", http.StatusBadGateway)
+		h.proxy.serveArtifactError(w, err, "failed to fetch package")
 		return
 	}
 

From cf3741162f7e3000cc9bc78152896e608e5a6549 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Sun, 26 Jul 2026 19:11:24 +0100
Subject: [PATCH 16/25] fix(upstream): honor npm and Cargo overrides (#200)

* fix(upstream): honor npm and cargo overrides

* Preserve npm scope separators in download URLs

* Apply upstream auth to metadata requests
---
 internal/handler/cargo.go      | 24 ++++++++--
 internal/handler/cargo_test.go | 71 +++++++++++++++++++++++++++++
 internal/handler/handler.go    | 16 +++++++
 internal/handler/npm.go        | 26 +++++++++--
 internal/handler/npm_test.go   | 83 ++++++++++++++++++++++++++++++++++
 internal/server/server.go      | 10 +++-
 internal/server/server_test.go |  9 +++-
 7 files changed, 228 insertions(+), 11 deletions(-)

diff --git a/internal/handler/cargo.go b/internal/handler/cargo.go
index abc0d1f..79fb750 100644
--- a/internal/handler/cargo.go
+++ b/internal/handler/cargo.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 )
@@ -28,11 +29,18 @@ type CargoHandler struct {
 }
 
 // NewCargoHandler creates a new cargo protocol handler.
-func NewCargoHandler(proxy *Proxy, proxyURL string) *CargoHandler {
+func NewCargoHandler(proxy *Proxy, proxyURL, indexURL, downloadURL string) *CargoHandler {
+	if strings.TrimSpace(indexURL) == "" {
+		indexURL = cargoUpstream
+	}
+	if strings.TrimSpace(downloadURL) == "" {
+		downloadURL = cargoDownloadBase
+	}
+
 	return &CargoHandler{
 		proxy:       proxy,
-		indexURL:    cargoUpstream,
-		downloadURL: cargoDownloadBase,
+		indexURL:    strings.TrimSuffix(indexURL, "/"),
+		downloadURL: strings.TrimSuffix(downloadURL, "/"),
 		proxyURL:    strings.TrimSuffix(proxyURL, "/"),
 	}
 }
@@ -189,7 +197,15 @@ func (h *CargoHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 	h.proxy.Logger.Info("cargo download request",
 		"crate", name, "version", version, "filename", filename)
 
-	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "cargo", name, version, filename)
+	downloadURL := fmt.Sprintf(
+		"%s/%s/%s",
+		h.downloadURL,
+		url.PathEscape(name),
+		url.PathEscape(filename),
+	)
+	result, err := h.proxy.GetOrFetchArtifactFromURL(
+		r.Context(), "cargo", name, version, filename, downloadURL,
+	)
 	if err != nil {
 		h.proxy.serveArtifactError(w, err, "failed to fetch crate")
 		return
diff --git a/internal/handler/cargo_test.go b/internal/handler/cargo_test.go
index 10d3faf..895ff7b 100644
--- a/internal/handler/cargo_test.go
+++ b/internal/handler/cargo_test.go
@@ -2,6 +2,7 @@ package handler
 
 import (
 	"encoding/json"
+	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
@@ -10,6 +11,7 @@ import (
 	"time"
 
 	"github.com/git-pkgs/cooldown"
+	"github.com/git-pkgs/registries/fetch"
 )
 
 func cargoTestProxy() *Proxy {
@@ -70,6 +72,75 @@ func TestCargoConfigEndpoint(t *testing.T) {
 	}
 }
 
+func TestCargoHandlerUsesConfiguredUpstreams(t *testing.T) {
+	t.Run("index", func(t *testing.T) {
+		var requestPath, authHeader string
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestPath = r.URL.Path
+			authHeader = r.Header.Get("Authorization")
+			if authHeader != "Bearer cargo-token" {
+				w.WriteHeader(http.StatusUnauthorized)
+				return
+			}
+			w.Header().Set("Content-Type", "text/plain")
+			_, _ = io.WriteString(w, `{"name":"serde","vers":"1.0.0"}`)
+		}))
+		defer upstream.Close()
+
+		proxy, _, _, _ := setupTestProxy(t)
+		proxy.HTTPClient = upstream.Client()
+		proxy.AuthForURL = func(string) (string, string) {
+			return "Authorization", "Bearer cargo-token"
+		}
+		h := NewCargoHandler(
+			proxy,
+			"http://proxy.test",
+			upstream.URL+"/index/",
+			"https://crates.example.test/files/",
+		)
+
+		req := httptest.NewRequest(http.MethodGet, "/se/rd/serde", nil)
+		w := httptest.NewRecorder()
+		h.Routes().ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Fatalf("status = %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+		}
+		if requestPath != "/index/se/rd/serde" {
+			t.Errorf("upstream path = %q, want %q", requestPath, "/index/se/rd/serde")
+		}
+		if authHeader != "Bearer cargo-token" {
+			t.Errorf("Authorization = %q, want %q", authHeader, "Bearer cargo-token")
+		}
+	})
+
+	t.Run("download", func(t *testing.T) {
+		proxy, _, _, artifactFetcher := setupTestProxy(t)
+		artifactFetcher.artifact = &fetch.Artifact{
+			Body:        io.NopCloser(strings.NewReader("crate")),
+			ContentType: "application/gzip",
+		}
+		h := NewCargoHandler(
+			proxy,
+			"http://proxy.test",
+			"https://index.example.test/root/",
+			"https://crates.example.test/files/",
+		)
+
+		req := httptest.NewRequest(http.MethodGet, "/crates/serde/1.0.0/download", nil)
+		w := httptest.NewRecorder()
+		h.Routes().ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Fatalf("status = %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+		}
+		want := "https://crates.example.test/files/serde/serde-1.0.0.crate"
+		if artifactFetcher.fetchedURL != want {
+			t.Errorf("fetched URL = %q, want %q", artifactFetcher.fetchedURL, want)
+		}
+	})
+}
+
 func TestCargoIndexProxy(t *testing.T) {
 	// Create a mock upstream index server
 	indexContent := `{"name":"serde","vers":"1.0.0","deps":[],"cksum":"abc123"}
diff --git a/internal/handler/handler.go b/internal/handler/handler.go
index e62292f..fc78dbf 100644
--- a/internal/handler/handler.go
+++ b/internal/handler/handler.go
@@ -104,6 +104,7 @@ type Proxy struct {
 	// storage at an internal one.
 	DirectServeBaseURL string
 	HTTPClient         *http.Client
+	AuthForURL         func(string) (headerName, headerValue string)
 }
 
 // NewProxy creates a new Proxy with the given dependencies.
@@ -405,6 +406,7 @@ func (p *Proxy) ProxyUpstream(w http.ResponseWriter, r *http.Request, upstreamUR
 			req.Header.Set(header, v)
 		}
 	}
+	p.applyUpstreamAuth(req)
 
 	resp, err := p.HTTPClient.Do(req)
 	if err != nil {
@@ -431,6 +433,7 @@ func (p *Proxy) ProxyFile(w http.ResponseWriter, r *http.Request, upstreamURL st
 		http.Error(w, "failed to create request", http.StatusInternalServerError)
 		return
 	}
+	p.applyUpstreamAuth(req)
 
 	resp, err := p.HTTPClient.Do(req)
 	if err != nil {
@@ -571,6 +574,7 @@ func (p *Proxy) fetchUpstreamMetadata(ctx context.Context, upstreamURL string, e
 		return nil, "", "", zeroTime, fmt.Errorf("creating request: %w", err)
 	}
 	req.Header.Set("Accept", accept)
+	p.applyUpstreamAuth(req)
 
 	if entry != nil && entry.ETag.Valid {
 		req.Header.Set("If-None-Match", entry.ETag.String)
@@ -760,6 +764,7 @@ func (p *Proxy) proxyMetadataStream(w http.ResponseWriter, r *http.Request, upst
 		accept = acceptHeaders[0]
 	}
 	req.Header.Set("Accept", accept)
+	p.applyUpstreamAuth(req)
 
 	for _, header := range []string{headerAcceptEncoding, "If-Modified-Since", "If-None-Match"} {
 		if v := r.Header.Get(header); v != "" {
@@ -784,6 +789,17 @@ func (p *Proxy) proxyMetadataStream(w http.ResponseWriter, r *http.Request, upst
 	_, _ = io.Copy(w, resp.Body)
 }
 
+func (p *Proxy) applyUpstreamAuth(req *http.Request) {
+	if p.AuthForURL == nil {
+		return
+	}
+
+	headerName, headerValue := p.AuthForURL(req.URL.String())
+	if headerName != "" && headerValue != "" {
+		req.Header.Set(headerName, headerValue)
+	}
+}
+
 // GetOrFetchArtifactFromURL retrieves an artifact from cache or fetches from a specific URL.
 // This is useful for registries where download URLs are determined from metadata.
 func (p *Proxy) GetOrFetchArtifactFromURL(ctx context.Context, ecosystem, name, version, filename, downloadURL string) (*CacheResult, error) {
diff --git a/internal/handler/npm.go b/internal/handler/npm.go
index a3ed910..ee9b59c 100644
--- a/internal/handler/npm.go
+++ b/internal/handler/npm.go
@@ -25,10 +25,14 @@ type NPMHandler struct {
 }
 
 // NewNPMHandler creates a new npm protocol handler.
-func NewNPMHandler(proxy *Proxy, proxyURL string) *NPMHandler {
+func NewNPMHandler(proxy *Proxy, proxyURL, upstreamURL string) *NPMHandler {
+	if strings.TrimSpace(upstreamURL) == "" {
+		upstreamURL = npmUpstream
+	}
+
 	return &NPMHandler{
 		proxy:       proxy,
-		upstreamURL: npmUpstream,
+		upstreamURL: strings.TrimSuffix(upstreamURL, "/"),
 		proxyURL:    strings.TrimSuffix(proxyURL, "/"),
 	}
 }
@@ -261,7 +265,15 @@ func (h *NPMHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 	h.proxy.Logger.Info("npm download request",
 		"package", packageName, "version", version, "filename", filename)
 
-	result, err := h.proxy.GetOrFetchArtifact(r.Context(), "npm", packageName, version, filename)
+	downloadURL := fmt.Sprintf(
+		"%s/%s/-/%s",
+		h.upstreamURL,
+		escapeNPMDownloadPackage(packageName),
+		url.PathEscape(filename),
+	)
+	result, err := h.proxy.GetOrFetchArtifactFromURL(
+		r.Context(), "npm", packageName, version, filename, downloadURL,
+	)
 	if err != nil {
 		if errors.Is(err, ErrUpstreamNotFound) {
 			JSONError(w, http.StatusNotFound, "package not found")
@@ -275,6 +287,14 @@ func (h *NPMHandler) handleDownload(w http.ResponseWriter, r *http.Request) {
 	ServeArtifact(w, result)
 }
 
+func escapeNPMDownloadPackage(packageName string) string {
+	scope, name, scoped := strings.Cut(packageName, "/")
+	if scoped && strings.HasPrefix(scope, "@") && len(scope) > 1 && name != "" && !strings.Contains(name, "/") {
+		return url.PathEscape(scope) + "/" + url.PathEscape(name)
+	}
+	return url.PathEscape(packageName)
+}
+
 // extractPackageName extracts the package name from the request path.
 // Handles both scoped (@scope/name) and unscoped (name) packages.
 func (h *NPMHandler) extractPackageName(r *http.Request) string {
diff --git a/internal/handler/npm_test.go b/internal/handler/npm_test.go
index bc1edde..e0257dd 100644
--- a/internal/handler/npm_test.go
+++ b/internal/handler/npm_test.go
@@ -2,13 +2,16 @@ package handler
 
 import (
 	"encoding/json"
+	"io"
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/git-pkgs/cooldown"
+	"github.com/git-pkgs/registries/fetch"
 )
 
 const testVersion100 = "1.0.0"
@@ -46,6 +49,86 @@ func TestNPMExtractVersionFromFilename(t *testing.T) {
 	}
 }
 
+func TestNPMHandlerUsesConfiguredUpstream(t *testing.T) {
+	t.Run("metadata", func(t *testing.T) {
+		var requestPath, authHeader string
+		upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			requestPath = r.URL.Path
+			authHeader = r.Header.Get("Authorization")
+			if authHeader != "Bearer npm-token" {
+				w.WriteHeader(http.StatusUnauthorized)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = io.WriteString(w, `{"versions":{}}`)
+		}))
+		defer upstream.Close()
+
+		proxy, _, _, _ := setupTestProxy(t)
+		proxy.HTTPClient = upstream.Client()
+		proxy.AuthForURL = func(string) (string, string) {
+			return "Authorization", "Bearer npm-token"
+		}
+		h := NewNPMHandler(proxy, "http://proxy.test", upstream.URL+"/root/")
+
+		req := httptest.NewRequest(http.MethodGet, "/testpkg", nil)
+		w := httptest.NewRecorder()
+		h.Routes().ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Fatalf("status = %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+		}
+		if requestPath != "/root/testpkg" {
+			t.Errorf("upstream path = %q, want %q", requestPath, "/root/testpkg")
+		}
+		if authHeader != "Bearer npm-token" {
+			t.Errorf("Authorization = %q, want %q", authHeader, "Bearer npm-token")
+		}
+	})
+
+	t.Run("download", func(t *testing.T) {
+		proxy, _, _, artifactFetcher := setupTestProxy(t)
+		artifactFetcher.artifact = &fetch.Artifact{
+			Body:        io.NopCloser(strings.NewReader("package")),
+			ContentType: "application/gzip",
+		}
+		h := NewNPMHandler(proxy, "http://proxy.test", "https://npm.example.test/root/")
+
+		req := httptest.NewRequest(http.MethodGet, "/testpkg/-/testpkg-1.0.0.tgz", nil)
+		w := httptest.NewRecorder()
+		h.Routes().ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Fatalf("status = %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+		}
+		want := "https://npm.example.test/root/testpkg/-/testpkg-1.0.0.tgz"
+		if artifactFetcher.fetchedURL != want {
+			t.Errorf("fetched URL = %q, want %q", artifactFetcher.fetchedURL, want)
+		}
+	})
+
+	t.Run("scoped download", func(t *testing.T) {
+		proxy, _, _, artifactFetcher := setupTestProxy(t)
+		artifactFetcher.artifact = &fetch.Artifact{
+			Body:        io.NopCloser(strings.NewReader("package")),
+			ContentType: "application/gzip",
+		}
+		h := NewNPMHandler(proxy, "http://proxy.test", "https://npm.example.test/root/")
+
+		req := httptest.NewRequest(http.MethodGet, "/@scope/name/-/name-1.0.0.tgz", nil)
+		w := httptest.NewRecorder()
+		h.Routes().ServeHTTP(w, req)
+
+		if w.Code != http.StatusOK {
+			t.Fatalf("status = %d, want %d; body: %s", w.Code, http.StatusOK, w.Body.String())
+		}
+		want := "https://npm.example.test/root/@scope/name/-/name-1.0.0.tgz"
+		if artifactFetcher.fetchedURL != want {
+			t.Errorf("fetched URL = %q, want %q", artifactFetcher.fetchedURL, want)
+		}
+	})
+}
+
 func TestNPMRewriteMetadata(t *testing.T) {
 	h := &NPMHandler{
 		proxy:    testProxy(),
diff --git a/internal/server/server.go b/internal/server/server.go
index 74c82c7..13c5997 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -167,6 +167,7 @@ func (s *Server) Start() error {
 	}
 	proxy := handler.NewProxy(s.db, s.storage, fetcher, resolver, s.logger)
 	proxy.HTTPClient.Timeout = s.cfg.ParseHTTPTimeout()
+	proxy.AuthForURL = s.authForURL
 	proxy.Cooldown = cd
 	proxy.CacheMetadata = s.cfg.CacheMetadata
 	proxy.MetadataTTL = s.cfg.ParseMetadataTTL()
@@ -196,8 +197,13 @@ func (s *Server) Start() error {
 	})
 
 	// Mount protocol handlers
-	npmHandler := handler.NewNPMHandler(proxy, s.cfg.BaseURL)
-	cargoHandler := handler.NewCargoHandler(proxy, s.cfg.BaseURL)
+	npmHandler := handler.NewNPMHandler(proxy, s.cfg.BaseURL, s.cfg.Upstream.NPM)
+	cargoHandler := handler.NewCargoHandler(
+		proxy,
+		s.cfg.BaseURL,
+		s.cfg.Upstream.Cargo,
+		s.cfg.Upstream.CargoDownload,
+	)
 	gemHandler := handler.NewGemHandler(proxy, s.cfg.BaseURL)
 	goHandler := handler.NewGoHandler(proxy, s.cfg.BaseURL)
 	hexHandler := handler.NewHexHandler(proxy, s.cfg.BaseURL)
diff --git a/internal/server/server_test.go b/internal/server/server_test.go
index f1de62d..2d27147 100644
--- a/internal/server/server_test.go
+++ b/internal/server/server_test.go
@@ -67,8 +67,13 @@ func newTestServer(t *testing.T) *testServer {
 	r := chi.NewRouter()
 
 	// Mount handlers
-	npmHandler := handler.NewNPMHandler(proxy, cfg.BaseURL)
-	cargoHandler := handler.NewCargoHandler(proxy, cfg.BaseURL)
+	npmHandler := handler.NewNPMHandler(proxy, cfg.BaseURL, cfg.Upstream.NPM)
+	cargoHandler := handler.NewCargoHandler(
+		proxy,
+		cfg.BaseURL,
+		cfg.Upstream.Cargo,
+		cfg.Upstream.CargoDownload,
+	)
 	gemHandler := handler.NewGemHandler(proxy, cfg.BaseURL)
 	goHandler := handler.NewGoHandler(proxy, cfg.BaseURL)
 	pypiHandler := handler.NewPyPIHandler(proxy, cfg.BaseURL)

From 44041d07a986de9b567c4a7e3dd5eb34aa3f5b8b Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Mon, 27 Jul 2026 12:15:57 +0100
Subject: [PATCH 17/25] Bump git-pkgs archives, enrichment, purl, registries,
 vulns (#215)

---
 go.mod | 17 +++++++++--------
 go.sum | 32 ++++++++++++++++----------------
 2 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/go.mod b/go.mod
index 6d81076..f3becd4 100644
--- a/go.mod
+++ b/go.mod
@@ -5,14 +5,14 @@ go 1.25.6
 require (
 	github.com/BurntSushi/toml v1.6.0
 	github.com/CycloneDX/cyclonedx-go v0.11.0
-	github.com/git-pkgs/archives v0.3.0
+	github.com/git-pkgs/archives v0.3.1
 	github.com/git-pkgs/cooldown v0.1.1
-	github.com/git-pkgs/enrichment v0.6.0
-	github.com/git-pkgs/purl v0.1.14
-	github.com/git-pkgs/registries v0.6.3
+	github.com/git-pkgs/enrichment v0.6.4
+	github.com/git-pkgs/purl v0.1.15
+	github.com/git-pkgs/registries v0.6.4
 	github.com/git-pkgs/spdx v0.1.4
 	github.com/git-pkgs/vers v0.3.0
-	github.com/git-pkgs/vulns v0.2.0
+	github.com/git-pkgs/vulns v0.2.1
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lib/pq v1.12.3
@@ -115,7 +115,7 @@ require (
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ecosyste-ms/ecosystems-go v0.3.0 // indirect
+	github.com/ecosyste-ms/ecosystems-go v0.4.0 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
 	github.com/fatih/color v1.18.0 // indirect
@@ -217,7 +217,8 @@ require (
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
 	github.com/nunnatsa/ginkgolinter v0.23.0 // indirect
-	github.com/oapi-codegen/runtime v1.4.2 // indirect
+	github.com/oapi-codegen/nullable v1.1.0 // indirect
+	github.com/oapi-codegen/runtime v1.6.0 // indirect
 	github.com/package-url/packageurl-go v0.1.6 // indirect
 	github.com/pandatix/go-cvss v0.6.2 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
@@ -265,7 +266,7 @@ require (
 	github.com/timonwong/loggercheck v0.11.0 // indirect
 	github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect
 	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
+	github.com/ulikunitz/xz v0.5.16 // indirect
 	github.com/ultraware/funlen v0.2.0 // indirect
 	github.com/ultraware/whitespace v0.2.0 // indirect
 	github.com/urfave/cli/v2 v2.3.0 // indirect
diff --git a/go.sum b/go.sum
index 5d16d31..34e9116 100644
--- a/go.sum
+++ b/go.sum
@@ -217,8 +217,8 @@ github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZ
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ecosyste-ms/ecosystems-go v0.3.0 h1:eVTNKQ3PyVNkSAnk1934958Vg4rR7ho5B5MWEQaMLi4=
-github.com/ecosyste-ms/ecosystems-go v0.3.0/go.mod h1:bkjiI8WoTFB1Jw0M3h8yn3KXCD/+LdETsQ3m2BNLMHQ=
+github.com/ecosyste-ms/ecosystems-go v0.4.0 h1:5A+zF+XWT8sYYYjlc2/tI1SmiDGzbHLyT9CapVc5dGA=
+github.com/ecosyste-ms/ecosystems-go v0.4.0/go.mod h1:FVswCrp3DQkur1HjVqfDF/gYrDSEmiFflntcB1G0DbA=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
@@ -244,26 +244,26 @@ github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
 github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
 github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
-github.com/git-pkgs/archives v0.3.0 h1:iXKyO83jEFub1PGEDlHmk2tQ7XeV5LySTc0sEkH3x78=
-github.com/git-pkgs/archives v0.3.0/go.mod h1:LTJ1iQVFA7otizWMOyiI82NYVmyBWAPRzwu/e30rcXU=
+github.com/git-pkgs/archives v0.3.1 h1:GKUuw++0YXAAElxweVHiR4AaSShKKYoVQmyxlF5blG4=
+github.com/git-pkgs/archives v0.3.1/go.mod h1:408oQv3FxLCtePa33zp3sg3njXnwH74vnHZFxkRqoPo=
 github.com/git-pkgs/cooldown v0.1.1 h1:9OqqzCB8gANz/y44SmqGD0Jp8Qtu81D1sCbKl6Ehg7w=
 github.com/git-pkgs/cooldown v0.1.1/go.mod h1:v7APuK/UouTiu8mWQZbdDmj7DfxxkGUeuhjaRB5gv9E=
-github.com/git-pkgs/enrichment v0.6.0 h1:npV6N+eFZnI64uw/B0s+WJPn6Fu6Be08bexAViZFjMg=
-github.com/git-pkgs/enrichment v0.6.0/go.mod h1:ov2WDaiNoIXViqdnE1FlUjNTnB5RnkUH4et9BWPhUDY=
+github.com/git-pkgs/enrichment v0.6.4 h1:mGrfenttwmcUfPXRkWpB0wBJiiGj55ltniUh66Pq4bU=
+github.com/git-pkgs/enrichment v0.6.4/go.mod h1:zz1vPUak/w8Jhajll0KDRN2MjKaEYeCzQTxumWnVhqY=
 github.com/git-pkgs/packageurl-go v0.3.1 h1:WM3RBABQZLaRBxgKyYughc3cVBE8KyQxbSC6Jt5ak7M=
 github.com/git-pkgs/packageurl-go v0.3.1/go.mod h1:rcIxiG37BlQLB6FZfgdj9Fm7yjhRQd3l+5o7J0QPAk4=
 github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY=
 github.com/git-pkgs/pom v0.1.5/go.mod h1:ufdMBe1lKzqOeP9IUb9NPZ458xKV8E8NvuyBMxOfwIk=
-github.com/git-pkgs/purl v0.1.14 h1:GgqwiBNS0eKJqJ/gabUBEC10Xhpj6UX12kfNzujaeYc=
-github.com/git-pkgs/purl v0.1.14/go.mod h1:8oCcdcYZA/e1B33e7Ylju6azboTKjdqf3ybcbQj6I/o=
-github.com/git-pkgs/registries v0.6.3 h1:7sveeeMS2lgXtcqNYAA3bwaT7H9CQs0uhy6wQSxz3Js=
-github.com/git-pkgs/registries v0.6.3/go.mod h1:j4o50ii/vD9Z42/nFeQASt15BPolADIejeFmmqK4njo=
+github.com/git-pkgs/purl v0.1.15 h1:iQ3clh0Cw41rkM0rf24B7ShnN9Z+UtLMAFlNDUs+Qd4=
+github.com/git-pkgs/purl v0.1.15/go.mod h1:PqCLVBDeZrZgHysR803/AntMELgIr2LFZVNCcwLH2m0=
+github.com/git-pkgs/registries v0.6.4 h1:Kq/KlStjaQyE83UXT/tKuzCrIzc4keGeBjtroMqgoHA=
+github.com/git-pkgs/registries v0.6.4/go.mod h1:YkGHbxHIe2Ha/ROH6zNkS5PJUUoa9g0Ti/s2XhZnrak=
 github.com/git-pkgs/spdx v0.1.4 h1:eQ0waEV3uUeItpWAOvdN1K1rL9hTgsU7fF74r1mDXMs=
 github.com/git-pkgs/spdx v0.1.4/go.mod h1:cqRoZcvl530s/W+oGNvwjt4ODN8T1W6D/20MUZEFdto=
 github.com/git-pkgs/vers v0.3.0 h1:xM4LLUCRmqzdDfe+/pVQUx4SRyFXRVth6tOsJ14wMKU=
 github.com/git-pkgs/vers v0.3.0/go.mod h1:biTbSQK1qdbrsxDEKnqe3Jzclxz8vW6uDcwKjfUGcOo=
-github.com/git-pkgs/vulns v0.2.0 h1:S1sA0ObQ/IKW0vqK+lK+HAY37AdDHEfhaIja/fLptwg=
-github.com/git-pkgs/vulns v0.2.0/go.mod h1:mjVquLlunsAFPltqjf6mbvbI4tQ1iIa1NuhKIOPKt/4=
+github.com/git-pkgs/vulns v0.2.1 h1:tWGhOfPVDZwkM2Y9vRkMpMR+gjtlu2jhERS5JeNBoKQ=
+github.com/git-pkgs/vulns v0.2.1/go.mod h1:/0gHKHQR5SWttZVEMqgOvCXssKFwAtbac/PfkhBax9o=
 github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ=
 github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0=
 github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
@@ -512,8 +512,8 @@ github.com/nunnatsa/ginkgolinter v0.23.0 h1:x3o4DGYOWbBMP/VdNQKgSj+25aJKx2Pe6lHr
 github.com/nunnatsa/ginkgolinter v0.23.0/go.mod h1:9qN1+0akwXEccwV1CAcCDfcoBlWXHB+ML9884pL4SZ4=
 github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
 github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
-github.com/oapi-codegen/runtime v1.4.2 h1:GMxFVYLzoYLua+/KvzgSphkyK1lLTReQI9Vf4hvATKE=
-github.com/oapi-codegen/runtime v1.4.2/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
+github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCHp/VPU=
+github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
 github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
@@ -654,8 +654,8 @@ github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVF
 github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw=
 github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw=
-github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
-github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0=
+github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
 github.com/ultraware/funlen v0.2.0 h1:gCHmCn+d2/1SemTdYMiKLAHFYxTYz7z9VIDRaTGyLkI=
 github.com/ultraware/funlen v0.2.0/go.mod h1:ZE0q4TsJ8T1SQcjmkhN/w+MceuatI6pBFSxxyteHIJA=
 github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSWoFa+g=

From 90422697b81da002b7ad9ec2908c9cb6c7d7e84c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 12:16:27 +0100
Subject: [PATCH 18/25] Bump google.golang.org/grpc from 1.81.1 to 1.82.1
 (#216)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod |  4 ++--
 go.sum | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/go.mod b/go.mod
index f3becd4..c460ec7 100644
--- a/go.mod
+++ b/go.mod
@@ -303,8 +303,8 @@ require (
 	golang.org/x/tools v0.47.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.272.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
-	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	honnef.co/go/tools v0.7.0 // indirect
diff --git a/go.sum b/go.sum
index 34e9116..5621b47 100644
--- a/go.sum
+++ b/go.sum
@@ -66,8 +66,8 @@ github.com/CycloneDX/cyclonedx-go v0.11.0 h1:GokP8FiRC+foiuwWhSSLpSD5H4hSWtGnR3w
 github.com/CycloneDX/cyclonedx-go v0.11.0/go.mod h1:vUvbCXQsEm48OI6oOlanxstwNByXjCZ2wuleUlwGEO8=
 github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g=
 github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 h1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0/go.mod h1:RD2SsorTmYhF6HkTmDw7KmPYQk8OBYwTkuasChwv7R4=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
@@ -702,8 +702,8 @@ go.augendre.info/fatcontext v0.9.0 h1:Gt5jGD4Zcj8CDMVzjOJITlSb9cEch54hjRRlN3qDoj
 go.augendre.info/fatcontext v0.9.0/go.mod h1:L94brOAT1OOUNue6ph/2HnwxoNlds9aXDF2FcUntbNw=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.42.0 h1:kpt2PEJuOuqYkPcktfJqWWDjTEd/FNgrxcniL7kQrXQ=
-go.opentelemetry.io/contrib/detectors/gcp v1.42.0/go.mod h1:W9zQ439utxymRrXsUOzZbFX4JhLxXU4+ZnCt8GG7yA8=
+go.opentelemetry.io/contrib/detectors/gcp v1.43.0 h1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU=
+go.opentelemetry.io/contrib/detectors/gcp v1.43.0/go.mod h1:RyaZMFY7yi1kAs45S6mbFGz8O8rqB0dTY14uzvG4LCs=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
@@ -857,12 +857,12 @@ google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=
 google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=
 google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=
 google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=
-google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 h1:aJmi6DVGGIStN9Mobk/tZOOQUBbj0BPjZjjnOdoZKts=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From a5d456790d9da7455e6194cf28fc11d73c091eb0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 17:14:36 +0100
Subject: [PATCH 19/25] Bump actions/checkout from 7.0.0 to 7.0.1 (#218)

Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml      | 4 ++--
 .github/workflows/publish.yml | 2 +-
 .github/workflows/release.yml | 2 +-
 .github/workflows/swagger.yml | 2 +-
 .github/workflows/zizmor.yml  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c405f5d..bb3d87d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -35,7 +35,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9c99e5d..bb483f1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,7 +20,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f06cecd..5d32181 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index e99aecf..625f944 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -12,7 +12,7 @@ jobs:
   swagger:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index df06c5f..d50b0a4 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -21,7 +21,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

From b56a1fed658b91f5b6839ab02abee4471f22ea9c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 17:52:35 +0100
Subject: [PATCH 20/25] Bump docker/login-action from 4.4.0 to 4.5.0 (#220)

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...06fb636fac595d6fb4b28a5dfcb21a6f5091859c)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bb483f1..c08cfa6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Log in to the Container registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0
+        uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

From 1057ee926eb29ea87015b5f6109242cc86d27d14 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 17:55:16 +0100
Subject: [PATCH 21/25] Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1
 (#217)

Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/6599ee8b7a49aef6a770f63d261d214911a7ce02...6fc4b006235f201fdab3722e17240ab420d580e5)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index d50b0a4..4df0e18 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -26,4 +26,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1

From 31ecca8cf14a643ea8479109b8d169ea4842a174 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:31:21 +0100
Subject: [PATCH 22/25] Bump github.com/prometheus/client_golang from 1.23.2 to
 1.24.0 (#221)

Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 10 +++++-----
 go.sum | 24 ++++++++++++------------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/go.mod b/go.mod
index c460ec7..005ec32 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/go-chi/chi/v5 v5.3.1
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lib/pq v1.12.3
-	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/client_golang v1.24.0
 	github.com/prometheus/client_model v0.6.2
 	github.com/spdx/tools-golang v0.5.7
 	github.com/swaggo/swag v1.16.6
@@ -225,8 +225,8 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/quasilyte/go-ruleguard v0.4.5 // indirect
 	github.com/quasilyte/go-ruleguard/dsl v0.3.23 // indirect
 	github.com/quasilyte/gogrep v0.5.0 // indirect
@@ -290,7 +290,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
@@ -298,7 +298,7 @@ require (
 	golang.org/x/mod v0.37.0 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/tools v0.47.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
diff --git a/go.sum b/go.sum
index 5621b47..0801599 100644
--- a/go.sum
+++ b/go.sum
@@ -422,8 +422,8 @@ github.com/kisielk/errcheck v1.9.0 h1:9xt1zI9EBfcYBvdU1nVrzMzzUPUtPKs9bVSIM3TAb3
 github.com/kisielk/errcheck v1.9.0/go.mod h1:kQxWMMVZgIkDq7U8xtG/n2juOjbLgZtedi0D+/VL/i8=
 github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE=
 github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -541,14 +541,14 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgm
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
+github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
+github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
+github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/quasilyte/go-ruleguard v0.4.5 h1:AGY0tiOT5hJX9BTdx/xBdoCubQUAE2grkqY2lSwvZcA=
 github.com/quasilyte/go-ruleguard v0.4.5/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
 github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY=
@@ -726,8 +726,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 gocloud.dev v0.46.0 h1:niIuZwSjMtBx8K+ITB2s5kZullB13PGOS2ZoQPZxQ4Q=
@@ -807,8 +807,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

From 9a9a82176da7988d4ded052c39f996e93c5adff8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 09:32:38 +0100
Subject: [PATCH 23/25] Bump modernc.org/sqlite from 1.54.0 to 1.55.0 (#219)

Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.54.0 to 1.55.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 005ec32..2f62065 100644
--- a/go.mod
+++ b/go.mod
@@ -24,7 +24,7 @@ require (
 	golang.org/x/sync v0.22.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.54.0
+	modernc.org/sqlite v1.55.0
 )
 
 require (
diff --git a/go.sum b/go.sum
index 0801599..4f356f9 100644
--- a/go.sum
+++ b/go.sum
@@ -904,8 +904,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.54.0 h1:JCxR4qwkJvOaqAoYcgDoO25Nc+ROg6EJ2LfBVzdrgog=
-modernc.org/sqlite v1.54.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
+modernc.org/sqlite v1.55.0 h1:hIFh0MCH0rGinQ/4KYb5/UbCkRkb+UP+OkLCVWa5MTM=
+modernc.org/sqlite v1.55.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

From 36f3a51c6523ca4b296dadec66bf8080263932c1 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Fri, 31 Jul 2026 17:04:01 +0100
Subject: [PATCH 24/25] Detect content types when browsing files

---
 go.mod                               |   3 +-
 go.sum                               |   6 +-
 internal/server/browse.go            | 128 +++++++++++++++----------
 internal/server/browse_bench_test.go |  25 +++++
 internal/server/browse_test.go       | 138 ++++++++++++++++-----------
 5 files changed, 190 insertions(+), 110 deletions(-)

diff --git a/go.mod b/go.mod
index 2f62065..e6e0a08 100644
--- a/go.mod
+++ b/go.mod
@@ -5,9 +5,10 @@ go 1.25.6
 require (
 	github.com/BurntSushi/toml v1.6.0
 	github.com/CycloneDX/cyclonedx-go v0.11.0
-	github.com/git-pkgs/archives v0.3.1
+	github.com/git-pkgs/archives v0.4.0
 	github.com/git-pkgs/cooldown v0.1.1
 	github.com/git-pkgs/enrichment v0.6.4
+	github.com/git-pkgs/magic v0.1.0
 	github.com/git-pkgs/purl v0.1.15
 	github.com/git-pkgs/registries v0.6.4
 	github.com/git-pkgs/spdx v0.1.4
diff --git a/go.sum b/go.sum
index 4f356f9..c239240 100644
--- a/go.sum
+++ b/go.sum
@@ -244,12 +244,14 @@ github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
 github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
 github.com/ghostiam/protogetter v0.3.20/go.mod h1:FjIu5Yfs6FT391m+Fjp3fbAYJ6rkL/J6ySpZBfnODuI=
-github.com/git-pkgs/archives v0.3.1 h1:GKUuw++0YXAAElxweVHiR4AaSShKKYoVQmyxlF5blG4=
-github.com/git-pkgs/archives v0.3.1/go.mod h1:408oQv3FxLCtePa33zp3sg3njXnwH74vnHZFxkRqoPo=
+github.com/git-pkgs/archives v0.4.0 h1:KNmmIsLiSH27lUdT27EfUkQXFaLgXV5KezE81iyOIgo=
+github.com/git-pkgs/archives v0.4.0/go.mod h1:tfio0OIuPKEBKHs/UCL5XBUvYmKpnvtnba2iDlfSd6g=
 github.com/git-pkgs/cooldown v0.1.1 h1:9OqqzCB8gANz/y44SmqGD0Jp8Qtu81D1sCbKl6Ehg7w=
 github.com/git-pkgs/cooldown v0.1.1/go.mod h1:v7APuK/UouTiu8mWQZbdDmj7DfxxkGUeuhjaRB5gv9E=
 github.com/git-pkgs/enrichment v0.6.4 h1:mGrfenttwmcUfPXRkWpB0wBJiiGj55ltniUh66Pq4bU=
 github.com/git-pkgs/enrichment v0.6.4/go.mod h1:zz1vPUak/w8Jhajll0KDRN2MjKaEYeCzQTxumWnVhqY=
+github.com/git-pkgs/magic v0.1.0 h1:xLrqq7CMXB9g5bJnmJyKw17Rvlh0GFiEmO6e5RFsoeY=
+github.com/git-pkgs/magic v0.1.0/go.mod h1:3ndidt+yvFaI1M0aEkkzkOlFnLPkeVQASIUojazcxCI=
 github.com/git-pkgs/packageurl-go v0.3.1 h1:WM3RBABQZLaRBxgKyYughc3cVBE8KyQxbSC6Jt5ak7M=
 github.com/git-pkgs/packageurl-go v0.3.1/go.mod h1:rcIxiG37BlQLB6FZfgdj9Fm7yjhRQd3l+5o7J0QPAk4=
 github.com/git-pkgs/pom v0.1.5 h1:TGT8Az2OMxGWsXnSagtUMGzZm7Oax8HrSCteA+mi0qY=
diff --git a/internal/server/browse.go b/internal/server/browse.go
index 504f5f1..3ea5676 100644
--- a/internal/server/browse.go
+++ b/internal/server/browse.go
@@ -1,6 +1,7 @@
 package server
 
 import (
+	"bufio"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -10,29 +11,22 @@ import (
 
 	"github.com/git-pkgs/archives"
 	"github.com/git-pkgs/archives/diff"
+	"github.com/git-pkgs/magic"
 	"github.com/git-pkgs/proxy/internal/database"
 	"github.com/git-pkgs/purl"
 	"github.com/go-chi/chi/v5"
 )
 
-const contentTypePlainText = "text/plain; charset=utf-8"
+const (
+	contentTypePlainText = "text/plain; charset=utf-8"
+	browseSniffSize      = 512
+)
 
 // maxBrowseArchiveSize caps how much data openArchive will buffer for
 // prefix detection. Artifacts larger than this are rejected to prevent
 // memory exhaustion from a single request.
 const maxBrowseArchiveSize = 512 << 20 // 512 MB
 
-// archiveFilename returns a filename suitable for archive format detection.
-// Some ecosystems (e.g. composer) store artifacts with bare hash filenames
-// that have no extension. This adds .zip when the original has no extension
-// and the content is likely a zip archive.
-func archiveFilename(filename string) string {
-	if path.Ext(filename) == "" {
-		return filename + ".zip"
-	}
-	return filename
-}
-
 // detectSingleRootDir returns the single top-level directory name if all files
 // in the archive live under one common directory (e.g. GitHub zipballs use
 // "repo-hash/"). Returns "" if there's no single root or the archive is flat.
@@ -66,8 +60,6 @@ func detectSingleRootDir(reader archives.Reader) string {
 // and stripping a single top-level directory prefix (like GitHub zipballs).
 // For npm, the hardcoded "package/" prefix takes precedence.
 func openArchive(filename string, content io.Reader, ecosystem string) (archives.Reader, error) { //nolint:ireturn // wraps multiple archive implementations
-	fname := archiveFilename(filename)
-
 	limited := io.LimitReader(content, maxBrowseArchiveSize+1)
 	data, err := io.ReadAll(limited)
 	if err != nil {
@@ -78,17 +70,17 @@ func openArchive(filename string, content io.Reader, ecosystem string) (archives
 	}
 
 	if ecosystem == "npm" {
-		return archives.OpenBytesWithPrefix(fname, data, "package/")
+		return archives.OpenBytesWithPrefix(filename, data, "package/")
 	}
 
-	probe, err := archives.OpenBytes(fname, data)
+	probe, err := archives.OpenBytes(filename, data)
 	if err != nil {
 		return nil, err
 	}
 	prefix := detectSingleRootDir(probe)
 	_ = probe.Close()
 
-	return archives.OpenBytesWithPrefix(fname, data, prefix)
+	return archives.OpenBytesWithPrefix(filename, data, prefix)
 }
 
 // BrowseListResponse contains the file listing for a directory in an archives.
@@ -361,7 +353,14 @@ func (s *Server) browseFile(w http.ResponseWriter, r *http.Request, ecosystem, n
 	}
 	defer func() { _ = fileReader.Close() }()
 
-	contentType := detectContentType(filePath)
+	contentType, knownPath := detectContentTypeFromPath(filePath)
+	var content io.Reader = fileReader
+	if !knownPath {
+		bufferedFile := bufio.NewReaderSize(fileReader, browseSniffSize)
+		prefix, _ := bufferedFile.Peek(browseSniffSize)
+		contentType = detectContentType(filePath, prefix)
+		content = bufferedFile
+	}
 	w.Header().Set("Content-Type", contentType)
 	w.Header().Set("Content-Security-Policy", "sandbox")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
@@ -370,85 +369,112 @@ func (s *Server) browseFile(w http.ResponseWriter, r *http.Request, ecosystem, n
 	w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=%q", filename))
 
 	// Stream the file
-	_, _ = io.Copy(w, fileReader)
+	_, _ = io.Copy(w, content)
 }
 
-// detectContentType returns an appropriate content type based on file extension.
-func detectContentType(filename string) string {
+// detectContentType returns an appropriate content type. Known filenames and
+// extensions take precedence; content detection handles the remaining files.
+func detectContentType(filename string, prefix []byte) string {
+	if contentType, ok := detectContentTypeFromPath(filename); ok {
+		return contentType
+	}
+	return detectContentTypeFromPrefix(prefix)
+}
+
+func detectContentTypeFromPath(filename string) (string, bool) {
 	ext := strings.ToLower(path.Ext(filename))
 
 	switch ext {
 	// Text formats
 	case ".txt", ".md", ".markdown":
-		return contentTypePlainText
+		return contentTypePlainText, true
 	case ".html", ".htm", ".xhtml":
-		return contentTypePlainText
+		return contentTypePlainText, true
 	case ".css":
-		return "text/css; charset=utf-8"
+		return "text/css; charset=utf-8", true
 	case ".js", ".mjs":
-		return "application/javascript; charset=utf-8"
+		return "application/javascript; charset=utf-8", true
 	case ".json":
-		return "application/json; charset=utf-8"
+		return "application/json; charset=utf-8", true
 	case ".xml":
-		return "application/xml; charset=utf-8"
+		return "application/xml; charset=utf-8", true
 	case ".yaml", ".yml":
-		return "text/yaml; charset=utf-8"
+		return "text/yaml; charset=utf-8", true
 	case ".toml":
-		return "text/toml; charset=utf-8"
+		return "text/toml; charset=utf-8", true
 
 	// Programming languages
 	case ".go":
-		return "text/x-go; charset=utf-8"
+		return "text/x-go; charset=utf-8", true
 	case ".rs":
-		return "text/x-rust; charset=utf-8"
+		return "text/x-rust; charset=utf-8", true
 	case ".py":
-		return "text/x-python; charset=utf-8"
+		return "text/x-python; charset=utf-8", true
 	case ".rb":
-		return "text/x-ruby; charset=utf-8"
+		return "text/x-ruby; charset=utf-8", true
 	case ".java":
-		return "text/x-java; charset=utf-8"
+		return "text/x-java; charset=utf-8", true
 	case ".c", ".h":
-		return "text/x-c; charset=utf-8"
+		return "text/x-c; charset=utf-8", true
 	case ".cpp", ".cc", ".cxx", ".hpp":
-		return "text/x-c++; charset=utf-8"
+		return "text/x-c++; charset=utf-8", true
 	case ".ts":
-		return "text/typescript; charset=utf-8"
+		return "text/typescript; charset=utf-8", true
 	case ".tsx":
-		return "text/tsx; charset=utf-8"
+		return "text/tsx; charset=utf-8", true
 	case ".jsx":
-		return "text/jsx; charset=utf-8"
+		return "text/jsx; charset=utf-8", true
 	case ".php":
-		return "text/x-php; charset=utf-8"
+		return "text/x-php; charset=utf-8", true
 
 	// Config files
 	case ".conf", ".config", ".ini":
-		return contentTypePlainText
+		return contentTypePlainText, true
 	case ".sh", ".bash":
-		return "text/x-shellscript; charset=utf-8"
+		return "text/x-shellscript; charset=utf-8", true
 	case ".dockerfile":
-		return "text/x-dockerfile; charset=utf-8"
+		return "text/x-dockerfile; charset=utf-8", true
 
 	// Images
 	case ".png":
-		return "image/png"
+		return "image/png", true
 	case ".jpg", ".jpeg":
-		return "image/jpeg"
+		return "image/jpeg", true
 	case ".gif":
-		return "image/gif"
+		return "image/gif", true
 	case ".svg":
-		return contentTypePlainText
+		return contentTypePlainText, true
 	case ".ico":
-		return "image/x-icon"
+		return "image/x-icon", true
 
 	// Archives
 	case ".zip", ".tar", ".gz", ".bz2", ".xz":
-		return "application/octet-stream"
+		return "application/octet-stream", true
 
 	default:
-		// Try to detect if it looks like text
 		if isLikelyText(filename) {
-			return contentTypePlainText
+			return contentTypePlainText, true
 		}
+		return "", false
+	}
+}
+
+func detectContentTypeFromPrefix(prefix []byte) string {
+	result := magic.DetectPrefix(prefix)
+	if result.Kind == magic.KindText {
+		return contentTypePlainText
+	}
+
+	switch result.Format {
+	case "png":
+		return "image/png"
+	case "jpeg":
+		return "image/jpeg"
+	case "gif":
+		return "image/gif"
+	case "pdf":
+		return "application/pdf"
+	default:
 		return "application/octet-stream"
 	}
 }
diff --git a/internal/server/browse_bench_test.go b/internal/server/browse_bench_test.go
index 03f3f02..16b2419 100644
--- a/internal/server/browse_bench_test.go
+++ b/internal/server/browse_bench_test.go
@@ -55,3 +55,28 @@ func BenchmarkOpenArchive(b *testing.B) {
 		})
 	}
 }
+
+func BenchmarkDetectContentType(b *testing.B) {
+	cases := []struct {
+		name     string
+		filename string
+		prefix   []byte
+	}{
+		{"known-path", "README.md", nil},
+		{"text-prefix", "artifact", bytes.Repeat([]byte("a"), browseSniffSize)},
+		{"png-prefix", "artifact", append([]byte("\x89PNG\r\n\x1a\n"), make([]byte, browseSniffSize-8)...)},
+	}
+
+	for _, tc := range cases {
+		b.Run(tc.name, func(b *testing.B) {
+			b.ReportAllocs()
+			var contentType string
+			for b.Loop() {
+				contentType = detectContentType(tc.filename, tc.prefix)
+			}
+			if contentType == "" {
+				b.Fatal("empty content type")
+			}
+		})
+	}
+}
diff --git a/internal/server/browse_test.go b/internal/server/browse_test.go
index f1fb993..6b1e487 100644
--- a/internal/server/browse_test.go
+++ b/internal/server/browse_test.go
@@ -137,29 +137,44 @@ func TestHandleBrowseFile(t *testing.T) {
 		t.Fatalf("failed to upsert artifact: %v", err)
 	}
 
-	// Test fetching a file
-	req := httptest.NewRequest("GET", "/ui/api/browse/npm/test-browse/1.0.0/file/README.md", nil)
-	w := httptest.NewRecorder()
-	ts.handler.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
+	files := []struct {
+		path        string
+		content     string
+		contentType string
+	}{
+		{"README.md", "# Test Package\n", contentTypePlainText},
+		{"notes.data", "short text\n", contentTypePlainText},
+		{"logo", "\x89PNG\r\n\x1a\nimage data", "image/png"},
+		{"page", "<!DOCTYPE html><html></html>", contentTypePlainText},
+		{"misleading.txt", "\x89PNG\r\n\x1a\nimage data", contentTypePlainText},
 	}
+	for _, file := range files {
+		t.Run(file.path, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "/ui/api/browse/npm/test-browse/1.0.0/file/"+file.path, nil)
+			w := httptest.NewRecorder()
+			ts.handler.ServeHTTP(w, req)
 
-	body := w.Body.String()
-	if body != "# Test Package\n" {
-		t.Errorf("unexpected file content: %q", body)
-	}
-
-	// Check content type
-	contentType := w.Header().Get("Content-Type")
-	if contentType != contentTypePlainText {
-		t.Errorf("expected text/plain content type, got %q", contentType)
+			if w.Code != http.StatusOK {
+				t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
+			}
+			if w.Body.String() != file.content {
+				t.Errorf("unexpected file content: %q", w.Body.String())
+			}
+			if got := w.Header().Get("Content-Type"); got != file.contentType {
+				t.Errorf("Content-Type = %q, want %q", got, file.contentType)
+			}
+			if got := w.Header().Get("Content-Security-Policy"); got != "sandbox" {
+				t.Errorf("Content-Security-Policy = %q, want sandbox", got)
+			}
+			if got := w.Header().Get("X-Content-Type-Options"); got != "nosniff" {
+				t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+			}
+		})
 	}
 
 	// Test fetching non-existent file
-	req = httptest.NewRequest("GET", "/ui/api/browse/npm/test-browse/1.0.0/file/nonexistent.txt", nil)
-	w = httptest.NewRecorder()
+	req := httptest.NewRequest("GET", "/ui/api/browse/npm/test-browse/1.0.0/file/nonexistent.txt", nil)
+	w := httptest.NewRecorder()
 	ts.handler.ServeHTTP(w, req)
 
 	if w.Code != http.StatusNotFound {
@@ -169,34 +184,47 @@ func TestHandleBrowseFile(t *testing.T) {
 
 func TestDetectContentType(t *testing.T) {
 	tests := []struct {
+		name       string
 		filename   string
+		prefix     []byte
 		expectedCT string
 	}{
-		{"file.txt", contentTypePlainText},
-		{"file.md", contentTypePlainText},
-		{"file.json", "application/json; charset=utf-8"},
-		{"file.js", "application/javascript; charset=utf-8"},
-		{"file.go", "text/x-go; charset=utf-8"},
-		{"file.py", "text/x-python; charset=utf-8"},
-		{"file.rs", "text/x-rust; charset=utf-8"},
-		{"file.html", contentTypePlainText},
-		{"file.htm", contentTypePlainText},
-		{"file.xhtml", contentTypePlainText},
-		{"file.svg", contentTypePlainText},
-		{"file.png", "image/png"},
-		{"file.jpg", "image/jpeg"},
-		{"README", contentTypePlainText},
-		{"LICENSE", contentTypePlainText},
-		{"Makefile", contentTypePlainText},
-		{".gitignore", contentTypePlainText},
-		{"file.bin", "application/octet-stream"},
+		{"text extension", "file.txt", nil, contentTypePlainText},
+		{"markdown extension", "file.md", nil, contentTypePlainText},
+		{"JSON extension", "file.json", nil, "application/json; charset=utf-8"},
+		{"JavaScript extension", "file.js", nil, "application/javascript; charset=utf-8"},
+		{"Go extension", "file.go", nil, "text/x-go; charset=utf-8"},
+		{"Python extension", "file.py", nil, "text/x-python; charset=utf-8"},
+		{"Rust extension", "file.rs", nil, "text/x-rust; charset=utf-8"},
+		{"HTML extension", "file.html", nil, contentTypePlainText},
+		{"HTM extension", "file.htm", nil, contentTypePlainText},
+		{"XHTML extension", "file.xhtml", nil, contentTypePlainText},
+		{"SVG extension", "file.svg", nil, contentTypePlainText},
+		{"PNG extension", "file.png", nil, "image/png"},
+		{"JPEG extension", "file.jpg", nil, "image/jpeg"},
+		{"README", "README", nil, contentTypePlainText},
+		{"LICENSE", "LICENSE", nil, contentTypePlainText},
+		{"Makefile", "Makefile", nil, contentTypePlainText},
+		{"gitignore", ".gitignore", nil, contentTypePlainText},
+		{"unknown empty", "file.bin", nil, "application/octet-stream"},
+		{"extensionless PNG", "asset", []byte("\x89PNG\r\n\x1a\n"), "image/png"},
+		{"extensionless JPEG", "asset", []byte("\xff\xd8\xff"), "image/jpeg"},
+		{"extensionless GIF", "asset", []byte("GIF89a"), "image/gif"},
+		{"extensionless PDF", "asset", []byte("%PDF-1.7"), "application/pdf"},
+		{"extensionless text", "asset", []byte("plain text\n"), contentTypePlainText},
+		{"extensionless HTML", "asset", []byte("<!DOCTYPE html><html></html>"), contentTypePlainText},
+		{"extensionless XML", "asset", []byte("<?xml version=\"1.0\"?><root/>"), contentTypePlainText},
+		{"extensionless SVG", "asset", []byte("<svg xmlns=\"http://www.w3.org/2000/svg\"></svg>"), contentTypePlainText},
+		{"extensionless ZIP", "asset", []byte("PK\x03\x04"), "application/octet-stream"},
+		{"extensionless binary", "asset", []byte{0, 1, 2}, "application/octet-stream"},
+		{"known path wins", "file.txt", []byte("\x89PNG\r\n\x1a\n"), contentTypePlainText},
 	}
 
 	for _, tt := range tests {
-		t.Run(tt.filename, func(t *testing.T) {
-			got := detectContentType(tt.filename)
+		t.Run(tt.name, func(t *testing.T) {
+			got := detectContentType(tt.filename, tt.prefix)
 			if got != tt.expectedCT {
-				t.Errorf("detectContentType(%q) = %q, want %q", tt.filename, got, tt.expectedCT)
+				t.Errorf("detectContentType(%q, %q) = %q, want %q", tt.filename, tt.prefix, got, tt.expectedCT)
 			}
 		})
 	}
@@ -255,6 +283,10 @@ func createTestArchive(t *testing.T) []byte {
 		"package/lib/index.js":       "module.exports = {};",
 		"package/lib/helper.js":      "module.exports.help = () => {};",
 		"package/test/index.test.js": "// tests",
+		"package/notes.data":         "short text\n",
+		"package/logo":               "\x89PNG\r\n\x1a\nimage data",
+		"package/page":               "<!DOCTYPE html><html></html>",
+		"package/misleading.txt":     "\x89PNG\r\n\x1a\nimage data",
 	}
 
 	for path, content := range files {
@@ -609,25 +641,19 @@ func TestHandleComparePage(t *testing.T) {
 	}
 }
 
-func TestArchiveFilename(t *testing.T) {
-	tests := []struct {
-		input string
-		want  string
-	}{
-		{"package.tar.gz", "package.tar.gz"},
-		{"d2e2f014ccd6ec9fae8dbe6336a4164346a2a856", "d2e2f014ccd6ec9fae8dbe6336a4164346a2a856.zip"},
-		{"file.zip", "file.zip"},
-		{"archive.tgz", "archive.tgz"},
-		{"noext", "noext.zip"},
+func TestOpenArchiveDetectsExtensionlessTarGz(t *testing.T) {
+	reader, err := openArchive("artifact", bytes.NewReader(createTestArchive(t)), "npm")
+	if err != nil {
+		t.Fatalf("openArchive failed: %v", err)
 	}
+	defer func() { _ = reader.Close() }()
 
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			got := archiveFilename(tt.input)
-			if got != tt.want {
-				t.Errorf("archiveFilename(%q) = %q, want %q", tt.input, got, tt.want)
-			}
-		})
+	files, err := reader.List()
+	if err != nil {
+		t.Fatalf("List failed: %v", err)
+	}
+	if len(files) == 0 {
+		t.Fatal("expected files in extensionless archive")
 	}
 }
 

From 7dbf13e3450396a7fe0973c50ea59911b4c8f7c6 Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Sat, 1 Aug 2026 11:22:13 +0100
Subject: [PATCH 25/25] Avoid repeated content type path lookup

---
 internal/server/browse.go            | 11 +----------
 internal/server/browse_bench_test.go | 23 +++++++++++++++--------
 internal/server/browse_test.go       |  9 ++++++---
 3 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/internal/server/browse.go b/internal/server/browse.go
index 3ea5676..56aa1c5 100644
--- a/internal/server/browse.go
+++ b/internal/server/browse.go
@@ -358,7 +358,7 @@ func (s *Server) browseFile(w http.ResponseWriter, r *http.Request, ecosystem, n
 	if !knownPath {
 		bufferedFile := bufio.NewReaderSize(fileReader, browseSniffSize)
 		prefix, _ := bufferedFile.Peek(browseSniffSize)
-		contentType = detectContentType(filePath, prefix)
+		contentType = detectContentTypeFromPrefix(prefix)
 		content = bufferedFile
 	}
 	w.Header().Set("Content-Type", contentType)
@@ -372,15 +372,6 @@ func (s *Server) browseFile(w http.ResponseWriter, r *http.Request, ecosystem, n
 	_, _ = io.Copy(w, content)
 }
 
-// detectContentType returns an appropriate content type. Known filenames and
-// extensions take precedence; content detection handles the remaining files.
-func detectContentType(filename string, prefix []byte) string {
-	if contentType, ok := detectContentTypeFromPath(filename); ok {
-		return contentType
-	}
-	return detectContentTypeFromPrefix(prefix)
-}
-
 func detectContentTypeFromPath(filename string) (string, bool) {
 	ext := strings.ToLower(path.Ext(filename))
 
diff --git a/internal/server/browse_bench_test.go b/internal/server/browse_bench_test.go
index 16b2419..840bc75 100644
--- a/internal/server/browse_bench_test.go
+++ b/internal/server/browse_bench_test.go
@@ -58,21 +58,28 @@ func BenchmarkOpenArchive(b *testing.B) {
 
 func BenchmarkDetectContentType(b *testing.B) {
 	cases := []struct {
-		name     string
-		filename string
-		prefix   []byte
+		name      string
+		filename  string
+		prefix    []byte
+		knownPath bool
 	}{
-		{"known-path", "README.md", nil},
-		{"text-prefix", "artifact", bytes.Repeat([]byte("a"), browseSniffSize)},
-		{"png-prefix", "artifact", append([]byte("\x89PNG\r\n\x1a\n"), make([]byte, browseSniffSize-8)...)},
+		{"known-path", "README.md", nil, true},
+		{"text-prefix", "artifact", bytes.Repeat([]byte("a"), browseSniffSize), false},
+		{"png-prefix", "artifact", append([]byte("\x89PNG\r\n\x1a\n"), make([]byte, browseSniffSize-8)...), false},
 	}
 
 	for _, tc := range cases {
 		b.Run(tc.name, func(b *testing.B) {
 			b.ReportAllocs()
 			var contentType string
-			for b.Loop() {
-				contentType = detectContentType(tc.filename, tc.prefix)
+			if tc.knownPath {
+				for b.Loop() {
+					contentType, _ = detectContentTypeFromPath(tc.filename)
+				}
+			} else {
+				for b.Loop() {
+					contentType = detectContentTypeFromPrefix(tc.prefix)
+				}
 			}
 			if contentType == "" {
 				b.Fatal("empty content type")
diff --git a/internal/server/browse_test.go b/internal/server/browse_test.go
index 6b1e487..5240a92 100644
--- a/internal/server/browse_test.go
+++ b/internal/server/browse_test.go
@@ -182,7 +182,7 @@ func TestHandleBrowseFile(t *testing.T) {
 	}
 }
 
-func TestDetectContentType(t *testing.T) {
+func TestBrowseContentTypePolicy(t *testing.T) {
 	tests := []struct {
 		name       string
 		filename   string
@@ -222,9 +222,12 @@ func TestDetectContentType(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := detectContentType(tt.filename, tt.prefix)
+			got, knownPath := detectContentTypeFromPath(tt.filename)
+			if !knownPath {
+				got = detectContentTypeFromPrefix(tt.prefix)
+			}
 			if got != tt.expectedCT {
-				t.Errorf("detectContentType(%q, %q) = %q, want %q", tt.filename, tt.prefix, got, tt.expectedCT)
+				t.Errorf("content type for %q with prefix %q = %q, want %q", tt.filename, tt.prefix, got, tt.expectedCT)
 			}
 		})
 	}