Commit graph

Select branches

Hide pull requests

bump-deps

bump-deps-v0.4.0

bump-vulnerable-deps

bump-x-net

composer-unset-sentinel

cosign-signing

deps/pre-v0.7.0

enforce-max-size-eviction

extract-portable-npm-metadata

fix-197-cooldown-scoped-purls

fix-database-log-173

http-timeout-config

issue-186-container-offline-auth

issue-186-upstream-auth

issue-225-sign-container-image

julia-support

lint-cleanup

main

path-traversal-decode

perf/cache-hit-path

pin-vendored-assets

registries-v0.6.0-cooldown

ui-polish

use-database-package

validate-package-name

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#113

#114

#115

#117

#119

#120

#121

#122

#124

#125

#13

#135

#136

#137

#138

#139

#14

#140

#146

#148

#15

#150

#151

#152

#153

#154

#156

#157

#158

#159

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#174

#175

#176

#177

#178

#179

#18

#180

#181

#185

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#227

#229

#23

#230

#232

#233

#234

#235

#237

#238

#24

#240

#241

#243

#244

#245

#246

#25

#250

#251

#252

#253

#254

#255

#257

#258

#259

#26

#260

#267

#268

#269

#27

#270

#272

#273

#275

#277

#278

#279

#28

#280

#281

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#293

#294

#296

#297

#298

#299

#3

#30

#301

#302

#304

#307

#308

#31

#310

#311

#314

#315

#316

#317

#318

#319

#32

#324

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#340

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#399

#4

#40

#400

#401

#402

#404

#405

#406

#407

#408

#413

#417

#418

#419

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#430

#431

#433

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#462

#463

#464

#465

#468

#469

#47

#470

#471

#472

#473

#475

#476

#477

#479

#48

#481

#482

#483

#484

#485

#487

#488

#489

#490

#491

#492

#493

#494

#495

#496

#5

#50

#502

#503

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#515

#516

#518

#519

#520

#527

#528

#531

#533

#534

#537

#538

#539

#540

#541

#544

#545

#546

#547

#548

#549

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#561

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#610

#611

#612

#615

#616

#618

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#645

#646

#647

#649

#650

#650

#651

#653

#654

#655

#656

#658

#659

#66

#660

#661

#662

#663

#664

#666

#667

#669

#67

#671

#671

#672

#674

#675

#675

#676

#677

#678

#679

#68

#680

#681

#682

#682

#683

#683

#684

#687

#687

#688

#688

#689

#689

#69

#690

#690

#691

#691

#7

#70

#71

#72

#77

#79

#8

#80

#81

#82

#83

#84

#85

#87

#88

#89

#9

#90

#91

#92

#93

#93

#94

#95

#97

#98

v0.1.0

v0.10.0

v0.11.0

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Mono Color

• a288afab32 Match denylist entries for distro packages as handlers name them Simon Chrzanowski 2026-11-08 08:04:09 +01:00
• 4f7a8b1b08 Read Conda timestamps in seconds or milliseconds as conda does Simon Chrzanowski 2026-11-08 08:01:11 +01:00
• 3fdc53d39a Stop relaying for a fetch once it has ended Simon Chrzanowski 2026-11-08 08:02:30 +01:00
• b3728b1e16 Check the cached copy before serving upload-pack requests Simon Chrzanowski 2026-11-08 07:58:23 +01:00
• 12666071ce Make package search case-insensitive on Postgres too Simon Chrzanowski 2026-11-08 08:00:50 +01:00
• 20cbeeff22 Disable install notifications for pushed Composer versions Simon Chrzanowski 2026-11-08 07:59:45 +01:00
• 1fbcdc95c8 Rewrite project links in the PyPI root simple index Simon Chrzanowski 2026-11-08 07:58:55 +01:00
• 81c6ea26c2 Treat git keys differing only in case as one repository Simon Chrzanowski 2026-11-08 08:00:50 +01:00
• 3860a6cae5 Don't cache Maven paths with dotted group directories Simon Chrzanowski 2026-11-08 08:00:50 +01:00
• fcdf8ebc3a Serve metadata with the validators of the bytes sent Simon Chrzanowski 2026-11-08 08:00:26 +01:00
• d073fdcd52 Close npm, PyPI and pub cooldown gaps in metadata and downloads Simon Chrzanowski 2026-11-08 08:00:14 +01:00
• 2a6c809103 Reject negative and out-of-range sizes and TTLs Simon Chrzanowski 2026-11-08 07:58:49 +01:00
• 6398ed63f6 Validate and normalise scanner ecosystem names Simon Chrzanowski 2026-11-08 07:57:30 +01:00
• 0b399c248d Accept sha512 OCI blob digests and check HEAD digests Simon Chrzanowski 2026-11-08 07:57:22 +01:00
• b9f047f8dc Parse boolean environment variables strictly Simon Chrzanowski 2026-11-08 07:56:56 +01:00
• cbbeed423b Cache RPM packages under their full path Simon Chrzanowski 2026-11-08 07:56:52 +01:00
• 70d9db2906 Add CRAN routes for macOS arch layout and Meta files Simon Chrzanowski 2026-11-08 07:55:24 +01:00
• ae0be48b36
  chore: clean-up/clarity around signing across providers Milas Bowman 2026-11-07 18:29:31 -05:00
• 9f400c34af
  fix: compile error in cooldown after merge (remove direct serve URL) Milas Bowman 2026-11-07 17:13:27 -05:00
• 163665f4dc
  Merge remote-tracking branch 'upstream/main' into milas/s3-fixes Milas Bowman 2026-11-07 17:09:37 -05:00
• dadc94dd62
  chore: add some godoc on modified complex funcs Milas Bowman 2026-11-07 17:06:44 -05:00
• e4bc1f5f11
  fix: do not prepend host on signing Milas Bowman 2026-11-07 16:50:24 -05:00
• 7d84bf7682
  chore: remove deb source pkg logic / fix root-level pkg caching Milas Bowman 2026-11-07 15:28:26 -05:00
• 5c1eaa9fe5
  chore: test reliability / godoc on methods Milas Bowman 2026-11-07 13:57:40 -05:00
• d58b07b2a7 Skip discarded npm packument values with jsontext Simon Chrzanowski 2026-11-07 18:02:59 +01:00
• 2b525dc442 Count the git page's summary from its rows, and keep failed state reads Simon Chrzanowski 2026-11-07 17:57:07 +01:00
• 7f2ac614c4 Mirror commits whose .gitmodules lists no submodule Simon Chrzanowski 2026-11-07 17:51:13 +01:00
• f867f3d5a1 List cached Git repositories in the UI and the ecosystem gauges Simon Chrzanowski 2026-11-07 17:34:44 +01:00
• e9aa078a85 Mirror pkg:git tags and the submodules a commit pins Simon Chrzanowski 2026-11-07 17:29:03 +01:00
• 794ea98a28 Match abi3 wheels whatever minimum Python they name Simon Chrzanowski 2026-11-07 17:04:29 +01:00
• c0ae2e98b3 Merge remote-tracking branch 'origin/main' into feat/mirror-refresh Simon Chrzanowski 2026-11-07 17:01:23 +01:00
• 72aa8fdc43
  Merge pull request #667 from simonchrz/feat/mirror-git Andrew Nesbitt 2026-11-07 14:58:02 +00:00
• 7e18c6a020
  Merge pull request #664 from simonchrz/fix/retention-mirrored-images Andrew Nesbitt 2026-11-07 14:43:06 +00:00
• 14d103bab1
  Merge pull request #669 from git-pkgs/docs/package-manager-config Andrew Nesbitt 2026-11-07 09:56:06 +00:00
• f153a83b3a
  Cover Fedora updates and Conda defaults in setup docs Andrew Nesbitt 2026-11-07 09:46:54 +00:00
• 611feb003a
  fix(debian): route packages by filename rather than /pool prefix Milas Bowman 2026-11-04 18:29:37 -05:00
• f82ec69006
  fix(storage): restore Azure/GCS direct serve signing Milas Bowman 2026-11-06 20:06:36 -05:00
• 909e2e464a
  fix(s3): signatures for alternate hosts Milas Bowman 2026-10-19 00:02:05 -04:00
• 292ecc1488
  Correct package manager configuration examples Andrew Nesbitt 2026-11-06 22:36:47 +00:00
• b0566aa456 Fail a mirror whose refresh is past max_repo_size Simon Chrzanowski 2026-11-06 13:00:31 +01:00
• c037fb9e8b Note that git.max_size can evict a mirrored repository sooner Simon Chrzanowski 2026-11-06 12:04:14 +01:00
• 90ba3f9fd1 Say which commits fail to mirror without fetching by ID Simon Chrzanowski 2026-11-06 11:44:22 +01:00
• abe94017a1 Renew wanted refs of mirrored commits and count refreshes that fetched Simon Chrzanowski 2026-11-06 11:36:42 +01:00
• 563f58e5cc
  Merge pull request #666 from git-pkgs/cooldown-profiles Andrew Nesbitt 2026-11-06 09:59:37 +00:00
• 691088b947
  Merge pull request #658 from git-pkgs/hide-stats-connection-details Andrew Nesbitt 2026-11-06 09:40:43 +00:00
• c2dd16903a
  Share publish indexes across cooldown profiles Andrew Nesbitt 2026-11-06 09:38:07 +00:00
• 0ed91b5872
  Redact storage passwords in startup logs Andrew Nesbitt 2026-11-06 09:20:43 +00:00
• 03be03b8fe Mirror pkg:git commits into the git cache Simon Chrzanowski 2026-11-06 07:48:51 +01:00
• 79be33049a
  Add cooldown profiles selected by registry URL Andrew Nesbitt 2026-11-05 18:03:21 +00:00
• 6f6ffcb364
  Merge pull request #533 from pinguinfuss/issue-521-download-cooldown Andrew Nesbitt 2026-11-05 21:20:14 +00:00
• 61ac273862
  Check primary metadata before allowing untimed downloads Andrew Nesbitt 2026-11-05 20:00:19 +00:00
• a1021a6cd7
  Merge pull request #663 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/ecr-1.67.1 simon chrzanowski 2026-11-05 19:41:40 +01:00
• b9dcbd27fc
  Handle cooldown lookup failures and reuse download indexes Andrew Nesbitt 2026-11-05 18:41:03 +00:00
• 3ab7dcc1dc
  The UTC test compares the zone offset, since Postgres reads TIMESTAMP back as a fixed +0000 zone rather than time.UTC. Christian Heim 2026-10-26 08:55:25 +01:00
• 5db16cbb99
  Conda reads repodata as a stream for the download check, under the same bound as the repodata filter, so a repodata.json over metadata_max_size no longer lets a package in cooldown through. If even the compressed copy is too large to cache, the check streams it from upstream. Christian Heim 2026-10-26 07:28:44 +01:00
• 89c60abd1a
  Conda now checks each package file against its own timestamp, because builds of one version differ. Conda repodata and helm indexes are parsed once per cached document instead of on every download. Christian Heim 2026-10-18 21:43:57 +02:00
• 3456b394be
  Cargo, gem, hex, pub, conda and helm now check cooldown on artifact downloads too, so a version inside the window is withheld even when it was cached before. Publish times are stored in UTC. Fixes #521. Christian Heim 2026-10-18 21:30:21 +02:00
• 550a908d88
  Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.5 to 1.67.1 dependabot[bot] 2026-11-05 18:23:50 +00:00
• 7a1f25932a
  Merge pull request #662 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.12 simon chrzanowski 2026-11-05 19:18:37 +01:00
• 3a4dd48934
  Merge pull request #661 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.8.0 simon chrzanowski 2026-11-05 19:18:32 +01:00
• 8a819ca54c
  Merge pull request #660 from git-pkgs/dependabot/github_actions/docker/login-action-4.7.0 simon chrzanowski 2026-11-05 19:18:27 +01:00
• c871b7ca05
  Merge pull request #659 from git-pkgs/dependabot/docker/alpine-3.24.3 simon chrzanowski 2026-11-05 19:18:23 +01:00
• 0300ad2522 Limit APKINDEX to maxIndexBytes once decompressed Simon Chrzanowski 2026-11-05 17:44:12 +01:00
• 14d04955b4 Match wheels on any of their alternative tags Simon Chrzanowski 2026-11-05 17:43:33 +01:00
• 0f26841f56 Keep blobs of scheduled images from retention Simon Chrzanowski 2026-11-05 17:39:19 +01:00
• 6d971716d9 Describe the looser file kind matching Simon Chrzanowski 2026-11-05 17:20:16 +01:00
• 34524a4056 Limit a refreshed index to 512 MiB once decompressed Simon Chrzanowski 2026-11-05 17:20:06 +01:00
• f8c5fa9a1d Match wheels on OS and architecture, and conda builds without the hash anywhere Simon Chrzanowski 2026-11-05 17:18:56 +01:00
• 06dd126211
  Bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.12 dependabot[bot] 2026-11-05 15:15:18 +00:00
• d5dbd7a95a
  Bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 dependabot[bot] 2026-11-05 15:14:03 +00:00
• 12c5cc9e4c
  Bump docker/login-action from 4.6.0 to 4.7.0 dependabot[bot] 2026-11-05 15:14:00 +00:00
• 17355d2227
  Bump alpine from 3.24.2 to 3.24.3 dependabot[bot] 2026-11-05 15:13:42 +00:00
• 308cc133ab
  Remove connection details from stats response Andrew Nesbitt 2026-11-05 15:09:16 +00:00
• 55f1b1e2da Reject a negative mirror.refresh.max_bytes Simon Chrzanowski 2026-11-05 14:53:36 +01:00
• 010ed4761a Skip index entries whose path leaves the repository Simon Chrzanowski 2026-11-05 13:51:07 +01:00
• 6f3e8c6f7e Merge remote-tracking branch 'origin/main' into feat/mirror-refresh Simon Chrzanowski 2026-11-05 13:50:08 +01:00
• 6c8fb35ab7
  Merge pull request #626 from simonchrz/feat/project-inventory Andrew Nesbitt 2026-11-05 12:36:54 +00:00
• 17c2d52500 Note that refreshing Debian, Alpine and RPM needs cache_metadata Simon Chrzanowski 2026-11-05 12:34:36 +01:00
• 903fd94df9 Test that apk index errors leave out the URL Simon Chrzanowski 2026-11-05 12:34:32 +01:00
• eb34a1ac6f Name the apk repository, not its URL, in index errors Simon Chrzanowski 2026-11-05 12:33:46 +01:00
• 5c46a39b2d Merge remote-tracking branch 'origin/main' into feat/mirror-refresh Simon Chrzanowski 2026-11-05 12:21:49 +01:00
• 4d70793351 Name the apk repository in mirror errors Simon Chrzanowski 2026-11-05 11:56:42 +01:00
• c20f64ebaa Keep the apk namespace for the mirror's repository lookup Simon Chrzanowski 2026-11-05 10:48:44 +01:00
• 1e916bf334 Merge remote-tracking branch 'origin/main' into feat/project-inventory Simon Chrzanowski 2026-11-05 10:47:14 +01:00
• 60872fe990 Use sbom v0.1.9 Simon Chrzanowski 2026-11-05 09:34:02 +01:00
• fba9e036df
  Merge pull request #656 from simonchrz/feat/mirror-apk Andrew Nesbitt 2026-11-05 08:24:32 +00:00
• c3f0c23dc3 Name the repository segment of the APK path in the mirror docs Simon Chrzanowski 2026-11-04 16:31:50 +01:00
• e4e14696d0 Say which edge packages the APK mirror can't recognise Simon Chrzanowski 2026-11-04 16:20:30 +01:00
• 7095ab67ef Keep the Projects link on an empty projects page Simon Chrzanowski 2026-11-04 16:16:35 +01:00
• 4e25396331 Refuse distro qualifiers that aren't an Alpine release Simon Chrzanowski 2026-11-04 16:09:00 +01:00
• 6d3410df41 Use sbom's ProjectRoots for the project's own packages Simon Chrzanowski 2026-11-04 16:05:16 +01:00
• adcda6ca8b Read APKINDEX.tar.gz also where Packages.adb is served beside it Simon Chrzanowski 2026-11-04 15:54:10 +01:00
• 3e2a84a88a Mirror Alpine packages Simon Chrzanowski 2026-11-04 15:44:01 +01:00
• 1912deba6c
  Merge pull request #620 from simonchrz/feat/composer-advisories Andrew Nesbitt 2026-11-04 12:38:40 +00:00
• 88c0ba8ab3 Use sbom's root detection for the project's own packages Simon Chrzanowski 2026-11-04 13:20:29 +01:00
• e358666482 Merge remote-tracking branch 'origin/main' into feat/project-inventory Simon Chrzanowski 2026-11-04 13:19:09 +01:00
• 82b45cbb1b Merge remote-tracking branch 'origin/main' into feat/composer-advisories Simon Chrzanowski 2026-11-04 13:05:10 +01:00
• 5b10559636
  Merge pull request #639 from simonchrz/feat/cooldown-withheld-versions Andrew Nesbitt 2026-11-04 12:01:24 +00:00
• ee6cac700c
  Merge pull request #655 from simonchrz/fix/composer-download-lookup-status Andrew Nesbitt 2026-11-04 11:59:55 +00:00
• cb330a5cbf Answer 502 when a Composer download's metadata lookup fails upstream Simon Chrzanowski 2026-11-03 20:10:24 +01:00