Commit graph

Select branches

Hide pull requests

bump-deps

bump-deps-v0.4.0

bump-vulnerable-deps

bump-x-net

composer-unset-sentinel

cosign-signing

deps/pre-v0.7.0

enforce-max-size-eviction

extract-portable-npm-metadata

fix-197-cooldown-scoped-purls

fix-database-log-173

http-timeout-config

issue-186-container-offline-auth

issue-186-upstream-auth

issue-225-sign-container-image

julia-support

lint-cleanup

main

path-traversal-decode

perf/cache-hit-path

pin-vendored-assets

registries-v0.6.0-cooldown

ui-polish

use-database-package

validate-package-name

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#113

#114

#115

#117

#119

#120

#121

#122

#124

#125

#13

#135

#136

#137

#138

#139

#14

#140

#146

#148

#15

#150

#151

#152

#153

#154

#156

#157

#158

#159

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#174

#175

#176

#177

#178

#179

#18

#180

#181

#185

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#227

#229

#23

#230

#232

#233

#234

#235

#237

#238

#24

#240

#241

#243

#244

#245

#246

#25

#250

#251

#252

#253

#254

#255

#257

#258

#259

#26

#260

#267

#268

#269

#27

#270

#272

#273

#275

#277

#278

#279

#28

#280

#281

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#293

#294

#296

#297

#298

#299

#3

#30

#301

#302

#304

#307

#308

#31

#310

#311

#314

#315

#316

#317

#318

#319

#32

#324

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#340

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#399

#4

#40

#400

#401

#402

#404

#405

#406

#407

#408

#413

#417

#418

#419

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#430

#431

#433

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#462

#463

#464

#465

#468

#469

#47

#470

#471

#472

#473

#475

#476

#477

#479

#48

#481

#482

#483

#484

#485

#487

#488

#489

#490

#491

#492

#493

#494

#495

#496

#5

#50

#502

#503

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#515

#516

#518

#519

#520

#527

#528

#531

#533

#534

#537

#538

#539

#540

#541

#544

#545

#546

#547

#548

#549

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#561

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#610

#611

#612

#615

#616

#618

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#645

#646

#647

#649

#650

#650

#651

#653

#654

#655

#656

#658

#659

#66

#660

#661

#662

#663

#664

#666

#667

#669

#67

#671

#671

#672

#674

#675

#675

#676

#677

#678

#679

#68

#680

#681

#682

#682

#683

#683

#684

#687

#687

#688

#688

#689

#689

#69

#690

#690

#691

#691

#7

#70

#71

#72

#77

#79

#8

#80

#81

#82

#83

#84

#85

#87

#88

#89

#9

#90

#91

#92

#93

#93

#94

#95

#97

#98

v0.1.0

v0.10.0

v0.11.0

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Mono Color

• 1bd5cfc724
  Merge pull request #555 from simonchrz/fix/denylist-names Andrew Nesbitt 2026-10-23 09:33:42 +01:00
• 6b36f59ade
  Merge pull request #556 from simonchrz/fix/maven-extensions Andrew Nesbitt 2026-10-23 09:32:09 +01:00
• f79642b579
  Merge pull request #557 from simonchrz/fix/conda-arch Andrew Nesbitt 2026-10-23 09:30:50 +01:00
• 2e4b1033ea
  Merge pull request #559 from simonchrz/build/go-1.27.3 Andrew Nesbitt 2026-10-23 09:29:53 +01:00
• e1650e202d Match more denylist spellings Simon Chrzanowski 2026-10-23 09:55:06 +02:00
• d9d3bd2ff1 Check unhashed FreeBSD packages against the denylist Simon Chrzanowski 2026-10-23 09:50:22 +02:00
• d28c0befbf Build with Go 1.27.3 everywhere Simon Chrzanowski 2026-10-23 09:57:37 +02:00
• 1fbee102b1 Ignore path parameters when checking for dot segments Simon Chrzanowski 2026-10-23 09:47:07 +02:00
• 618975354b
  Merge pull request #558 from montehurd/contributing-review-rules Andrew Nesbitt 2026-10-23 08:45:43 +01:00
• 0ed360b8f4 Document how pull requests are reviewed and merged montehurd 2026-10-22 18:55:05 -07:00
• 20c8878dd9 Match denylist entries the way each ecosystem spells names Simon Chrzanowski 2026-10-22 20:44:02 +02:00
• 0e6ec299b3 Refuse dot segments in package paths and upstream auth matching Simon Chrzanowski 2026-10-22 20:42:19 +02:00
• 01692142a7 Cache conda packages per subdir Simon Chrzanowski 2026-10-22 20:42:17 +02:00
• f9d4da8400 Route every Maven artifact file through the download path Simon Chrzanowski 2026-10-22 20:41:51 +02:00
• 37bef64bca
  Merge pull request #553 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.7.1 Andrew Nesbitt 2026-10-22 16:57:43 +01:00
• efb77991bc
  Merge pull request #552 from git-pkgs/dependabot/github_actions/goreleaser/goreleaser-action-7.3.0 Andrew Nesbitt 2026-10-22 16:55:03 +01:00
• d154757ca3
  Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 dependabot[bot] 2026-10-22 15:13:43 +00:00
• c08c25fd04
  Bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 dependabot[bot] 2026-10-22 15:13:38 +00:00
• 1aabe47e8b
  Bump golang from 1.26.7-alpine to 1.27.2-alpine dependabot[bot] 2026-10-22 15:13:19 +00:00
• e92afe967e Mirror packages from the configured upstreams Simon Chrzanowski 2026-10-22 16:00:58 +02:00
• baeccd4408 Mirror gems and composer packages under the handler names Simon Chrzanowski 2026-10-22 15:57:14 +02:00
• f44ce1e60f List mirror versions from the configured upstream Simon Chrzanowski 2026-10-22 15:38:35 +02:00
• 3963d7ecea Support npm publish and tokens limited to some packages Simon Chrzanowski 2026-10-22 13:32:42 +02:00
• 25a5414427 Release FreeBSD binaries Simon Chrzanowski 2026-10-22 13:22:13 +02:00
• b8a4cf71de Keep the long config test and dashboard list under the maintidx limit Simon Chrzanowski 2026-10-22 13:03:16 +02:00
• 91b37ec1f8 Proxy FreeBSD pkg repositories at /freebsd/{name}/ Simon Chrzanowski 2026-10-22 12:13:20 +02:00
• bd83ef242a
  Merge pull request #537 from simonchrz/feat/hosted-adapters Andrew Nesbitt 2026-10-22 09:07:05 +01:00
• 31a4f4da8b
  Merge pull request #541 from simonchrz/fix/stale-metadata-definite-errors Andrew Nesbitt 2026-10-22 09:05:06 +01:00
• 140eca7022
  Merge pull request #544 from simonchrz/ci/monthly-release Andrew Nesbitt 2026-10-22 09:03:22 +01:00
• 0e25e46732 Keep the stale fallback for 404 and 401/403, leave npm to #503 Simon Chrzanowski 2026-10-22 09:14:33 +02:00
• a524fa95fb Flag stale npm metadata and relay definitive npm answers Mohamed Labiadh 2026-10-18 01:08:58 +01:00
• d4addfe26e Cut a patch release on the 1st of each month Simon Chrzanowski 2026-10-21 15:43:32 +02:00
• 626a8e80ec
  Serve Git repositories from a local cache (#492) montehurd 2026-10-21 03:47:16 -07:00
• fb204e9dae
  Merge main into git-http-cache Andrew Nesbitt 2026-10-21 11:40:36 +01:00
• 0832c6142b Refuse pushes of a version that holds a pushed file under another name Simon Chrzanowski 2026-10-21 12:33:43 +02:00
• 48916bcb09 Never let a cache fill replace a pushed artifact Simon Chrzanowski 2026-10-20 20:21:01 +02:00
• 5f431a3d89 Test concurrent pushes of one file at the database level Simon Chrzanowski 2026-10-20 20:07:04 +02:00
• 5c0120f305 Record pushes atomically and address review findings Simon Chrzanowski 2026-10-20 20:03:06 +02:00
• d13b8be0ae Host generic files and share one push path across hosted ecosystems Simon Chrzanowski 2026-10-20 19:39:14 +02:00
• 994a9368d1 Keep the stale warning on filtered npm version metadata Simon Chrzanowski 2026-10-21 12:23:33 +02:00
• ed77e40816
  Log rewritten npm tarball URLs once per document (#538) simon chrzanowski 2026-10-21 12:12:05 +02:00
• cc6069d8a0
  Serve additional Maven repositories at /maven/{name}/ (#539) simon chrzanowski 2026-10-21 12:10:49 +02:00
• 10fc27b2b8
  Cache Go modules that differ only in case apart (#540) simon chrzanowski 2026-10-21 12:08:50 +02:00
• 82915f6924 Count fetches in progress toward git.max_size montehurd 2026-10-20 11:34:30 -07:00
• 160305b83d Cap git.max_repo_size at git.max_size montehurd 2026-10-20 11:34:30 -07:00
• 09ce83d8c5 Evict again once repositories in use are released montehurd 2026-10-20 09:40:31 -07:00
• 64a9c6307e Lock cache_dir against a second process montehurd 2026-10-19 13:17:04 -07:00
• 7c204b5f13 Apply refresh_wait to the ref check only montehurd 2026-10-19 13:16:55 -07:00
• f3e4e097ef Cap concurrent upload-pack processes and request body size montehurd 2026-10-19 13:16:44 -07:00
• eb9216528f Note that upstream.auth credentials reach every route to a host montehurd 2026-10-19 13:15:07 -07:00
• 696fa0b219 Document setting the Git rewrite through environment variables montehurd 2026-10-15 10:28:19 -07:00
• 2a74a94a9c Serve Git repositories from a local cache montehurd 2026-10-15 04:07:30 -07:00
• 844e2ae4f3 Test that Composer metadata doesn't hide upstream 404 and 401/403 Simon Chrzanowski 2026-10-20 21:34:07 +02:00
• f77d299b31 Don't hide upstream 404 and 401/403 behind stale metadata Simon Chrzanowski 2026-10-20 21:33:08 +02:00
• fe427c75e6 Cache Go modules that differ only in case apart Simon Chrzanowski 2026-10-20 21:27:48 +02:00
• 0f37d177bc Refuse Gradle Plugin Portal roots and unroutable repository names Simon Chrzanowski 2026-10-20 21:01:17 +02:00
• 376535eed3 Refuse every Maven Central group root as a repository name Simon Chrzanowski 2026-10-20 20:53:06 +02:00
• 8502f533b4 Serve additional Maven repositories at /maven/{name}/ Simon Chrzanowski 2026-10-20 20:43:16 +02:00
• bbbe54604e Log rewritten npm tarball URLs once per document Simon Chrzanowski 2026-10-20 20:24:30 +02:00
• 5b5a848c65
  Update Go dependencies (#534) v0.10.0 Andrew Nesbitt 2026-10-20 12:29:22 +01:00
• e82a096de1
  Update Go dependencies Andrew Nesbitt 2026-10-20 12:14:23 +01:00
• 03f0ebdd55
  Use shared archives browser for cached artifacts (#512) Andrew Nesbitt 2026-10-20 11:41:18 +01:00
• 8bebc560f7
  Delete cached artifacts through the API and the UI (#491) Giles Westwood 2026-10-20 11:35:08 +01:00
• ac8ebb8a12
  Return 404 when browsing archive directories as files Andrew Nesbitt 2026-10-20 11:09:07 +01:00
• 4aa927473b
  Use archives v0.9.0 release Andrew Nesbitt 2026-10-19 08:28:26 +01:00
• f329879ec1
  Pin archives to combined browser and Hex changes Andrew Nesbitt 2026-10-18 13:22:14 +01:00
• 7b53f0b482
  Use shared archives browser for cached artifacts Andrew Nesbitt 2026-10-18 12:51:35 +01:00
• 7760d0e3b1
  Load the cache delete script from a static file Giles Westwood 2026-10-19 21:37:54 +02:00
• c09fce4d29
  Delete cached artifacts through the API and the UI Giles Westwood 2026-10-15 16:42:18 +01:00
• a97b690858
  Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) Abhinav Gautam 2026-10-20 15:55:33 +05:30
• 6857fad20e
  Abort the response when a cached artifact fails its integrity check (#504) Бат-Орших 2026-10-20 18:22:50 +08:00
• ec2dfddeb6
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-20 15:43:27 +05:30
• d56d4367c9
  Count cached metadata against max_size and evict it LRU (#507) Christian Heim 2026-10-20 11:22:55 +02:00
• c5b3ce8c2e Read the seeded artifact's storage path from the database in the integrity test orshih6 2026-10-20 08:40:26 +00:00
• 5dfd01ea74
  Use shared sbom parser for mirror sources (#510) Andrew Nesbitt 2026-10-20 09:14:09 +01:00
• eca9d9e6eb
  Merge main into issue-461-metadata-eviction Andrew Nesbitt 2026-10-20 09:11:55 +01:00
• be86256ca9
  Merge main into use-shared-sbom Andrew Nesbitt 2026-10-20 09:00:40 +01:00
• 6d771a8d3a
  Use shared cooldown package-pattern policy Andrew Nesbitt 2026-10-20 08:53:22 +01:00
• e9b9edda5a Merge remote-tracking branch 'origin/main' into fix/mirror-exit-on-failure yunaremaia 2026-10-20 04:15:50 +00:00
• b87c75199e The last-access backfill now runs in the background in batches of 1000 instead of inside the migration, resuming after a restart, and until a row is backfilled eviction orders it by its write time. Christian Heim 2026-10-19 19:51:07 +02:00
• b94533dffe Evicting metadata now drops the row and queues its path in one transaction, so a crash before the blob is deleted leaves it to reclaim instead of orphaning it. Christian Heim 2026-10-19 19:41:20 +02:00
• e6c76b09e8 Show evicted metadata on the analytics page next to evicted artifacts, and cover the new counter in the metric surface test. Christian Heim 2026-10-19 19:39:59 +02:00
• 8e04713425
  Use shared registries size limits and rate-limit gate (#516) Andrew Nesbitt 2026-10-19 12:28:55 +01:00
• f600bed073
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-19 16:10:14 +05:30
• 4de5419256
  Make response write and artifact download timeouts configurable (#531) profiling 2026-10-19 15:54:21 +08:00
• d643836649
  Add opt-in retention for generic artifacts (#513) profiling 2026-10-19 15:43:57 +08:00
• d58dd3dc3d
  Update x/net and remove unused production helpers Andrew Nesbitt 2026-10-19 08:35:46 +01:00
• 1b0bafc69d
  Use sbom v0.1.7 release Andrew Nesbitt 2026-10-19 08:20:18 +01:00
• 5fe84cd995
  Use cooldown v0.3.0 release Andrew Nesbitt 2026-10-19 08:20:05 +01:00
• ef7112c1b7
  Use registries v0.10.0 release Andrew Nesbitt 2026-10-19 08:19:55 +01:00
• 76c0de59f7 Make response write and artifact download timeouts configurable ztzhou 2026-10-19 08:17:39 +08:00
• ad7f29919b
  Refuse package mirroring from the CLI while scanning is enabled (#493) Abhinav Gautam 2026-10-19 12:32:05 +05:30
• bf0c784feb
  Add Chef Supermarket proxy support for Berkshelf and Policyfiles (#518) Abhinav Gautam 2026-10-19 12:29:39 +05:30
• cf463c1141
  Only cache real pub archives on download (#520) Christian Heim 2026-10-19 08:58:13 +02:00
• cae9c08dfe
  Stream conda repodata through the cooldown filter (#527) Andrew Nesbitt 2026-10-19 06:47:34 +01:00
• 2e0f1322a2
  Check gofmt in CI and reformat (#528) Andrew Nesbitt 2026-10-19 06:47:28 +01:00
• b33e773335
  Merge upstream main and expect exit status 1 for refused mirror downloads abhinavgautam01 2026-10-19 11:11:27 +05:30
• 558e9ea695
  Scope cached Chef cookbook archives to the upstream Supermarket abhinavgautam01 2026-10-19 11:05:11 +05:30
• 134906451b
  Check gofmt in CI and reformat Andrew Nesbitt 2026-10-18 21:11:43 +01:00
• e6eee45653
  Stream conda repodata through the cooldown filter Andrew Nesbitt 2026-10-18 21:09:47 +01:00