Releases: git-pkgs/proxy
Releases · git-pkgs/proxy
Release list
v0.7.0
Changelog
- 3e53469 Bump git-pkgs dependencies (#253)
- 41c033a Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#252)
- ed54005 Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#251)
- 30e4052 Document upstream.debian in README and config.example.yaml (#237)
- 4fa903e Enforce cooldown on artifact downloads (#240)
- 6fcc57c Optimize cached artifact serving (#245)
- a17bdc7 Sign published container images (#227)
- 538a15d fix(container): serve cached images when upstream is unavailable (#199)
- 14f80ce fix(npm): use combined Accept header to support Artifactory upstreams (#241)
- bbea63f fix(upstream): apply authentication through shared transport (#198)
- 849500d fix: decode PURL percent-encoding in versions and package paths (#244)
v0.6.1
Changelog
- 7dbf13e Avoid repeated content type path lookup
- a5d4567 Bump actions/checkout from 7.0.0 to 7.0.1 (#218)
- d0f9319 Bump dependencies ahead of v0.7.0 (#235)
- b56a1fe Bump docker/login-action from 4.4.0 to 4.5.0 (#220)
- 5f993e3 Bump docker/login-action from 4.5.0 to 4.6.0 (#232)
- 31ecca8 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#221)
- 9a9a821 Bump modernc.org/sqlite from 1.54.0 to 1.55.0 (#219)
- 1057ee9 Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#217)
- 36f3a51 Detect content types when browsing files
- 800ffc6 Make Debian upstream repository configurable. (#229)
- bc1ea30 Multi-platform build (linux/amd64 and linux/arm64) (#230)
- 63f0efd fix(pypi): resolve name and version for PEP 658 metadata sidecars (#222)
v0.6.0
Changelog
- a8c0562 Bump actions/setup-go from 6.4.0 to 6.5.0
- 60c72be Bump actions/setup-go from 6.5.0 to 7.0.0
- df3ad91 Bump docker/build-push-action from 7.2.0 to 7.3.0
- ea4eea4 Bump docker/login-action from 4.2.0 to 4.3.0
- df997e5 Bump docker/login-action from 4.3.0 to 4.4.0
- 383d208 Bump docker/metadata-action from 6.1.0 to 6.2.0
- 44041d0 Bump git-pkgs archives, enrichment, purl, registries, vulns (#215)
- 41ef279 Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
- 96e1132 Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
- 13ae397 Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
- 5ae5eab Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
- ec3cc35 Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
- cdf0756 Bump golang from 1.26.4-alpine to 1.26.5-alpine
- 1a18dd4 Bump golang.org/x/net to v0.56.0
- f7b5dd2 Bump golang.org/x/sync from 0.21.0 to 0.22.0
- 9042269 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#216)
- defe1ec Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
- c3f1577 Bump modernc.org/sqlite from 1.53.0 to 1.54.0
- 81d19b7 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
- d9b7a30 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
- cdbd1a9 Canonicalize cooldown lookup PURLs to match config
- 787b76d Fix Composer 404 on minified metadata and add debug logging
- be15a0f Fix cooldown overrides for scoped package PURLs
- 0ae6306 Make upstream HTTP timeout configurable
- 98150ea Name empty path validation subtest
- 5b959d1 Preserve Go proxy fallback for missing modules
- 4146596 Validate filesystem storage paths
- cf37411 fix(upstream): honor npm and Cargo overrides (#200)
- 532e492 fix: proper handling of upstream registry 404s (#209)
v0.5.1
Changelog
- cb18df5 Bump actions/checkout from 6.0.2 to 6.0.3 (#163)
- 795edb4 Bump actions/checkout from 6.0.3 to 7.0.0 (#175)
- d968f4a Bump alpine from 3.23.4 to 3.24.0 (#166)
- 22c9df6 Bump alpine from 3.24.0 to 3.24.1 (#172)
- bb214bb Bump git-pkgs and third-party dependencies (#177)
- fc245fd Bump github.com/git-pkgs/enrichment from 0.2.3 to 0.3.0 (#165)
- 50ea557 Bump gocloud.dev from 0.45.0 to 0.46.0 (#164)
- e289fae Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#170)
- 8aa6d75 Bump modernc.org/sqlite from 1.51.0 to 1.52.0 (#171)
- f4a8c56 Fix package redirection to '/ui/packages' (#169)
- b2011c0 Log actual database config instead of sqlite path (#176)
- ca25149 fix(composer): resolve *-dev versions from the ~dev metadata file (#174)
v0.5.0
Changelog
- da4fa2f Add PROXY_UI_URL for separate UI/package URL advertisement (#161)
- ee57878 Bump docker/build-push-action from 7.1.0 to 7.2.0 (#151)
- e5fbd6e Bump docker/login-action from 4.1.0 to 4.2.0 (#160)
- 6fa2d95 Bump docker/metadata-action from 6.0.0 to 6.1.0 (#158)
- fbe82f3 Bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0 (#157)
- 31b5135 Bump golang from 1.26.3-alpine to 1.26.4-alpine (#156)
- 65474c7 Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#153)
- 94ba4ab Bump grpc, otel, and aws-sdk-go-v2 to address security advisories (#154)
- 67190c1 Bump modernc.org/sqlite from 1.50.1 to 1.51.0 (#159)
- 946d39f Bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#152)
- 0e7af4a Make metadata size limit configurable (closes #149) (#150)
- 08d975c Mount web UI under /ui (#148)
- 8c28b02 Polish UI: lucide icons, sticky footer, hamburger nav, clickable logo (#162)
v0.4.0
Changelog
- 992f5c6 Add .golangci.yml and clear gocognit/goconst findings (#113)
- f2a5b70 Add Julia Pkg server support (#117)
- 76f41cf Add storage backend probe to /health (closes #73) (#119)
- 497e16f Bump alpine from 3.21 to 3.23.4 (#139)
- 00b032c Bump git-pkgs deps for v0.4.0 (#146)
- 1e6a0d1 Bump github.com/CycloneDX/cyclonedx-go from 0.10.0 to 0.11.0 (#136)
- 7586beb Bump github.com/git-pkgs/vers from 0.2.5 to 0.2.6 (#137)
- 7832db2 Bump golang from 1.25-alpine to 1.26.3-alpine (#138)
- ebc2ea9 Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#115)
- d39e312 Bump modernc.org/sqlite from 1.50.0 to 1.50.1 (#140)
- 5315883 Bump registries to v0.6.0 and replace internal/cooldown (#120)
- 17a10bd Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#122)
- e8363e2 Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 (#135)
- ffd28ad Handle __unset sentinel in Composer minified metadata (#121)
- 552c8ac Update Gradle cache with the configurable plugin support (#114)
- 31a9ca7 add Gradle Build Cache support with handler and tests (#87)
- a8b6b0a add support for Gradle prometheus metrics (#124)
v0.3.2
Changelog
- a4fd333 Check for path traversal after URL decoding (#108)
- 8d27406 Structured JSON error responses for API endpoints (#110)
- e912227 Use archives.OpenBytes in browse handler to cut buffer copies (#107)
- 522c6f2 Validate package paths before database lookups (#109)
- 6174112 Verify cached artifacts on read (#111)
v0.3.1
Changelog
- 50772d8 Add Homebrew install instructions
- 2816ff2 Add LICENSE
- d6066af Add MaxBytesReader to mirror API HandleCreate (#105)
- c73b0a3 Add direct-serve via presigned storage URLs
- 1ad1827 Add storage.direct_serve_base_url to override presigned URL host
- c655399 Apply 'go fmt' as suggested in CONTRIBUTING.md.
- a1d0286 Bump docker/build-push-action from 7.0.0 to 7.1.0
- 78325b6 Bump docker/login-action from 4.0.0 to 4.1.0
- adca293 Bump git-pkgs deps to latest patch releases
- d9d6e87 Bump github.com/git-pkgs/registries from 0.4.0 to 0.4.1
- 59a510f Bump github.com/lib/pq from 1.12.2 to 1.12.3
- 96049c1 Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0
- 35f26f4 Bump modernc.org/sqlite from 1.48.0 to 1.48.2
- 3a68cce Bump modernc.org/sqlite from 1.48.2 to 1.49.1
- 34be35c Bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
- 461a95c Enforce max_size config with LRU cache eviction
- cfcf480 Limit io.ReadAll in openArchive to 512 MB (#104)
- 71e8d3b Reject path traversal in filesystem storage (#106)
- f1ea8b5 Serve .html, .svg and .xhtml as text/plain in browse file handler (#103)
- 0c02455 Sign release checksums with cosign keyless
- f9f2a6e Use cosign v4 bundle format for release signing
v0.3.0
Changelog
- 7346008 Add metadata TTL and stale-while-revalidate support
- d62c42b Add mirror command and API for selective package mirroring
- d64fcb5 Bump github.com/git-pkgs/enrichment from 0.2.1 to 0.2.2
- 73d78c2 Bump github.com/git-pkgs/vulns from 0.1.3 to 0.1.4
- 497afdf Bump github.com/lib/pq from 1.12.0 to 1.12.2
- 55db8f9 Bump modernc.org/sqlite from 1.47.0 to 1.48.0
- 0273865 Fix concurrency, resource, and reliability issues in mirror
- c01f0a5 Fix metadata caching, 404 propagation, mirror progress, and registry stubs
- 4768106 Fix review issues in mirror feature
- 8b762ff Fix silent truncation of large npm metadata responses
- a947a75 Sort the ecosystems list for presentation in the UI
- 01b4e72 Use abbreviated npm metadata when cooldown is disabled
v0.2.1
Changelog
- bcbb883 Add failing tests for composer dist URL and shared reference bugs
- 941ed51 Auto-detect and strip single top-level directory prefix when browsing archives
- 81f5057 Bump archives to v0.2.2
- e36a924 Clean up review feedback: use path.Ext for extension checks, remove dead getStripPrefix, add openArchive tests
- b68184c Fix composer dist URL rewriting and browse source for extensionless filenames