GeezerVison

• Serve Git repositories and LFS objects from a local cache, FreeBSD repositories at /freebsd/{name}/, additional Maven repositories at /maven/{name}/, the Go vulnerability database at /go/vulndb, and npm attestations.
• Host generic files next to npm and Composer packages, and mirror PyPI, conda, Composer, Helm, Homebrew, Julia, CRAN and Swift packages. proxy mirror --latest mirrors only the newest version.
• Apply cooldown to Go modules and Maven and show the cooldown configuration in the web UI. When publish times are missing or unreadable, return an error instead of unfiltered metadata.
• Stream artifacts to the client while a cache miss is being stored, and cache more metadata rewrites. SQLite reads use a separate read-only pool, and the Go memory limit is set from the cgroup limit.
• Instances sharing a Postgres database fetch each cache miss once and share rate-limit holds.
• Match denylist entries using each ecosystem's name normalization. Verify Helm charts, mirrored files and sha512 OCI digests. Send registry tokens only to the token service's own registry and limit where upstream credentials are sent.
• Build with Go 1.27.3 and update registries to v0.13.0, enrichment to v0.7.5, purl to v0.2.1 and golang.org/x/net to v0.62.0.

Before upgrading:

• The proxy exits at startup if a generic upstream with credentials in upstream.auth has no upstream.generic_paths (#581). config.example.yaml lists the GitHub API paths that mise requests.
• With cooldown on, the proxy withholds Go and Maven versions inside the window (#564, #573). When publish times are missing or unreadable, gem, Hex, PyPI and npm return 502 or 503 and compressed conda repodata returns 404 (#585, #605).
• Pushing a hosted file that already exists returns 409 for npm and Composer too; delete it first (#537).
• The proxy returns 502 for an uncached npm tarball when its packument is unreadable, for example when it exceeds metadata_max_size (#582). Previously it fetched the tarball unverified.
• Package paths with dot segments or ; return 400, and POST /api/mirror requires Content-Type: application/json (#554, #574).
• Mirror jobs now list versions from the configured upstream rather than the public registry (#548). The proxy sends registry tokens only to the token service's own registry (#576) and checks forward-proxy destinations against the private address rules (#577).
• Denylist entries now match each ecosystem's spellings of a name and may block versions that were served before (#555). After the upgrade, the proxy refetches some cached conda, Conan, CRAN, RPM, Debian, Maven, gem and Go entries one time (#555, #557, #578, #642).

Changelog

• 1979fb0 Accept Swift source repository PURLs in the denylist and retention rules (#641)
• eb5ff1a Accept only relative paths in a conda shard index's base URLs
• ce9ab47 Add --latest to mirror only the newest version (#631)
• 1887b12 Add extraVolumes, extraVolumeMounts and extraInitContainers to Helm chart
• a06b20f Address Docker guide review points
• fc29959 Answer 404 for packages the registry doesn't have
• 23f48c5 Answer HEAD on a cached artifact without opening it
• fd0d9a5 Answer PyPI download cooldown from stored upload times
• e97d4aa Answer npm dist-tag ls from the served packument
• 4d74ad6 Apply cooldown to Go modules
• 74f8eb3 Apply cooldown to Maven
• 77bd66a Bound Git requests by their body and response progress
• aa0460a Bound Hex and gem cooldown reads by the metadata size limit
• aa3adbf Bound the registry token and challenge caches
• d28c0be Build with Go 1.27.3 everywhere
• 1b641b6 Bump enrichment to v0.7.4
• 9374437 Bump git-pkgs/registries to v0.12.0
• 359ba32 Bump github.com/git-pkgs/archives from 0.9.0 to 0.10.0
• 96bd0f4 Bump github.com/git-pkgs/magic from 0.5.0 to 0.6.0
• ce60611 Bump github.com/klauspost/compress from 1.20.1 to 1.20.3
• c08c25f Bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0
• b31ee70 Bump modernc.org/sqlite from 1.60.1 to 1.61.0
• 2a4ce12 Bump purl to v0.1.24 and drop redundant Swift lowercasing
• c3d0448 Bump registries for streamed npm packuments
• 42584c3 Bump registries to v0.11.1
• 910dadc Bump registries to v0.11.1
• d154757 Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1
• 605e27d Cache Git LFS objects
• 10fc27b Cache Go modules that differ only in case apart (#540)
• 3afbf24 Cache Helm and PyPI metadata rewrites
• 0169214 Cache conda packages per subdir
• f4cab2d Cache cooldown metadata rewrites for a minute
• 58e87c2 Cache cooldown rewrites for a 24th of the shortest cooldown
• 8ea75a3 Check cached Swift documents against their digest and resolve source PURLs
• 16ae3de Check mirrored files against their own SHA-256
• d9d3bd2 Check unhashed FreeBSD packages against the denylist
• 9500c5b Check upstream destinations sent through a forward proxy
• c0320c7 Clearing a record and queueing its file for deletion now happen in one transaction, so a failed queue write keeps the record instead of leaving a file nothing points at. Eviction drops the queue entry again once it has deleted the file itself.
• 3fcdb0b Close the SQLite test databases in the lock tests
• d02ad9b Coordinate instances sharing a Postgres database
• 4094b0f Create breaking monthly releases as drafts
• d4addfe Cut a patch release on the 1st of each month
• cdd3bea Cut the relay connection on any upstream copy error
• 9babab7 Describe archived CRAN versions as fetched unchecked
• f81274b Describe how Maven publish times are read
• 2928b5c Detect Helm's cooldown check in the handler coverage test
• e6c4a3e Document Maven cooldown
• 0ed360b Document how pull requests are reviewed and merged
• 4402075 Document serving cached downloads when publish times can't be read
• f0548d1 Document that the OCI handler is pull-only
• bcda24e Document timeouts for large LFS objects
• 9037d93 Document using proxy in Docker builds
• b6d7575 Don't fetch npm tarballs whose packument can't be read
• f77d299 Don't hide upstream 404 and 401/403 behind stale metadata
• 16bd0e5 Drop FillVersionPublishedAt until it has a caller
• 6c9505f Drop cached metadata that fails its integrity check
• db8a60e Drop the Homebrew sibling formulae filter
• cb566d5 Expire cooldown rewrites when a withheld version becomes available (#638)
• 8ed0edb Extract portable npm metadata transformations
• a787913 Fail closed in Go cooldown and key stored times by escaped path
• 09e41d0 Fail closed in gem, Hex and PyPI cooldown
• 842fa21 Fetch archived CRAN versions unchecked and drop the version dedup
• 84111c3 Fetch each cache miss once across instances
• 2ea8915 Filter gzipped gem compact indexes under cooldown
• 8dcd194 Fix npm search routing and abbreviated packuments under cooldown
• 3fd79cc Fuzz the PACKAGES.rds decoder
• 371cefa Harden the Git LFS cache
• d2c6587 Hash path-based metadata cache keys
• fb346ae Hold an unrecorded object for a client reading its stored copy
• d13b8be Host generic files and share one push path across hosted ecosystems
• 1fbee10 Ignore path parameters when checking for dot segments
• 391c5b7 Index artifacts by filename and shorten Julia comments
• 9a5e5a2 Keep a slow client from holding back a streamed miss
• 64162c7 Keep detached lease waits alive and stop waiting on a failed fetch
• fd4f067 Keep legacy metadata whose blob matches its digest
• 10bc2f3 Keep rewritten metadata gzip-only and longer with cooldown
• b8a4cf...

Proxy adds hosted npm and Composer packages, age-based cache retention, container image mirroring and schedules, and cache deletion through the API and web UI.

• Add Chef Supermarket and Arch Linux proxy support, Go checksum database proxying, private npm and Composer package routes, and OCI referrers support.
• Cache more Maven, Conan, and generic download artifacts. Improve archive browsing and support additional SBOM mirror inputs.
• Reduce npm and Composer metadata processing costs, gzip cached responses, preserve metadata on upstream 304 responses, and stream Conda cooldown filtering.
• Verify registry-provided artifact checksums, abort corrupt cached responses, limit upstream artifact sizes, restrict credential forwarding, and sandbox upstream content.
• Separate artifact and metadata cache metrics, expose more failure details, respect upstream rate limits, and make response and artifact download timeouts configurable.
• Update Go dependencies, including registries v0.11.0, enrichment v0.7.3, and purl v0.1.22.

Before upgrading:

• Gradle build cache uploads are disabled by default. Instances that accept CI uploads need gradle.build_cache.read_only: false or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false.
• storage.max_size now includes cached metadata. Existing installations may evict metadata or artifacts when the combined total exceeds the configured limit.
• Cache hit and miss metrics now include a kind label for artifact or metadata; check custom Prometheus queries and dashboards.
• proxy mirror returns a nonzero exit status when a package fails and refuses CLI mirroring while scanning is enabled.

Changelog

• 086abeb A database refresh now fetches the signature as well and stores it for that exact database content, keyed by its digest. A signature requested later, after the upstream has moved on, is still the one for the database the client got, and a refresh that returns the same bytes keeps the cached signature, so it is served offline too. The database is fetched once more after its signature to catch a mirror that swapped both in between. A missing signature is remembered per database, so official repos answer 404 without going upstream.
• 5ce445f A database signature that belongs to an older database is no longer served. When the database was refreshed and the signature refetch fails, the proxy answers 404 or 502 instead of falling back to the cached signature, which pacman would reject. Paths with a decoded ? or # are refused, since they would fetch one file and cache it under another name. The README now says that pacman -Sy only works offline with cache_metadata enabled.
• d7a6a89 Abort blob writes when the download fails
• 6857fad Abort the response when a cached artifact fails its integrity check (#504)
• bf0c784 Add Chef Supermarket proxy support for Berkshelf and Policyfiles (#518)
• ea696a7 Add a hosted config block and a bearer token check for writes
• 599b2e1 Add a metadata_dates table for rewritten metadata dates
• b7b7a64 Add a size limit for upstream artifacts
• b664530 Add age-based retention for cached artifacts (#428)
• d643836 Add opt-in retention for generic artifacts (#513)
• 832a441 Add package routes for private Composer and npm registries (#426)
• 80fdd16 Add push, list and delete commands for hosted packages
• 9532c6a Add upstream.go_sumdbs_offline for networks where only the proxy has egress
• 513687c Answer uncached referrers tags with 404 when the upstream is down
• 111b271 Arch Linux pacman repositories are now proxied at /arch/{name}/, with geo.mirror.pkgbuild.com as the built-in archlinux repository and more mirrors configurable under upstream.arch. Databases and file lists go through the metadata cache byte for byte, and a database signature is refreshed together with its database so the two always match. Packages and package signatures go to the artifact cache and stay available offline. The path is passed through unchanged, so Arch Linux ARM's $arch/$repo layout works too. README, config example, configuration docs and the dashboard have pacman instructions.
• 094a962 At most 64 fetches keep running after their client hangs up; beyond that a fetch is tied to its client again, so nobody can start an unbounded number of large downloads and leave. A server test now checks that client requests actually get the detach marker.
• fdd0c81 Build in version-pinned paths for well-known download hosts
• cbb1978 Bump git-pkgs/integrity to v0.2.0
• fc312a0 Bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.7
• b8d5cf4 Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.2
• ba61c45 Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0
• b884a5f Bump golang.org/x/sync from 0.23.0 to 0.24.0
• 5683349 Cache Conan 2 recipe and package archives (#431)
• 6051e20 Cache Maven checksums and signatures as artifacts
• 579ab79 Cache archive artifacts from Maven repositories (#425)
• d2a069f Cache configured version-pinned paths of generic upstreams (#424)
• 2e0f132 Check gofmt in CI and reformat (#528)
• 943009c Check that a data tile holds W records before caching it. Complete tiles are never fetched again, so a block page cached as one stayed for good.
• 9a93ce0 Check tile sizes before caching them
• dcf90cf Close the Composer download gaps left after #430 (#433)
• 854182f Concurrent clients could still end up with a database and a signature that don't belong together. Databases are now stored under their digest like signatures, so a cache row and its bytes always agree, also with several replicas on shared storage. Writes for one database are serialized, and the signature recovery shares the refresh with database requests, so a slow fetch can no longer store an older database over a newer one. When the cache write fails, the proxy serves the database the cache still describes. Unchanged databases are no longer rewritten, and a remembered missing signature is asked for again after the metadata TTL. The new tests force these interleavings with storage and upstream hooks.
• d56d436 Count cached metadata against max_size and evict it LRU (#507)
• 1584499 Cut memory use of npm metadata rewriting (#413)
• cff4b51 Date rewritten metadata by when its package started serving it
• 8903a8c Date rewritten metadata by when the rewrite was made
• 8bebc56 Delete cached artifacts through the API and the UI (#491)
• bf7d17d Derive cooldown metadata ETags from the rewrite's inputs
• c0b2a20 Document how pushed versions appear in package metadata
• 9eb88e4 Document upstream.go_sumdbs
• 5332f1f Don't count a tree fresh in the cache as the database answering. The probe never asked it, and during an outage that kept lookups from remembering the failure, so offline mode waited for the upstream timeout on every request until the tree expired.
• c1a597d Don't let the supported check hang, and don't take a block page for an answer
• 1d88be5 Enable storage retention for alpine
• 70ea921 Enable storage retention for cargo
• 9c75e59 Enable storage retention for composer
• ff4d5ca Enable storage retention for conan
• bffba28 Enable storage retention for conda
• 42b4303 Enable storage retention for cran
• 3297800 Enable storage retention for deb
• 20855ca Enable storage retention for gem
• c61cb51 Enable storage retention for golang (#442)
• f3505ad Enable storage retention for helm
• 743fbe5 Enable storage retention for hex
• 8f30c6d Enable storage retention for julia
• 90989eb Enable storage retention for maven (#444)
• 4b8678c Enable storage retention for npm (#440)
• dcfb9a8 Enable storage retention for nuget
• b40a3f0 Enable storage retention for oci (#443)
• 48edbb8 Enable storage retention for pub
• 18f410d Enable storage retention for pypi (#441)
• 42f459e Enable storage retention for rpm
• f8ca190 Enable storage retention for swift
• ea4c1ba Encode file paths when loading files in the source browser
• bdec446 Exit with s...

Changelog

• 36fe6ab Add a Grafana dashboard
• 866e559 Add cooldown package pattern overrides (#407)
• b40a50a Add storage.cache_artifacts to serve artifacts without storing them (#387)
• 0501534 Add the /ui/analytics page
• 3655000 Attribute requests to a caller and a client tool
• 4827cb9 Batch cache hit writes
• 8cc63c4 Cache rewritten npm and Composer metadata (#402)
• dc1fc5b Coalesce concurrent metadata fetches (#400)
• 4b1625b Copy inherited Composer fields shallowly when expanding (#401)
• 739bba3 Drop unused registry from TestUpdateEcosystemStatsSumsAliasedRows
• 129e6c6 Filter cached packages by ecosystem using pills (#319)
• 76db945 Install development tools directly in CI (#398)
• 55ed6b9 Keep hit timestamps from moving backwards
• 9dff45d Merge remote-tracking branch 'origin/main' into analytics-2-ecosystem-stats
• fb04bb8 Name every mounted route in requestEcosystem
• 4ebd805 Per-ecosystem cache and download statistics
• 4b8c5a8 Report the per-ecosystem breakdown from GET /stats
• 4261bcb Show the by-client table regardless of ui_request_sources
• f60772d Support HTTP byte-range requests for local file cached artifact downloads (#404)
• 34985b5 Support npm content-addressed tarball URLs
• 107301c build(deps): bump alpine from 3.24.1 to 3.24.2 (#397)

Changelog

• c1f420a Add and align CI security and dependency automation
• 73a9863 Assert omitted Helm releases are not downloadable
• 8d3dacf Bump azure/setup-helm from 4.3.1 to 5.0.1 (#332)
• f0580d9 Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 (#331)
• 0935c15 Bump github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.2 (#336)
• b2817dc Bump github.com/aws/aws-sdk-go-v2/config from 1.33.2 to 1.33.4 (#356)
• f29c916 Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.61.0 to 1.64.0 (#334)
• 2ae6213 Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.64.0 to 1.65.0 (#357)
• 2aad8bf Bump github.com/git-pkgs/spdx from 0.3.1 to 0.3.2 (#355)
• 66a6d81 Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 (#330)
• 83e7e80 Bump golang.org/x/sync from 0.22.0 to 0.23.0 (#335)
• 4436130 Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#346)
• dc1ce8d Bump modernc.org/sqlite from 1.57.0 to 1.58.0 (#337)
• 7e4b13c Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#333)
• b83bc0e Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#354)
• 436155e Clear before deleting on eviction, and requeue failed reclaims
• 7835f7a Discard a stale cache entry under the coalescing key (#348)
• 1001cd7 End an eviction pass that cannot evict anything
• 499033b Exit non-zero when mirror denylist is invalid
• 2736fe0 Fall back to embedded build info for Version (#352)
• c895e5b Fix NuGet cooldown enforcement for listings and downloads (#340)
• eb45cd5 Fix duplicate fetches and 502s on concurrent cache misses (#329)
• 8f09c1d Fix the handler test build
• 4ce6c37 Give each fetch its own storage path
• eb43505 Log and count requests aborted mid-relay
• 2fef446 Mark Helm as completed in registry table (#316)
• 8b1e7cb Omit malformed Helm chart releases instead of failing the index
• 0bab9bd Separate OCI request timeout from readiness probes in loopback test (#347)
• 00a49e2 Standardize the README license footer
• 0089917 Stop writing fileblob's .attrs sidecar (#328)
• e635a62 Test that GCS Delete of a missing object returns nil
• 5f0f3b0 Update enrichment to v0.7.2 (#394)
• 51caa17 Update git-pkgs dependencies (#396)
• 65f2bf5 Widen wall-clock bound in flaky probe timeout test
• 94c11b4 align data in the dashboard table more nicely (#318)
• d8a8111 apply review changes
• d14b240 build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
• 3724c93 build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
• 15d5ac0 build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0
• ccc80f8 build(deps): bump github.com/aws/aws-sdk-go-v2/config
• 8bbe117 build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr
• eedc290 build(deps): bump github.com/git-pkgs/archives from 0.7.0 to 0.7.1
• 2a35d3d build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0
• ceee79f build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
• 3611ff2 build(deps): bump github.com/git-pkgs/vers from 0.7.0 to 0.7.1
• 442b591 build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0
• 468e9e5 build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
• fbb89c9 build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0
• bb2205a docker host is trimmed too much in the docs (#317)
• 658664a docs(debian): drop a stray space in a test comment
• 46faf76 docs(debian): trim comments on the named-repositories change
• 9788aa7 feat(debian): report a misspelled repository name
• 8a51d04 feat(debian): serve additional APT archives at /debian/{name}/
• 548a50d feat: add exact-version package denylist
• c4f34b0 fix pnpm audit
• e40c78f fix(conda): preserve gzip for large repodata indexes
• 3db2cd5 fix(database): set connection pool limits for Postgres (#350)
• 8696a25 fix(handler): let the ProxyCached path request a per-call Accept-Encoding (#324)
• 429e745 fix(helm): support OCI references in HTTP repository indexes
• a55f42e fix(mirror): match cached artifacts by resolved filename
• be2a1f0 fix(server): tune the shared upstream transport defaults (#351)
• ac261cc fix: centralize pass-through response relaying
• ba45227 test(database): drop every schema table in the Postgres fixture (#349)
• e738a21 test(handler): stop asserting on an upstream connection the proxy abandons

Changelog

• a45befd Bump Dockerfile builder to golang:1.26.7-alpine (#315)

Changelog

• 7f8ccab Accept inline SBOM documents in mirror API (#294)
• 4b9b401 Add Alpine APK repository proxy support (#293)
• b5ee6dd Add ECR auto-refreshing upstream authentication (#278)
• 41ae7d6 Add GCS storage backend with lighter dependencies (#179)
• 230fa7b Add Helm chart (#250)
• b67cfb1 Add Homebrew JSON API and bottle proxy support (#254)
• e4fbf3f Add JSONL access logging (#269)
• 7743417 Add Swift package registry support (#259)
• 30e54a1 Add generic HTTP download proxy for GitHub release assets (mise/aqua) (#302)
• 5499837 Add pre-cache artifact scanning hook (trivy/ClamAV/Wiz/custom) (#298)
• 7e1cb68 Add upstream.npm_full_metadata to serve publish times without cooldown (#297)
• 5b92e44 Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#284)
• 06baf43 Bump github.com/CycloneDX/cyclonedx-go from 0.11.0 to 0.12.0 (#311)
• ca9eed9 Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.32.40 (#310)
• 5492ab5 Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.60.7 to 1.61.0 (#308)
• a101182 Bump github.com/git-pkgs/cooldown from 0.1.1 to 0.2.0 (#287)
• 50f5561 Bump github.com/git-pkgs/enrichment from 0.6.5 to 0.7.0 (#285)
• 12ad4ec Bump github.com/git-pkgs/purl to v0.1.17 (#273)
• cd0aaf0 Bump github.com/git-pkgs/purl to v0.1.19 (#291)
• 5508872 Bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 (#286)
• a0b87bc Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#299)
• eb6e280 Bump intra-org dependencies for v0.8.0 (#314)
• 062d616 Bump modernc.org/sqlite from 1.56.0 to 1.57.0 (#289)
• 17446b4 Bump registries to v0.8.1 (#277)
• 879e89e Correct cache metrics (#272)
• 87bf742 Document package support issue drafts
• 272e6d9 Lint and dead-code cleanup (#279)
• f43aa9d Make built-in upstream URLs configurable (#255)
• 76fcd07 Read the stored publish time in the npm cooldown download check (#296)
• 49a68f1 Record proxy request metrics (#270)
• 5cdbc89 Remove supporting-module-issues.md
• cad1a92 Report upstream circuit breaker state in /health and /metrics (#275)
• c1f09e7 Show build information in web UI (#257)
• 3b5dc88 Support PyPI Simple API JSON responses (#290)
• f0e6e11 Upgrade to Go 1.26.6 (#246)
• c5e1483 Use header constants across the handler package (#301)
• d950919 Use shared artifacts at cache boundaries (#267)
• 1a814c7 Use shared integrity verification (#260)
• 088027c feat: add Helm repository proxy support (#268)
• c188a54 fix(handler): preserve upstream content-encoding for cached metadata (#304)
• 1e3369c fix(oci): cache tag lists and normalize manifest variants (#280)
• f0d90cd fix(oci): retry transient token requests (#281)
• 78b29e5 fix: cache PyPI metadata for filtered versions (#258)

Changelog

• 3e53469 Bump git-pkgs dependencies (#253)
• 41c033a Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#252)
• ed54005 Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#251)
• 30e4052 Document upstream.debian in README and config.example.yaml (#237)
• 4fa903e Enforce cooldown on artifact downloads (#240)
• 6fcc57c Optimize cached artifact serving (#245)
• a17bdc7 Sign published container images (#227)
• 538a15d fix(container): serve cached images when upstream is unavailable (#199)
• 14f80ce fix(npm): use combined Accept header to support Artifactory upstreams (#241)
• bbea63f fix(upstream): apply authentication through shared transport (#198)
• 849500d fix: decode PURL percent-encoding in versions and package paths (#244)

Changelog

• 7dbf13e Avoid repeated content type path lookup
• a5d4567 Bump actions/checkout from 7.0.0 to 7.0.1 (#218)
• d0f9319 Bump dependencies ahead of v0.7.0 (#235)
• b56a1fe Bump docker/login-action from 4.4.0 to 4.5.0 (#220)
• 5f993e3 Bump docker/login-action from 4.5.0 to 4.6.0 (#232)
• 31ecca8 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#221)
• 9a9a821 Bump modernc.org/sqlite from 1.54.0 to 1.55.0 (#219)
• 1057ee9 Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#217)
• 36f3a51 Detect content types when browsing files
• 800ffc6 Make Debian upstream repository configurable. (#229)
• bc1ea30 Multi-platform build (linux/amd64 and linux/arm64) (#230)
• 63f0efd fix(pypi): resolve name and version for PEP 658 metadata sidecars (#222)

Changelog

• a8c0562 Bump actions/setup-go from 6.4.0 to 6.5.0
• 60c72be Bump actions/setup-go from 6.5.0 to 7.0.0
• df3ad91 Bump docker/build-push-action from 7.2.0 to 7.3.0
• ea4eea4 Bump docker/login-action from 4.2.0 to 4.3.0
• df997e5 Bump docker/login-action from 4.3.0 to 4.4.0
• 383d208 Bump docker/metadata-action from 6.1.0 to 6.2.0
• 44041d0 Bump git-pkgs archives, enrichment, purl, registries, vulns (#215)
• 41ef279 Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
• 96e1132 Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
• 13ae397 Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
• 5ae5eab Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
• ec3cc35 Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
• cdf0756 Bump golang from 1.26.4-alpine to 1.26.5-alpine
• 1a18dd4 Bump golang.org/x/net to v0.56.0
• f7b5dd2 Bump golang.org/x/sync from 0.21.0 to 0.22.0
• 9042269 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#216)
• defe1ec Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
• c3f1577 Bump modernc.org/sqlite from 1.53.0 to 1.54.0
• 81d19b7 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
• d9b7a30 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
• cdbd1a9 Canonicalize cooldown lookup PURLs to match config
• 787b76d Fix Composer 404 on minified metadata and add debug logging
• be15a0f Fix cooldown overrides for scoped package PURLs
• 0ae6306 Make upstream HTTP timeout configurable
• 98150ea Name empty path validation subtest
• 5b959d1 Preserve Go proxy fallback for missing modules
• 4146596 Validate filesystem storage paths
• cf37411 fix(upstream): honor npm and Cargo overrides (#200)
• 532e492 fix: proper handling of upstream registry 404s (#209)

Changelog

• cb18df5 Bump actions/checkout from 6.0.2 to 6.0.3 (#163)
• 795edb4 Bump actions/checkout from 6.0.3 to 7.0.0 (#175)
• d968f4a Bump alpine from 3.23.4 to 3.24.0 (#166)
• 22c9df6 Bump alpine from 3.24.0 to 3.24.1 (#172)
• bb214bb Bump git-pkgs and third-party dependencies (#177)
• fc245fd Bump github.com/git-pkgs/enrichment from 0.2.3 to 0.3.0 (#165)
• 50ea557 Bump gocloud.dev from 0.45.0 to 0.46.0 (#164)
• e289fae Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#170)
• 8aa6d75 Bump modernc.org/sqlite from 1.51.0 to 1.52.0 (#171)
• f4a8c56 Fix package redirection to '/ui/packages' (#169)
• b2011c0 Log actual database config instead of sqlite path (#176)
• ca25149 fix(composer): resolve *-dev versions from the ~dev metadata file (#174)