Andrew Nesbitt
d0f93196a3
Bump dependencies ahead of v0.7.0 ( #235 )
...
- github.com/git-pkgs/archives v0.4.0 -> v0.5.0
- github.com/git-pkgs/magic v0.1.0 -> v0.2.0
- github.com/git-pkgs/spdx v0.1.4 -> v0.3.0
- github.com/prometheus/client_golang v1.24.0 -> v1.24.1
- modernc.org/sqlite v1.55.0 -> v1.56.0
- golang.org/x/text v0.38.0 -> v0.40.0 (fixes GO-2026-5970)
2026-08-06 22:14:51 +01:00
Ondrej Kokes
bc1ea307f3
Multi-platform build (linux/amd64 and linux/arm64) ( #230 )
...
* wip
* pin to latest version, not commit
* test run
* Revert "test run"
This reverts commit 355e8f867e
2026-08-06 22:03:20 +01:00
dependabot[bot]
5f993e3961
Bump docker/login-action from 4.5.0 to 4.6.0 ( #232 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.5.0 to 4.6.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](06fb636fac...dbcb813823
2026-08-06 21:59:52 +01:00
Vincent Palatin
800ffc6b38
Make Debian upstream repository configurable. ( #229 )
...
* Refactor LoadFromEnv to use helpers
Avoid triggering the linter about the cyclomatic complexity of the LoadFromEnv
function in later changes by refactoring it to use setEnvString/setEnvBool
helpers.
No functional change, just collapse ~29 repetitive if-blocks into single-line
calls to two small helpers.
* Make Debian upstream repository configurable
Support overriding the Debian handler's upstream (e.g. Ubuntu archives)
via PROXY_UPSTREAM_DEBIAN or upstream.debian in the config file.
Tested with PROXY_UPSTREAM_DEBIAN=http://archive.ubuntu.com/ubuntu
to get Ubuntu Resolute packages.
2026-08-05 17:48:00 +01:00
wickedOne
63f0efd0e9
fix(pypi): resolve name and version for PEP 658 metadata sidecars ( #222 )
...
* resolve name and version for PEP 658 metadata sidecars
* fix(pypi): parse Windows installer and egg filenames separately
The bdist_wininst and bdist_msi layout joins the platform to the version
with a '.' rather than a '-', so treating .exe/.msi like a wheel folded
the platform into the version: foo-1.0.win32-py2.0.exe resolved to
version "1.0.win32". Eggs shared the problem, as setuptools' hyphen
escaping is not universal: aws-sdk-1.0.0-py3.11.egg resolved to name
"aws", version "sdk".
Give each format its own parser. Wheels keep the PEP 427
spec-guaranteed field positions, eggs locate the version relative to the
py{X.Y} interpreter field, and Windows installers strip the platform and
interpreter fields before splitting name from version.
A PEP 658 sidecar resolves to the same name and version as the
distribution it describes, so it is cached under that version. Browse and
compare took the first cached artifact without checking its extension,
handing openArchive plain text: a version pip had only fetched metadata
for reported hasCached and then 500'd.
Add firstBrowsableArtifact, replacing five duplicated selection loops,
and export PyPIMetadataSuffix so the suffix has a single definition.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-03 11:14:03 +01:00
Andrew Nesbitt
a7cad7828d
Merge pull request #224 from git-pkgs/magic-integration
...
Detect content types when browsing files
2026-08-01 11:26:51 +01:00
Andrew Nesbitt
7dbf13e345
Avoid repeated content type path lookup
2026-08-01 11:22:13 +01:00
Andrew Nesbitt
36f3a51c65
Detect content types when browsing files
2026-07-31 17:04:01 +01:00
dependabot[bot]
9a9a82176d
Bump modernc.org/sqlite from 1.54.0 to 1.55.0 ( #219 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.54.0 to 1.55.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 09:32:38 +01:00
dependabot[bot]
31ecca8cf1
Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 ( #221 )
...
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) from 1.23.2 to 1.24.0.
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
dependency-version: 1.24.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 09:31:21 +01:00
dependabot[bot]
1057ee926e
Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 ( #217 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](6599ee8b7a...6fc4b00623
2026-07-30 17:55:16 +01:00
dependabot[bot]
b56a1fed65
Bump docker/login-action from 4.4.0 to 4.5.0 ( #220 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](af1e73f918...06fb636fac
2026-07-30 17:52:35 +01:00
dependabot[bot]
a5d456790d
Bump actions/checkout from 7.0.0 to 7.0.1 ( #218 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](9c091bb21b...3d3c42e5aa
2026-07-30 17:14:36 +01:00
dependabot[bot]
90422697b8
Bump google.golang.org/grpc from 1.81.1 to 1.82.1 ( #216 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.81.1 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.82.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 12:16:27 +01:00
Andrew Nesbitt
44041d07a9
Bump git-pkgs archives, enrichment, purl, registries, vulns ( #215 )
2026-07-27 12:15:57 +01:00
Andrew Nesbitt
cf3741162f
fix(upstream): honor npm and Cargo overrides ( #200 )
...
* fix(upstream): honor npm and cargo overrides
* Preserve npm scope separators in download URLs
* Apply upstream auth to metadata requests
2026-07-26 19:11:24 +01:00
Tilian Honig
532e4925fe
fix: proper handling of upstream registry 404s ( #209 )
...
* fix: proper handling of upstream registry 404s
* fix: consistently return 404s for all artifact types
2026-07-26 19:07:46 +01:00
Andrew Nesbitt
6b767d0128
Merge pull request #211 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vers-0.3.0
...
Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
2026-07-23 17:01:32 +01:00
Andrew Nesbitt
4737777e80
Merge pull request #212 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.6.0
...
Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
2026-07-23 16:52:51 +01:00
Andrew Nesbitt
238c628b31
Merge pull request #213 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.54.0
...
Bump modernc.org/sqlite from 1.53.0 to 1.54.0
2026-07-23 16:47:03 +01:00
Andrew Nesbitt
ced9c1198b
Merge pull request #210 from git-pkgs/dependabot/github_actions/actions/setup-go-7.0.0
...
Bump actions/setup-go from 6.5.0 to 7.0.0
2026-07-23 16:45:51 +01:00
dependabot[bot]
13ae3970e9
Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
...
Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers ) from 0.2.6 to 0.3.0.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.2.6...v0.3.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
dependency-version: 0.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 15:42:03 +00:00
Andrew Nesbitt
7071d4fb0e
Merge pull request #214 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vulns-0.2.0
...
Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
2026-07-23 16:39:43 +01:00
dependabot[bot]
5ae5eab031
Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
...
Bumps [github.com/git-pkgs/vulns](https://github.com/git-pkgs/vulns ) from 0.1.6 to 0.2.0.
- [Commits](https://github.com/git-pkgs/vulns/compare/v0.1.6...v0.2.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vulns
dependency-version: 0.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 15:14:10 +00:00
dependabot[bot]
c3f1577017
Bump modernc.org/sqlite from 1.53.0 to 1.54.0
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.53.0 to 1.54.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.54.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 15:14:01 +00:00
dependabot[bot]
d9b7a30294
Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.5.7 to 0.6.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](192e21d79a...6599ee8b7a
2026-07-23 15:13:53 +00:00
dependabot[bot]
60c72be65e
Bump actions/setup-go from 6.5.0 to 7.0.0
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](924ae3a1cd...b7ad1dad31
2026-07-23 15:13:49 +00:00
Andrew Nesbitt
0a3b9e58f2
Merge pull request #201 from git-pkgs/fix-197-cooldown-scoped-purls
...
Normalize cooldown package PURL overrides
2026-07-17 18:18:54 -07:00
Andrew Nesbitt
cdbd1a9369
Canonicalize cooldown lookup PURLs to match config
...
NormalizedPackages runs config keys through purl.Parse().String(), which
applies per-type rules like lowercasing pypi names. The handler side was
building lookup keys with MakePURLString, which does not, so a config
entry for pkg:pypi/Django would be normalized to pkg:pypi/django and
never match the runtime key pkg:pypi/Django.
Route both sides through the same canonical form: a new
canonicalPackagePURL helper calls Normalize() on the constructed PURL
before stringifying, and all cooldown IsAllowed call sites use it.
2026-07-17 18:11:47 -07:00
Andrew Nesbitt
785c989f12
Merge pull request #206 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/enrichment-0.5.0
...
Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
2026-07-17 10:23:03 -07:00
dependabot[bot]
41ef27907e
Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
...
Bumps [github.com/git-pkgs/enrichment](https://github.com/git-pkgs/enrichment ) from 0.4.1 to 0.6.0.
- [Commits](https://github.com/git-pkgs/enrichment/compare/v0.4.1...v0.6.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/enrichment
dependency-version: 0.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-17 15:20:18 +00:00
Andrew Nesbitt
95b4e34ebe
Merge pull request #204 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/purl-0.1.14
...
Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
2026-07-17 08:19:09 -07:00
Andrew Nesbitt
61b91fbebb
Merge pull request #203 from git-pkgs/dependabot/go_modules/github.com/go-chi/chi/v5-5.3.1
...
Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
2026-07-17 08:18:12 -07:00
Andrew Nesbitt
4e0575a3ab
Merge pull request #202 from git-pkgs/dependabot/docker/golang-1.26.5-alpine
...
Bump golang from 1.26.4-alpine to 1.26.5-alpine
2026-07-17 08:15:36 -07:00
Andrew Nesbitt
a79ec25bc9
Merge pull request #205 from git-pkgs/dependabot/github_actions/docker/login-action-4.4.0
...
Bump docker/login-action from 4.3.0 to 4.4.0
2026-07-16 09:50:50 -07:00
dependabot[bot]
df997e5825
Bump docker/login-action from 4.3.0 to 4.4.0
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](c99871dec2...af1e73f918
2026-07-16 15:14:14 +00:00
dependabot[bot]
96e113213d
Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
...
Bumps [github.com/git-pkgs/purl](https://github.com/git-pkgs/purl ) from 0.1.13 to 0.1.14.
- [Commits](https://github.com/git-pkgs/purl/compare/v0.1.13...v0.1.14 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/purl
dependency-version: 0.1.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-16 15:14:12 +00:00
dependabot[bot]
ec3cc35795
Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
...
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi ) from 5.3.0 to 5.3.1.
- [Release notes](https://github.com/go-chi/chi/releases )
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md )
- [Commits](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1 )
---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
dependency-version: 5.3.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-16 15:14:06 +00:00
dependabot[bot]
cdf075695f
Bump golang from 1.26.4-alpine to 1.26.5-alpine
...
Bumps golang from 1.26.4-alpine to 1.26.5-alpine.
---
updated-dependencies:
- dependency-name: golang
dependency-version: 1.26.5-alpine
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-16 15:14:00 +00:00
Andrew Nesbitt
be15a0f826
Fix cooldown overrides for scoped package PURLs
2026-07-13 17:11:04 -07:00
Andrew Nesbitt
23364bd44a
Merge pull request #196 from ychampion/fix-go-proxy-not-found-status
...
fix(go): return 404 for missing modules
2026-07-12 23:32:24 +01:00
ychampion
5b959d14b9
Preserve Go proxy fallback for missing modules
...
Return the repository-standard not-found response when an upstream module is absent.
Constraint: GOPROXY advances to direct only after 404 or 410 responses.
Rejected: Preserve a handler-specific response body | sibling handlers consistently use not found.
Confidence: high
Scope-risk: narrow
Directive: Keep missing-artifact responses consistent across registry handlers.
Tested: go test ./internal/handler -run TestGoModuleDownloadUpstreamErrors -count=1; prior go test -race ./...; go build ./...; golangci-lint; go vet.
2026-07-12 18:48:39 +00:00
Andrew Nesbitt
18c711b4d3
Merge pull request #195 from git-pkgs/fix-filesystem-storage-path-validation
...
Validate filesystem storage paths
2026-07-09 17:46:32 +01:00
Andrew Nesbitt
98150ea576
Name empty path validation subtest
2026-07-09 17:41:05 +01:00
Andrew Nesbitt
41465968cb
Validate filesystem storage paths
2026-07-09 17:36:18 +01:00
Andrew Nesbitt
95bb9d897a
Merge pull request #193 from git-pkgs/dependabot/github_actions/goreleaser/goreleaser-action-7.2.3
...
Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
2026-07-09 17:19:29 +01:00
Andrew Nesbitt
16e778970f
Merge pull request #192 from git-pkgs/dependabot/github_actions/docker/login-action-4.3.0
...
Bump docker/login-action from 4.2.0 to 4.3.0
2026-07-09 16:41:34 +01:00
Andrew Nesbitt
a13e3ecaf1
Merge pull request #191 from git-pkgs/dependabot/go_modules/golang.org/x/sync-0.22.0
...
Bump golang.org/x/sync from 0.21.0 to 0.22.0
2026-07-09 16:41:08 +01:00
Andrew Nesbitt
c4f2b89290
Merge pull request #190 from git-pkgs/dependabot/github_actions/docker/build-push-action-7.3.0
...
Bump docker/build-push-action from 7.2.0 to 7.3.0
2026-07-09 16:40:19 +01:00
Andrew Nesbitt
bb9e560b46
Merge pull request #194 from git-pkgs/dependabot/github_actions/docker/metadata-action-6.2.0
...
Bump docker/metadata-action from 6.1.0 to 6.2.0
2026-07-09 16:39:00 +01:00
