Andrew Nesbitt
51caa17d5e
Update git-pkgs dependencies ( #396 )
2026-10-01 16:06:12 +01:00
Andrew Nesbitt
5f0f3b034a
Update enrichment to v0.7.2 ( #394 )
...
* Update ecosystems-go to v0.5.0
* Update enrichment to v0.7.2
2026-10-01 15:25:11 +01:00
Andrew Nesbitt
fb1630a27b
Merge pull request #395 from wickedOne/relay-test-flake
...
test(handler): fix TestRelayRoutes flake on /hex/packages and /gem/info
2026-10-01 15:12:59 +01:00
Wicliff Wolda
e738a21a2a
test(handler): stop asserting on an upstream connection the proxy abandons
...
TestRelayRoutes fails intermittently on CI with "write: connection reset
by peer" at the upstream handler's final Flush, on /hex/packages/demo and
/gem/info/demo.
Those two routes are the only ones in the table that fan out a second
upstream request: with cooldown enabled, the hex and gem handlers fetch
version timestamps concurrently with the artifact. The test server answers
that sidecar request with the same 64 KiB chunked 502, but the handler
returns as soon as it sees a non-200 and closes the body unread, so the
proxy drops the connection while the test server is still writing to it.
Whether the reset lands before or after the Flush is a scheduling race,
which is why it only surfaces on loaded runners.
The flush error says nothing about the response under test, which is
asserted on the downstream side, so stop reporting it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-01 15:30:22 +02:00
Andrew Nesbitt
b6f11db34c
Merge pull request #382 from wickedOne/npm-audit
...
fix pnpm audit
2026-10-01 12:09:27 +01:00
wickedOne
d8a811148c
apply review changes
2026-10-01 10:09:33 +02:00
wickedOne
c4f34b07b4
fix pnpm audit
2026-10-01 10:08:26 +02:00
Andrew Nesbitt
c3540fbcdf
Merge pull request #380 from abhinavgautam01/fix/response-relay-326
...
fix: centralize pass-through response relaying
2026-10-01 06:35:46 +01:00
Andrew Nesbitt
6f2bc9a9ce
Merge pull request #367 from montehurd/per-fetch-storage-path
...
Give each fetch its own storage path
2026-10-01 06:35:29 +01:00
Andrew Nesbitt
eb4350568c
Log and count requests aborted mid-relay
...
A truncated relay panics with http.ErrAbortHandler, which skipped the
request log line, the request metrics and the access log entry.
2026-10-01 06:31:00 +01:00
montehurd
436155e50c
Clear before deleting on eviction, and requeue failed reclaims
...
Eviction deleted an object before checking its record still pointed at
it. If a refetch had moved the record, that object was queued and a
request that read the record earlier could still be opening it. Eviction
now clears first, skips the delete if the record moved, and queues the
object when the delete fails after a clear.
Reclaim queues a failed delete again, which moves it behind the rest, so
objects the backend keeps refusing cannot fill every batch.
Also drop the clearArtifactCache passthrough and ClearCachedArtifact's
unused context, note that only tests call ArtifactPath, and document that
max_size does not count objects waiting to be reclaimed.
2026-09-29 10:24:22 -07:00
abhinavgautam01
ac261cc34d
fix: centralize pass-through response relaying
2026-09-26 15:44:28 +05:30
Andrew Nesbitt
b00da65ffd
Merge pull request #379 from abhinavgautam01/fix/conda-repodata-gzip-321
...
fix(conda): preserve gzip for large repodata indexes
2026-09-26 09:25:22 +01:00
abhinavgautam01
e40c78f72a
fix(conda): preserve gzip for large repodata indexes
2026-09-25 21:12:00 +05:30
Andrew Nesbitt
b5fcee5c7e
Merge pull request #375 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/archives-0.7.1
...
build(deps): bump github.com/git-pkgs/archives from 0.7.0 to 0.7.1
2026-09-24 17:35:29 +01:00
dependabot[bot]
eedc2908df
build(deps): bump github.com/git-pkgs/archives from 0.7.0 to 0.7.1
...
Bumps [github.com/git-pkgs/archives](https://github.com/git-pkgs/archives ) from 0.7.0 to 0.7.1.
- [Commits](https://github.com/git-pkgs/archives/compare/v0.7.0...v0.7.1 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/archives
dependency-version: 0.7.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 16:22:59 +00:00
Andrew Nesbitt
36556945ed
Merge pull request #378 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.5
...
build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.4 to 1.33.5
2026-09-24 17:20:57 +01:00
dependabot[bot]
ccc80f8449
build(deps): bump github.com/aws/aws-sdk-go-v2/config
...
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2 ) from 1.33.4 to 1.33.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.4...config/v1.33.5 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.33.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 16:01:35 +00:00
Andrew Nesbitt
10ebb52aa2
Merge pull request #377 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vers-0.7.1
...
build(deps): bump github.com/git-pkgs/vers from 0.7.0 to 0.7.1
2026-09-24 17:00:20 +01:00
Andrew Nesbitt
7379f4721e
Merge pull request #376 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.59.0
...
build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0
2026-09-24 16:59:53 +01:00
Andrew Nesbitt
43a91ec20d
Merge pull request #374 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/magic-0.4.0
...
build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0
2026-09-24 16:59:08 +01:00
Andrew Nesbitt
4f80102529
Merge pull request #373 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/registries-0.9.2
...
build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
2026-09-24 16:58:40 +01:00
Andrew Nesbitt
e4682c8ec1
Merge pull request #372 from git-pkgs/dependabot/go_modules/golang.org/x/net-0.59.0
...
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
2026-09-24 16:58:01 +01:00
Andrew Nesbitt
a4702d0814
Merge pull request #371 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/ecr-1.66.0
...
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.65.0 to 1.66.0
2026-09-24 16:57:32 +01:00
Andrew Nesbitt
e26c2d13a7
Merge pull request #370 from git-pkgs/dependabot/github_actions/docker/build-push-action-7.4.0
...
build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
2026-09-24 16:56:43 +01:00
Andrew Nesbitt
a7cccff3bc
Merge pull request #369 from git-pkgs/dependabot/github_actions/docker/setup-qemu-action-4.4.0
...
build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0
2026-09-24 16:55:20 +01:00
Andrew Nesbitt
c3fc32b164
Merge pull request #368 from git-pkgs/dependabot/github_actions/docker/setup-buildx-action-4.4.1
...
build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
2026-09-24 16:54:52 +01:00
dependabot[bot]
3611ff2fa2
build(deps): bump github.com/git-pkgs/vers from 0.7.0 to 0.7.1
...
Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers ) from 0.7.0 to 0.7.1.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.7.0...v0.7.1 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
dependency-version: 0.7.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:15:18 +00:00
dependabot[bot]
fbb89c9d78
build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.58.0 to 1.59.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.58.0...v1.59.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.59.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:15:14 +00:00
dependabot[bot]
2a35d3df90
build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0
...
Bumps [github.com/git-pkgs/magic](https://github.com/git-pkgs/magic ) from 0.3.1 to 0.4.0.
- [Release notes](https://github.com/git-pkgs/magic/releases )
- [Commits](https://github.com/git-pkgs/magic/compare/v0.3.1...v0.4.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/magic
dependency-version: 0.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:15:01 +00:00
dependabot[bot]
ceee79f123
build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
...
Bumps [github.com/git-pkgs/registries](https://github.com/git-pkgs/registries ) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/git-pkgs/registries/releases )
- [Commits](https://github.com/git-pkgs/registries/compare/v0.9.1...v0.9.2 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/registries
dependency-version: 0.9.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:14:57 +00:00
dependabot[bot]
468e9e564d
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.58.0 to 0.59.0.
- [Commits](https://github.com/golang/net/compare/v0.58.0...v0.59.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.59.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:14:52 +00:00
dependabot[bot]
8bbe117e84
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr
...
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2 ) from 1.65.0 to 1.66.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.65.0...service/s3/v1.66.0 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
dependency-version: 1.66.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-24 15:14:48 +00:00
dependabot[bot]
d14b240654
build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
...
Bumps [docker/build-push-action](https://github.com/docker/build-push-action ) from 7.3.0 to 7.4.0.
- [Release notes](https://github.com/docker/build-push-action/releases )
- [Commits](53b7df96c9...c3c9e263c2
2026-09-24 15:13:54 +00:00
dependabot[bot]
15d5ac09b8
build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0
...
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](1f40c72289...9901266195
2026-09-24 15:13:45 +00:00
dependabot[bot]
3724c93626
build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
...
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) from 4.3.0 to 4.4.1.
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](37fe631027...f87e5991a6
2026-09-24 15:13:32 +00:00
montehurd
4ce6c37bd9
Give each fetch its own storage path
...
Every fetch of an artifact wrote one path, so fetches with different URLs
or digests, which do not share a coalescing key, could overwrite each
other's bytes, serve the wrong ones, or delete them on a digest mismatch
while the other was about to open them.
storeArtifact now writes {ecosystem}/{name}/{version}/{fetch id}/{filename},
with a random id per fetch. Most ecosystems learn the digest only after
the fetch, and storage has no rename, so the id is the one rule that fits
all of them. Existing records keep their paths and stay readable. On a
file:// bucket, Delete now removes an emptied fetch directory, which
fileblob leaves behind, and no other directory, since another fetch may
be creating its own inside it.
A path a record stops pointing at is queued in pending_deletes rather
than deleted, since a request that read the record may still open it. A
loop deletes queued paths after max(1h, direct_serve_ttl), whether or not
max_size is set. UpsertArtifact and clears apply only if the record still
holds the path the caller read, so racing commits each queue the path
they replaced and a clear never orphans a newer commit. Eviction still
deletes inline, and counts space as freed only when the record still
pointed at what it deleted.
2026-09-23 16:14:43 -07:00
Andrew Nesbitt
e635a62e2c
Test that GCS Delete of a missing object returns nil
2026-09-23 17:26:42 +01:00
Andrew Nesbitt
37ef25b718
Merge pull request #363 from montehurd/bound-eviction-pass
...
End an eviction pass that cannot evict anything
2026-09-23 17:21:06 +01:00
Andrew Nesbitt
cd7d92e83b
Merge pull request #366 from abhinavgautam01/fix/mirror-cache-hit-342
...
fix(mirror): match cached artifacts by resolved filename
2026-09-23 17:19:18 +01:00
Andrew Nesbitt
00a49e2c40
Standardize the README license footer
2026-09-23 15:33:15 +01:00
abhinavgautam01
a55f42ec80
fix(mirror): match cached artifacts by resolved filename
2026-09-23 17:51:49 +05:30
Andrew Nesbitt
c1f420aafe
Add and align CI security and dependency automation
2026-09-23 10:53:57 +01:00
montehurd
50e5cc334e
Merge branch 'git-pkgs:main' into bound-eviction-pass
2026-09-22 14:30:58 -06:00
Andrew Nesbitt
e94805e9b5
Merge pull request #365 from git-pkgs/dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0
...
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0
2026-09-22 08:53:14 +01:00
Andrew Nesbitt
65f2bf52b1
Widen wall-clock bound in flaky probe timeout test
...
Loaded CI runners exceeded the 500ms bound; 5s still proves the
probe timeout fired instead of blocking on Store.
2026-09-22 08:46:40 +01:00
dependabot[bot]
442b591349
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0
...
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.45.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-09-22 07:38:12 +00:00
Andrew Nesbitt
f3445b505f
Merge pull request #361 from git-pkgs/helm-skip-malformed-releases
...
Omit malformed Helm chart releases instead of failing the index
2026-09-22 08:35:42 +01:00
Andrew Nesbitt
73a98636af
Assert omitted Helm releases are not downloadable
2026-09-22 08:35:20 +01:00
Andrew Nesbitt
e6271a8bd2
Merge pull request #364 from abhinavgautam01/docs/apt-denylist-pinning-358
...
docs: explain APT denylist limitations and version pinning
2026-09-22 08:31:01 +01:00
