.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.25'
 

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
           cache: false

.github/workflows/swagger.yml

@@ -17,7 +17,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.25'
 

.github/workflows/zizmor.yml

@@ -26,4 +26,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

internal/handler/composer.go

@@ -316,10 +316,6 @@ func (h *ComposerHandler) handleDownload(w http.ResponseWriter, r *http.Request)
 	// stable and dev versions resolve correctly.
 	metaURLs := h.metadataURLsForVersion(vendor, pkg, version)
 
-	h.proxy.Logger.Debug("resolving download URL",
-		"package", packageName, "version", version,
-		"metadata_urls", metaURLs)
-
 	var downloadURL string
 	for _, metaURL := range metaURLs {
 		url, err := h.findDownloadURLFromMetadata(r.Context(), metaURL, packageName, version)
@@ -335,17 +331,10 @@ func (h *ComposerHandler) handleDownload(w http.ResponseWriter, r *http.Request)
 	}
 
 	if downloadURL == "" {
-		h.proxy.Logger.Debug("version not found in any metadata source",
-			"package", packageName, "version", version,
-			"tried_urls", metaURLs)
 		http.Error(w, "version not found", http.StatusNotFound)
 		return
 	}
 
-	h.proxy.Logger.Debug("resolved download URL",
-		"package", packageName, "version", version,
-		"download_url", downloadURL)
-
 	result, err := h.proxy.GetOrFetchArtifactFromURL(r.Context(), "composer", packageName, version, filename, downloadURL)
 	if err != nil {
 		h.proxy.Logger.Error("failed to get artifact", "error", err)
@@ -383,9 +372,6 @@ func (h *ComposerHandler) metadataURLsForVersion(vendor, pkg, version string) []
 // An error is returned only on transport failure; a missing document (non-200)
 // or a missing version both yield an empty string so the caller can fall back.
 func (h *ComposerHandler) findDownloadURLFromMetadata(ctx context.Context, metaURL, packageName, version string) (string, error) {
-	h.proxy.Logger.Debug("fetching upstream metadata for download lookup",
-		"url", metaURL, "package", packageName, "version", version)
-
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, metaURL, nil)
 	if err != nil {
 		return "", err
@@ -397,9 +383,6 @@ func (h *ComposerHandler) findDownloadURLFromMetadata(ctx context.Context, metaU
 	}
 	defer func() { _ = resp.Body.Close() }()
 
-	h.proxy.Logger.Debug("upstream metadata response",
-		"url", metaURL, "status", resp.StatusCode)
-
 	if resp.StatusCode != http.StatusOK {
 		return "", nil
 	}
@@ -409,27 +392,7 @@ func (h *ComposerHandler) findDownloadURLFromMetadata(ctx context.Context, metaU
 		return "", err
 	}
 
-	// Expand minified Composer v2 format so that inherited fields (including
-	// dist) are present on every version entry. Without this, versions that
-	// inherit dist from a previous entry will appear to have no download URL.
-	if metadata["minified"] == "composer/2.0" {
-		h.proxy.Logger.Debug("expanding minified metadata", "url", metaURL)
-		if packages, ok := metadata["packages"].(map[string]any); ok {
-			for pkgName, versions := range packages {
-				versionList, ok := versions.([]any)
-				if !ok {
-					continue
-				}
-				packages[pkgName] = expandMinifiedVersions(versionList)
-			}
-		}
-	}
-
-	url := h.findDownloadURL(metadata, packageName, version)
-	h.proxy.Logger.Debug("download URL lookup result",
-		"url", metaURL, "package", packageName, "version", version,
-		"download_url", url)
-	return url, nil
+	return h.findDownloadURL(metadata, packageName, version), nil
 }
 
 // findDownloadURL finds the dist URL for a specific version in metadata.