Commit graph

Select branches

Hide pull requests

bump-deps

bump-deps-v0.4.0

bump-vulnerable-deps

bump-x-net

composer-unset-sentinel

cosign-signing

deps/pre-v0.7.0

enforce-max-size-eviction

extract-portable-npm-metadata

fix-197-cooldown-scoped-purls

fix-database-log-173

http-timeout-config

issue-186-container-offline-auth

issue-186-upstream-auth

issue-225-sign-container-image

julia-support

lint-cleanup

main

path-traversal-decode

perf/cache-hit-path

pin-vendored-assets

registries-v0.6.0-cooldown

ui-polish

use-database-package

validate-package-name

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#113

#114

#115

#117

#119

#120

#121

#122

#124

#125

#13

#135

#136

#137

#138

#139

#14

#140

#146

#148

#15

#150

#151

#152

#153

#154

#156

#157

#158

#159

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#174

#175

#176

#177

#178

#179

#18

#180

#181

#185

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#227

#229

#23

#230

#232

#233

#234

#235

#237

#238

#24

#240

#241

#243

#244

#245

#246

#25

#250

#251

#252

#253

#254

#255

#257

#258

#259

#26

#260

#267

#268

#269

#27

#270

#272

#273

#275

#277

#278

#279

#28

#280

#281

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#293

#294

#296

#297

#298

#299

#3

#30

#301

#302

#304

#307

#308

#31

#310

#311

#314

#315

#316

#317

#318

#319

#32

#324

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#340

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#399

#4

#40

#400

#401

#402

#404

#405

#406

#407

#408

#413

#417

#418

#419

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#430

#431

#433

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#462

#463

#464

#465

#468

#469

#47

#470

#471

#472

#473

#475

#476

#477

#479

#48

#481

#482

#483

#484

#485

#487

#488

#489

#490

#491

#492

#493

#494

#495

#496

#5

#50

#502

#503

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#515

#516

#518

#519

#520

#527

#528

#531

#533

#534

#537

#538

#539

#540

#541

#544

#545

#546

#547

#548

#549

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#561

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#610

#611

#612

#615

#616

#618

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#646

#647

#649

#650

#650

#651

#653

#654

#655

#656

#658

#659

#66

#660

#661

#662

#663

#664

#666

#667

#669

#67

#671

#672

#674

#675

#676

#677

#678

#679

#68

#680

#681

#682

#683

#684

#687

#687

#688

#688

#689

#689

#69

#690

#691

#692

#693

#694

#696

#697

#699

#7

#70

#701

#702

#702

#703

#703

#704

#705

#706

#706

#707

#708

#709

#709

#71

#72

#77

#79

#8

#80

#81

#82

#83

#84

#85

#87

#88

#89

#9

#90

#91

#92

#93

#93

#94

#95

#97

#98

v0.1.0

v0.10.0

v0.11.0

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Mono Color

• 994a9368d1 Keep the stale warning on filtered npm version metadata Simon Chrzanowski 2026-10-21 12:23:33 +02:00
• ed77e40816
  Log rewritten npm tarball URLs once per document (#538) simon chrzanowski 2026-10-21 12:12:05 +02:00
• cc6069d8a0
  Serve additional Maven repositories at /maven/{name}/ (#539) simon chrzanowski 2026-10-21 12:10:49 +02:00
• 10fc27b2b8
  Cache Go modules that differ only in case apart (#540) simon chrzanowski 2026-10-21 12:08:50 +02:00
• 82915f6924 Count fetches in progress toward git.max_size montehurd 2026-10-20 11:34:30 -07:00
• 160305b83d Cap git.max_repo_size at git.max_size montehurd 2026-10-20 11:34:30 -07:00
• 09ce83d8c5 Evict again once repositories in use are released montehurd 2026-10-20 09:40:31 -07:00
• 64a9c6307e Lock cache_dir against a second process montehurd 2026-10-19 13:17:04 -07:00
• 7c204b5f13 Apply refresh_wait to the ref check only montehurd 2026-10-19 13:16:55 -07:00
• f3e4e097ef Cap concurrent upload-pack processes and request body size montehurd 2026-10-19 13:16:44 -07:00
• eb9216528f Note that upstream.auth credentials reach every route to a host montehurd 2026-10-19 13:15:07 -07:00
• 696fa0b219 Document setting the Git rewrite through environment variables montehurd 2026-10-15 10:28:19 -07:00
• 2a74a94a9c Serve Git repositories from a local cache montehurd 2026-10-15 04:07:30 -07:00
• 844e2ae4f3 Test that Composer metadata doesn't hide upstream 404 and 401/403 Simon Chrzanowski 2026-10-20 21:34:07 +02:00
• f77d299b31 Don't hide upstream 404 and 401/403 behind stale metadata Simon Chrzanowski 2026-10-20 21:33:08 +02:00
• fe427c75e6 Cache Go modules that differ only in case apart Simon Chrzanowski 2026-10-20 21:27:48 +02:00
• 0f37d177bc Refuse Gradle Plugin Portal roots and unroutable repository names Simon Chrzanowski 2026-10-20 21:01:17 +02:00
• 376535eed3 Refuse every Maven Central group root as a repository name Simon Chrzanowski 2026-10-20 20:53:06 +02:00
• 8502f533b4 Serve additional Maven repositories at /maven/{name}/ Simon Chrzanowski 2026-10-20 20:43:16 +02:00
• bbbe54604e Log rewritten npm tarball URLs once per document Simon Chrzanowski 2026-10-20 20:24:30 +02:00
• 5b5a848c65
  Update Go dependencies (#534) v0.10.0 Andrew Nesbitt 2026-10-20 12:29:22 +01:00
• e82a096de1
  Update Go dependencies Andrew Nesbitt 2026-10-20 12:14:23 +01:00
• 03f0ebdd55
  Use shared archives browser for cached artifacts (#512) Andrew Nesbitt 2026-10-20 11:41:18 +01:00
• 8bebc560f7
  Delete cached artifacts through the API and the UI (#491) Giles Westwood 2026-10-20 11:35:08 +01:00
• ac8ebb8a12
  Return 404 when browsing archive directories as files Andrew Nesbitt 2026-10-20 11:09:07 +01:00
• 4aa927473b
  Use archives v0.9.0 release Andrew Nesbitt 2026-10-19 08:28:26 +01:00
• f329879ec1
  Pin archives to combined browser and Hex changes Andrew Nesbitt 2026-10-18 13:22:14 +01:00
• 7b53f0b482
  Use shared archives browser for cached artifacts Andrew Nesbitt 2026-10-18 12:51:35 +01:00
• 7760d0e3b1
  Load the cache delete script from a static file Giles Westwood 2026-10-19 21:37:54 +02:00
• c09fce4d29
  Delete cached artifacts through the API and the UI Giles Westwood 2026-10-15 16:42:18 +01:00
• a97b690858
  Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) Abhinav Gautam 2026-10-20 15:55:33 +05:30
• 6857fad20e
  Abort the response when a cached artifact fails its integrity check (#504) Бат-Орших 2026-10-20 18:22:50 +08:00
• ec2dfddeb6
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-20 15:43:27 +05:30
• d56d4367c9
  Count cached metadata against max_size and evict it LRU (#507) Christian Heim 2026-10-20 11:22:55 +02:00
• c5b3ce8c2e Read the seeded artifact's storage path from the database in the integrity test orshih6 2026-10-20 08:40:26 +00:00
• 5dfd01ea74
  Use shared sbom parser for mirror sources (#510) Andrew Nesbitt 2026-10-20 09:14:09 +01:00
• eca9d9e6eb
  Merge main into issue-461-metadata-eviction Andrew Nesbitt 2026-10-20 09:11:55 +01:00
• be86256ca9
  Merge main into use-shared-sbom Andrew Nesbitt 2026-10-20 09:00:40 +01:00
• 6d771a8d3a
  Use shared cooldown package-pattern policy Andrew Nesbitt 2026-10-20 08:53:22 +01:00
• e9b9edda5a Merge remote-tracking branch 'origin/main' into fix/mirror-exit-on-failure yunaremaia 2026-10-20 04:15:50 +00:00
• b87c75199e The last-access backfill now runs in the background in batches of 1000 instead of inside the migration, resuming after a restart, and until a row is backfilled eviction orders it by its write time. Christian Heim 2026-10-19 19:51:07 +02:00
• b94533dffe Evicting metadata now drops the row and queues its path in one transaction, so a crash before the blob is deleted leaves it to reclaim instead of orphaning it. Christian Heim 2026-10-19 19:41:20 +02:00
• e6c76b09e8 Show evicted metadata on the analytics page next to evicted artifacts, and cover the new counter in the metric surface test. Christian Heim 2026-10-19 19:39:59 +02:00
• 8e04713425
  Use shared registries size limits and rate-limit gate (#516) Andrew Nesbitt 2026-10-19 12:28:55 +01:00
• f600bed073
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-19 16:10:14 +05:30
• 4de5419256
  Make response write and artifact download timeouts configurable (#531) profiling 2026-10-19 15:54:21 +08:00
• d643836649
  Add opt-in retention for generic artifacts (#513) profiling 2026-10-19 15:43:57 +08:00
• d58dd3dc3d
  Update x/net and remove unused production helpers Andrew Nesbitt 2026-10-19 08:35:46 +01:00
• 1b0bafc69d
  Use sbom v0.1.7 release Andrew Nesbitt 2026-10-19 08:20:18 +01:00
• 5fe84cd995
  Use cooldown v0.3.0 release Andrew Nesbitt 2026-10-19 08:20:05 +01:00
• ef7112c1b7
  Use registries v0.10.0 release Andrew Nesbitt 2026-10-19 08:19:55 +01:00
• 76c0de59f7 Make response write and artifact download timeouts configurable ztzhou 2026-10-19 08:17:39 +08:00
• ad7f29919b
  Refuse package mirroring from the CLI while scanning is enabled (#493) Abhinav Gautam 2026-10-19 12:32:05 +05:30
• bf0c784feb
  Add Chef Supermarket proxy support for Berkshelf and Policyfiles (#518) Abhinav Gautam 2026-10-19 12:29:39 +05:30
• cf463c1141
  Only cache real pub archives on download (#520) Christian Heim 2026-10-19 08:58:13 +02:00
• cae9c08dfe
  Stream conda repodata through the cooldown filter (#527) Andrew Nesbitt 2026-10-19 06:47:34 +01:00
• 2e0f1322a2
  Check gofmt in CI and reformat (#528) Andrew Nesbitt 2026-10-19 06:47:28 +01:00
• b33e773335
  Merge upstream main and expect exit status 1 for refused mirror downloads abhinavgautam01 2026-10-19 11:11:27 +05:30
• 558e9ea695
  Scope cached Chef cookbook archives to the upstream Supermarket abhinavgautam01 2026-10-19 11:05:11 +05:30
• 134906451b
  Check gofmt in CI and reformat Andrew Nesbitt 2026-10-18 21:11:43 +01:00
• e6eee45653
  Stream conda repodata through the cooldown filter Andrew Nesbitt 2026-10-18 21:09:47 +01:00
• d4e89b08da
  Resolve Composer downloads from the cached metadata (#494) simon chrzanowski 2026-10-18 21:32:02 +02:00
• 85b674f278
  Keep the stored metadata on an upstream 304 (#495) simon chrzanowski 2026-10-18 21:29:43 +02:00
• fa7ae81c76
  Request npm packuments in one format for downloads too (#496) simon chrzanowski 2026-10-18 21:27:18 +02:00
• bdec446b69
  Exit with status 1 when proxy mirror fails to mirror a package (#502) Cestercian 2026-10-19 00:55:13 +05:30
• 8d96791f1a
  Re-mirror container images on a schedule (#508) Christian Heim 2026-10-18 19:33:13 +02:00
• 83e2fb4bda
  Make the Gradle build cache read-only by default, so a client that can reach the proxy can no longer overwrite cache entries; CI jobs that upload now need gradle.build_cache.read_only: false (or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false). The environment variable is parsed strictly, so a value like "yes" keeps uploads off and logs a warning instead of opening them. Fixes #497. (#509) Christian Heim 2026-10-18 19:31:46 +02:00
• ac137a3289
  Extract portable npm metadata transformations extract-portable-npm-metadata Andrew Nesbitt 2026-10-18 17:59:14 +01:00
• 23ed256d7a
  Add Chef Supermarket proxy support for Berkshelf and Policyfiles abhinavgautam01 2026-10-18 20:47:44 +05:30
• 32c299c70a Pub archives that older versions cached from a path without .tar.gz are now discarded and fetched again, so versions that were already broken heal on the next download. Christian Heim 2026-10-18 16:55:58 +02:00
• f094fe9b81 Pub downloads without .tar.gz fetched the HTML version page from pub.dev and cached it as the archive, so one request broke that version for everyone after; they now get a 404, and the upstream URL is built from the escaped name and version so an encoded ? or # can't become a query or fragment. Christian Heim 2026-10-18 13:25:11 +02:00
• 21fdf772fe
  Use shared registries size limits and rate-limit gate Andrew Nesbitt 2026-10-18 14:50:53 +01:00
• f279edf35d fix(mirror): exit with status 1 when downloads fail yunaremaia 2026-10-18 12:59:16 +00:00
• 39d10b1d15 Remove constant parameter from generic retention test helper ztzhou 2026-10-18 20:11:06 +08:00
• f1ea481161 Add opt-in retention for generic artifacts ztzhou 2026-10-18 20:02:39 +08:00
• 51743c6840
  Use shared cooldown package-pattern policy Andrew Nesbitt 2026-10-18 12:39:21 +01:00
• ac000eb601
  Use shared sbom parser for mirror sources Andrew Nesbitt 2026-10-18 12:10:26 +01:00
• 1c20b60445 Make the Gradle build cache read-only by default, so a client that can reach the proxy can no longer overwrite cache entries; CI jobs that upload now need gradle.build_cache.read_only: false (or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false). The environment variable is parsed strictly, so a value like "yes" keeps uploads off and logs a warning instead of opening them. Fixes #497. Christian Heim 2026-10-18 12:48:42 +02:00
• 3e88cd027a Check cached layers during a mirror without opening them, so a refresh no longer counts as a cache hit and doesn't keep scheduled images at the top of LRU eviction. Christian Heim 2026-10-18 11:08:53 +02:00
• c561cfede9 Start the schedules with the server and let shutdown wait for a running refresh before storage and database are closed. Docs included. Christian Heim 2026-10-18 08:14:50 +02:00
• ce82a153d4 Run each schedule through the normal mirror, one run after the other. The first run starts at a random point within ten minutes and later runs get ±10 % jitter, so several instances don't hit the registry at once. Christian Heim 2026-10-18 08:14:50 +02:00
• 9f058aa36a Add mirror.schedules, a list of image tags the server re-mirrors at a fixed interval. Digests are rejected since they never move. Christian Heim 2026-10-18 08:14:50 +02:00
• 552f0496f4 Shorter comments on the metadata last-access migration. Christian Heim 2026-10-18 07:30:20 +02:00
• b87c6567a0 max_size now counts cached metadata as well as artifacts, and eviction drops whichever was used least recently, so metadata no longer piles up for good (#461). Metadata rows record when they were last served, an artifact not yet served counts from its download, and Arch stores a database blob again if eviction removed it under a refreshed row. Christian Heim 2026-10-17 23:37:29 +02:00
• c0320c7c87 Clearing a record and queueing its file for deletion now happen in one transaction, so a failed queue write keeps the record instead of leaving a file nothing points at. Eviction drops the queue entry again once it has deleted the file itself. Christian Heim 2026-10-17 23:20:45 +02:00
• 56e1c9eb4e Refetch a cached Go zip that an older version stored for the other spelling of the module. Christian Heim 2026-10-17 23:21:08 +02:00
• 3fda7fd176 Keep the capitals of a Go module path in the cached zip's filename, so github.com/Sirupsen/logrus and github.com/sirupsen/logrus no longer share one cache entry. Lowercase paths keep their filename. Christian Heim 2026-10-17 23:12:46 +02:00
• 4b23b3f5a9 Abort the response when a cached artifact fails its integrity check orshih6 2026-10-17 17:40:15 +00:00
• 15aa90aea4
  Exit with status 1 when proxy mirror fails to mirror a package Cestercian 2026-10-17 22:44:26 +05:30
• db6d1d672d Request npm packuments in one format for downloads too Simon Chrzanowski 2026-10-17 14:10:55 +02:00
• 2dde10be4c Keep the stored metadata on an upstream 304 Simon Chrzanowski 2026-10-17 14:08:17 +02:00
• 9dafb8cb36 Resolve Composer downloads from the cached metadata Simon Chrzanowski 2026-10-17 13:58:36 +02:00
• 3f862bfd9c
  Refuse package mirroring from the CLI while scanning is enabled abhinavgautam01 2026-10-16 11:12:09 +05:30
• 1950c0b6a4
  Merge pull request #487 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/ecr-1.66.2 Andrew Nesbitt 2026-10-15 16:55:55 +01:00
• b8d5cf4f27
  Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.2 dependabot[bot] 2026-10-15 15:33:50 +00:00
• 78b1913865
  Merge pull request #490 from git-pkgs/dependabot/go_modules/github.com/prometheus/client_golang-1.25.0 Andrew Nesbitt 2026-10-15 16:31:13 +01:00
• 29046e6013
  Merge pull request #489 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.7 Andrew Nesbitt 2026-10-15 16:30:33 +01:00
• 1a4a372c4c
  Merge pull request #488 from git-pkgs/dependabot/go_modules/golang.org/x/sync-0.24.0 Andrew Nesbitt 2026-10-15 16:29:35 +01:00
• 7e35cfc4dd
  Merge pull request #483 from gilesw/feat/upstream-retry-after Andrew Nesbitt 2026-10-15 16:27:51 +01:00
• eb29011659
  Merge pull request #485 from simonchrz/perf/gzip-rewritten-metadata Andrew Nesbitt 2026-10-15 16:25:09 +01:00