Releases: git-pkgs/proxy
Releases · git-pkgs/proxy
Release list
v0.8.1
v0.8.0
Immutable
release. Only release title and notes can be modified.
Changelog
- 7f8ccab Accept inline SBOM documents in mirror API (#294)
- 4b9b401 Add Alpine APK repository proxy support (#293)
- b5ee6dd Add ECR auto-refreshing upstream authentication (#278)
- 41ae7d6 Add GCS storage backend with lighter dependencies (#179)
- 230fa7b Add Helm chart (#250)
- b67cfb1 Add Homebrew JSON API and bottle proxy support (#254)
- e4fbf3f Add JSONL access logging (#269)
- 7743417 Add Swift package registry support (#259)
- 30e54a1 Add generic HTTP download proxy for GitHub release assets (mise/aqua) (#302)
- 5499837 Add pre-cache artifact scanning hook (trivy/ClamAV/Wiz/custom) (#298)
- 7e1cb68 Add upstream.npm_full_metadata to serve publish times without cooldown (#297)
- 5b92e44 Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#284)
- 06baf43 Bump github.com/CycloneDX/cyclonedx-go from 0.11.0 to 0.12.0 (#311)
- ca9eed9 Bump github.com/aws/aws-sdk-go-v2/config from 1.32.38 to 1.32.40 (#310)
- 5492ab5 Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.60.7 to 1.61.0 (#308)
- a101182 Bump github.com/git-pkgs/cooldown from 0.1.1 to 0.2.0 (#287)
- 50f5561 Bump github.com/git-pkgs/enrichment from 0.6.5 to 0.7.0 (#285)
- 12ad4ec Bump github.com/git-pkgs/purl to v0.1.17 (#273)
- cd0aaf0 Bump github.com/git-pkgs/purl to v0.1.19 (#291)
- 5508872 Bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 (#286)
- a0b87bc Bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#299)
- eb6e280 Bump intra-org dependencies for v0.8.0 (#314)
- 062d616 Bump modernc.org/sqlite from 1.56.0 to 1.57.0 (#289)
- 17446b4 Bump registries to v0.8.1 (#277)
- 879e89e Correct cache metrics (#272)
- 87bf742 Document package support issue drafts
- 272e6d9 Lint and dead-code cleanup (#279)
- f43aa9d Make built-in upstream URLs configurable (#255)
- 76fcd07 Read the stored publish time in the npm cooldown download check (#296)
- 49a68f1 Record proxy request metrics (#270)
- 5cdbc89 Remove supporting-module-issues.md
- cad1a92 Report upstream circuit breaker state in /health and /metrics (#275)
- c1f09e7 Show build information in web UI (#257)
- 3b5dc88 Support PyPI Simple API JSON responses (#290)
- f0e6e11 Upgrade to Go 1.26.6 (#246)
- c5e1483 Use header constants across the handler package (#301)
- d950919 Use shared artifacts at cache boundaries (#267)
- 1a814c7 Use shared integrity verification (#260)
- 088027c feat: add Helm repository proxy support (#268)
- c188a54 fix(handler): preserve upstream content-encoding for cached metadata (#304)
- 1e3369c fix(oci): cache tag lists and normalize manifest variants (#280)
- f0d90cd fix(oci): retry transient token requests (#281)
- 78b29e5 fix: cache PyPI metadata for filtered versions (#258)
v0.7.0
Changelog
- 3e53469 Bump git-pkgs dependencies (#253)
- 41c033a Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#252)
- ed54005 Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#251)
- 30e4052 Document upstream.debian in README and config.example.yaml (#237)
- 4fa903e Enforce cooldown on artifact downloads (#240)
- 6fcc57c Optimize cached artifact serving (#245)
- a17bdc7 Sign published container images (#227)
- 538a15d fix(container): serve cached images when upstream is unavailable (#199)
- 14f80ce fix(npm): use combined Accept header to support Artifactory upstreams (#241)
- bbea63f fix(upstream): apply authentication through shared transport (#198)
- 849500d fix: decode PURL percent-encoding in versions and package paths (#244)
v0.6.1
Changelog
- 7dbf13e Avoid repeated content type path lookup
- a5d4567 Bump actions/checkout from 7.0.0 to 7.0.1 (#218)
- d0f9319 Bump dependencies ahead of v0.7.0 (#235)
- b56a1fe Bump docker/login-action from 4.4.0 to 4.5.0 (#220)
- 5f993e3 Bump docker/login-action from 4.5.0 to 4.6.0 (#232)
- 31ecca8 Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#221)
- 9a9a821 Bump modernc.org/sqlite from 1.54.0 to 1.55.0 (#219)
- 1057ee9 Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#217)
- 36f3a51 Detect content types when browsing files
- 800ffc6 Make Debian upstream repository configurable. (#229)
- bc1ea30 Multi-platform build (linux/amd64 and linux/arm64) (#230)
- 63f0efd fix(pypi): resolve name and version for PEP 658 metadata sidecars (#222)
v0.6.0
Changelog
- a8c0562 Bump actions/setup-go from 6.4.0 to 6.5.0
- 60c72be Bump actions/setup-go from 6.5.0 to 7.0.0
- df3ad91 Bump docker/build-push-action from 7.2.0 to 7.3.0
- ea4eea4 Bump docker/login-action from 4.2.0 to 4.3.0
- df997e5 Bump docker/login-action from 4.3.0 to 4.4.0
- 383d208 Bump docker/metadata-action from 6.1.0 to 6.2.0
- 44041d0 Bump git-pkgs archives, enrichment, purl, registries, vulns (#215)
- 41ef279 Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
- 96e1132 Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
- 13ae397 Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
- 5ae5eab Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
- ec3cc35 Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
- cdf0756 Bump golang from 1.26.4-alpine to 1.26.5-alpine
- 1a18dd4 Bump golang.org/x/net to v0.56.0
- f7b5dd2 Bump golang.org/x/sync from 0.21.0 to 0.22.0
- 9042269 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#216)
- defe1ec Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3
- c3f1577 Bump modernc.org/sqlite from 1.53.0 to 1.54.0
- 81d19b7 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
- d9b7a30 Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
- cdbd1a9 Canonicalize cooldown lookup PURLs to match config
- 787b76d Fix Composer 404 on minified metadata and add debug logging
- be15a0f Fix cooldown overrides for scoped package PURLs
- 0ae6306 Make upstream HTTP timeout configurable
- 98150ea Name empty path validation subtest
- 5b959d1 Preserve Go proxy fallback for missing modules
- 4146596 Validate filesystem storage paths
- cf37411 fix(upstream): honor npm and Cargo overrides (#200)
- 532e492 fix: proper handling of upstream registry 404s (#209)
v0.5.1
Changelog
- cb18df5 Bump actions/checkout from 6.0.2 to 6.0.3 (#163)
- 795edb4 Bump actions/checkout from 6.0.3 to 7.0.0 (#175)
- d968f4a Bump alpine from 3.23.4 to 3.24.0 (#166)
- 22c9df6 Bump alpine from 3.24.0 to 3.24.1 (#172)
- bb214bb Bump git-pkgs and third-party dependencies (#177)
- fc245fd Bump github.com/git-pkgs/enrichment from 0.2.3 to 0.3.0 (#165)
- 50ea557 Bump gocloud.dev from 0.45.0 to 0.46.0 (#164)
- e289fae Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#170)
- 8aa6d75 Bump modernc.org/sqlite from 1.51.0 to 1.52.0 (#171)
- f4a8c56 Fix package redirection to '/ui/packages' (#169)
- b2011c0 Log actual database config instead of sqlite path (#176)
- ca25149 fix(composer): resolve *-dev versions from the ~dev metadata file (#174)
v0.5.0
Changelog
- da4fa2f Add PROXY_UI_URL for separate UI/package URL advertisement (#161)
- ee57878 Bump docker/build-push-action from 7.1.0 to 7.2.0 (#151)
- e5fbd6e Bump docker/login-action from 4.1.0 to 4.2.0 (#160)
- 6fa2d95 Bump docker/metadata-action from 6.0.0 to 6.1.0 (#158)
- fbe82f3 Bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0 (#157)
- 31b5135 Bump golang from 1.26.3-alpine to 1.26.4-alpine (#156)
- 65474c7 Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#153)
- 94ba4ab Bump grpc, otel, and aws-sdk-go-v2 to address security advisories (#154)
- 67190c1 Bump modernc.org/sqlite from 1.50.1 to 1.51.0 (#159)
- 946d39f Bump zizmorcore/zizmor-action from 0.5.5 to 0.5.6 (#152)
- 0e7af4a Make metadata size limit configurable (closes #149) (#150)
- 08d975c Mount web UI under /ui (#148)
- 8c28b02 Polish UI: lucide icons, sticky footer, hamburger nav, clickable logo (#162)
v0.4.0
Changelog
- 992f5c6 Add .golangci.yml and clear gocognit/goconst findings (#113)
- f2a5b70 Add Julia Pkg server support (#117)
- 76f41cf Add storage backend probe to /health (closes #73) (#119)
- 497e16f Bump alpine from 3.21 to 3.23.4 (#139)
- 00b032c Bump git-pkgs deps for v0.4.0 (#146)
- 1e6a0d1 Bump github.com/CycloneDX/cyclonedx-go from 0.10.0 to 0.11.0 (#136)
- 7586beb Bump github.com/git-pkgs/vers from 0.2.5 to 0.2.6 (#137)
- 7832db2 Bump golang from 1.25-alpine to 1.26.3-alpine (#138)
- ebc2ea9 Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 (#115)
- d39e312 Bump modernc.org/sqlite from 1.50.0 to 1.50.1 (#140)
- 5315883 Bump registries to v0.6.0 and replace internal/cooldown (#120)
- 17a10bd Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#122)
- e8363e2 Bump zizmorcore/zizmor-action from 0.5.3 to 0.5.5 (#135)
- ffd28ad Handle __unset sentinel in Composer minified metadata (#121)
- 552c8ac Update Gradle cache with the configurable plugin support (#114)
- 31a9ca7 add Gradle Build Cache support with handler and tests (#87)
- a8b6b0a add support for Gradle prometheus metrics (#124)
v0.3.2
Changelog
- a4fd333 Check for path traversal after URL decoding (#108)
- 8d27406 Structured JSON error responses for API endpoints (#110)
- e912227 Use archives.OpenBytes in browse handler to cut buffer copies (#107)
- 522c6f2 Validate package paths before database lookups (#109)
- 6174112 Verify cached artifacts on read (#111)
v0.3.1
Changelog
- 50772d8 Add Homebrew install instructions
- 2816ff2 Add LICENSE
- d6066af Add MaxBytesReader to mirror API HandleCreate (#105)
- c73b0a3 Add direct-serve via presigned storage URLs
- 1ad1827 Add storage.direct_serve_base_url to override presigned URL host
- c655399 Apply 'go fmt' as suggested in CONTRIBUTING.md.
- a1d0286 Bump docker/build-push-action from 7.0.0 to 7.1.0
- 78325b6 Bump docker/login-action from 4.0.0 to 4.1.0
- adca293 Bump git-pkgs deps to latest patch releases
- d9d6e87 Bump github.com/git-pkgs/registries from 0.4.0 to 0.4.1
- 59a510f Bump github.com/lib/pq from 1.12.2 to 1.12.3
- 96049c1 Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0
- 35f26f4 Bump modernc.org/sqlite from 1.48.0 to 1.48.2
- 3a68cce Bump modernc.org/sqlite from 1.48.2 to 1.49.1
- 34be35c Bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
- 461a95c Enforce max_size config with LRU cache eviction
- cfcf480 Limit io.ReadAll in openArchive to 512 MB (#104)
- 71e8d3b Reject path traversal in filesystem storage (#106)
- f1ea8b5 Serve .html, .svg and .xhtml as text/plain in browse file handler (#103)
- 0c02455 Sign release checksums with cosign keyless
- f9f2a6e Use cosign v4 bundle format for release signing
