0.9.2 (Pre-release)

Pre-release

RepoFlow 0.9.2 is not yet generally available. These release notes may change before the final release.

Upgrading from an earlier version?

If you are upgrading an existing deployment, review the upgrade notes first.

New features (3)

1. npm security audits
   npm repositories now support npm audit. Local repositories use RepoFlow vulnerability scan results when scanning is enabled, remote repositories retrieve upstream advisories and include available cached scan findings, and virtual repositories combine results from their children.

2. Helm autoscaling
   The Helm chart can now create Horizontal Pod Autoscalers for Nginx, client, Hasura, and server. Enable autoscaling per component and configure replica limits, metrics, and scaling behavior. Existing deployments continue using their configured replica counts unless autoscaling is enabled.

3. List retention rules through API v1
   A new read-only endpoint lists the retention rules configured for a local repository, including their conditions, schedule, and current status.

Improvements (14)

1. Negative regex matching
   Retention and download rules now support Does not match pattern, allowing rules to exclude packages or versions that match a regular expression.

2. GitHub and GitLab release download paths
   Universal repositories now accept GitHub-style {package-name}/releases/download/{version}/{file} and GitLab-style {package-name}/-/releases/{version}/downloads/{file} URLs. GitLab paths also support nested assets such as bin/app.zip. Existing Universal download paths remain supported.

3. Custom Helm health probes
   All chart components now support custom liveness, readiness, and startup probes through values.yaml. Existing probe defaults remain unchanged.

4. Configurable Nginx workers
   Set nginx.workerProcesses to configure the gateway's worker count. The default remains auto.

5. Configurable Hasura connection pools
   Configure Hasura's connection limits, idle timeout, connection lifetime, retries, and pool wait timeout through server environment variables. Existing defaults remain unchanged. See Hasura Connection Pool for configuration options.

6. Faster npm metadata responses
   Reduced unnecessary copying when preparing and merging npm metadata, lowering CPU work and temporary memory allocations for large package manifests and virtual repositories.

7. Better npm package cache reuse
   Local npm repositories now include SHA-256 integrity in package metadata, allowing npm clients to verify and reuse cached packages instead of downloading them again.

8. Client container environment variables
   Helm deployments can now pass environment variables to the client container through client.containerEnvironment. Browser configuration continues to use client.environment.

9. Safer Hasura defaults
   The Helm chart, Docker Compose configuration, and all-in-one container now disable Hasura's administration console and development mode by default. Both settings remain configurable.

10. More temporary storage headroom
    Increased the Helm server's default ephemeral storage limit from 1Gi to 5Gi to provide more headroom for uploads, scans, and other temporary files.

11. Updated deployment dependencies
    Updated Hasura to 2.50.5, the Helm gateway and client Nginx images to 1.31.7, and the server and all-in-one Node.js runtime to 24.22.1.

12. Updated vulnerability scanners
    Updated Grype to 0.121.0 and Syft to 1.55.0, improving package detection, vulnerability matching, and handling of malformed files.

13. Safer Docker Compose database credentials
    New Docker Compose installations now generate a random PostgreSQL password and keep database credentials and Hasura connection URLs in secrets.env, instead of embedding the default password in the Compose file.

14. Better package search relevance
    Improved matching across package names, descriptions, and README content, including multiword searches, to bring more relevant packages to the top of the results.

Bug fixes (18)

1. Composer installs from existing lock files
   Fixed some packages returning 404 when installed through a remote Composer repository using an existing composer.lock file. The lock file does not need to be changed.

2. Maven repository metadata
   Remote Maven repositories now serve optional repository-level files such as .meta/prefixes.txt when available upstream. Local and virtual repositories return 404 for these files, preventing incomplete prefix lists from causing Maven to skip dependencies.

3. Docker upload authentication
   Docker upload requests now return the expected authentication challenge when the client does not have upload permission, before checking whether the repository type supports uploads.

4. Concurrent Maven uploads
   Fixed files being lost when multiple uploads create the same Maven package version at the same time. Failed Maven uploads now return an error instead of HTTP 200.

5. Package Updated Day conditions
   Fixed the retention rule editor going blank when selecting Updated Day for a package condition. The field uses the latest update among active files across all versions, falling back to the package creation date when there are no active files.

6. Custom Helm pod settings
   Fixed extraPodSpec placement across chart components so settings such as affinity, topology spread constraints, and tolerations apply to the pod correctly.

7. Download rule cache duration
   Fixed DOWNLOAD_RULES_CACHE_TTL_IN_SECONDS being capped at one second. The cache now honors the configured duration, including the existing two-second default. Setting it to 0 still disables caching.

8. Helm client configuration updates
   Client pods now roll out automatically when their browser environment or analytics configuration changes, applying the updated configuration without a manual restart.

9. npm publish validation and cleanup
   Invalid publish metadata and invalid gzip attachments now return HTTP 400 instead of an internal server error. Temporary request files are cleaned up after failed or interrupted publishes, without removing files still needed by an active upload. Storage failures continue to return server errors.

10. Object Storage health checks
    Concurrent health checks now use separate test objects and always attempt cleanup after verification. Scheduled garbage collection also removes health-check files older than 24 hours left behind by interrupted or failed cleanup attempts.

11. Pre-signed storage URL configuration
    Fixed the Helm configuration to use STORAGE_USE_PRE_SIGNED_URL. The obsolete S3_USE_PRE_SIGNED_URL setting was ignored by current server versions.

12. GitLab Composer metadata
    Remote Composer repositories now accept GitLab's version-keyed metadata alongside standard Composer metadata. Previously cached GitLab metadata also works without clearing the cache.

13. Helm OCI publishing
    Deploy-only users can now publish new Helm chart versions without an incorrect permission error. Charts are stored under the requested tag, and repeated digest uploads preserve references used by existing versions. Existing-version overwrite permissions remain enforced.

14. RubyGems source checks
    Authenticated source-root HEAD requests now succeed, allowing RubyGems clients to check the repository before requesting package indexes.

15. Remote download statistics
    Remote artifact downloads now update download counts and last-downloaded timestamps on both cold and cached downloads. Metadata and HEAD requests do not increase download counts.

16. Google Cloud Storage HEAD requests
    Fixed HEAD requests when pre-signed Google Cloud Storage URLs are enabled. These requests now use the server download path instead of a signature intended for GET.

17. Workspace refresh during repository deletion
    The system workspace list now refreshes while a repository is being deleted, making workspace deletion available when its last repository finishes deleting without a page reload.

18. Retention rule condition validation
    Incomplete or invalid conditions can no longer be silently omitted when previewing or saving a rule. Editing a condition disables preview until the updated input has been validated, preventing an incomplete rule from unintentionally matching every package.

Upgrade notes

There are no new RepoFlow database or data migrations when upgrading from 0.9.1. If upgrading from an older version, also follow the upgrade notes for the releases you are skipping.

Docker Compose

If adopting the updated Compose configuration:

1. Add POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB to your existing secrets.env using your current database credentials.
2. Add the existing HASURA_GRAPHQL_DATABASE_URL and HASURA_GRAPHQL_METADATA_DATABASE_URL values to that file. URL-encode special characters in credentials if constructing new URLs.
3. Add secrets.env to env_file for PostgreSQL and Hasura, and remove inline credential and connection URL values that would override it.
4. Recreate the affected services, keeping your existing PostgreSQL image version, volume mounts, and data volumes.

Changing environment variables does not change credentials in an existing database. See Deploying with Docker Compose for the configuration format.

Hasura defaults

The Helm chart and all-in-one image now default HASURA_GRAPHQL_ENABLE_CONSOLE and HASURA_GRAPHQL_DEV_MODE to false. Existing overrides remain respected. If your configuration explicitly sets either to true, change it to false to adopt the new defaults. For separate Hasura containers, set these variables on Hasura.

Hasura no longer uses PostgreSQL table and column comments as GraphQL descriptions. If you use these descriptions, define them in Hasura metadata. Queries and stored data are unaffected.

Helm

• Replace S3_USE_PRE_SIGNED_URL with STORAGE_USE_PRE_SIGNED_URL in custom server environment values.
• Remove an existing server.resources.limits.ephemeral-storage override or set it to 5Gi to adopt the new default. Large uploads may also need a larger server.tempVolumeSize.