artifact-keeper/artifact-keeper-web v1.11.2

Artifact Keeper Web 1.11.2

on GitHub

Sponsors

Thank you to our sponsors for supporting ongoing development of Artifact Keeper.

Backers

• Advailo, SIA (@advailo)
• stringke (@StringKe)
• Ash A. (@dragonpaw)
• Mike (@huylv95)
• Gabriel Rodriguez (@injectedfusion)
• Narek Engibaryan (@narek01)
• and one sponsor who chose to stay private

Become a sponsor to support the project and get your name listed here.

Thank You

• @trourance for reporting that the built-in admin could no longer sign in with a local account once an LDAP provider was enabled (artifact-keeper#4857, #1044).

Security

• Updates Next.js to 16.4.3 - the web server ran Next.js 16.3.8. next moves to 16.4.3 and eslint-config-next to match, and npm audit --omit=dev is clean again. This is a minor framework bump, not a patch: the build and the unit, lint and E2E suites pass unchanged.

Fixed

• The conda allowlist settings describe what the list filters since backend 1.11.9, and can set which members it applies to (artifact-keeper#5055) - the Allowlist section said hosted members are never filtered. From backend 1.11.9 a virtual channel's list applies to every member, hosted (local and staging) and remote, so a hosted package that is not on the list disappears from the channel (its index and downloads through it) after the upgrade, while the hosted repository itself still serves it and still owns its name, keeping upstream packages of that name out. The help text, the empty-list warning, the unreadable-list alert and the remove dialog now say so, and a new "Applies to" choice shows the stored scope and sets it: "All members (default)" or "Remote members only", which restores the earlier behaviour for one channel. The overview summary and the audit log name the remote-only opt-out. Trade-off: the backend rejects request fields it does not know, so the UI sends scope only when the backend reported one; against a backend before 1.11.9 the choice is hidden, a note says that server filters remote members only, and saves send the same body as before. The scope is sent on every save to a backend that reports it, so switching back to all members is explicit rather than relying on the backend keeping an omitted scope.
• With an LDAP provider enabled, the login page offers a way back to the local admin account (artifact-keeper#4857) - since 1.11.1 (#899) an enabled LDAP provider without ALLOW_LOCAL_ADMIN_LOGIN showed only the LDAP form, which binds to the directory, so the built-in admin looked locked out even though the server still accepts its password. The page now shows a muted "Sign in with a local account" link under the LDAP form that opens the existing /login?fallback=local form. The backend's local_login_enabled flag is unchanged and the login endpoint still rejects local passwords from everyone but a verified admin, so the link gives an ordinary user nothing new. Not covered: an OIDC- or SAML-only page shows no such link; /login?fallback=local remains the way in there.

What's Changed

• chore(deps): batch the open Dependabot bumps (#1021-#1025, #1027-#1031) by @brandonrc in #1041
• fix(login): offer a local-account link when only LDAP forms are shown by @brandonrc in #1044
• fix(security): bump next to 16.4.3; keep the logout E2E off the shared session by @brandonrc in #1060
• fix(conda): allowlist scope control and accurate help text (artifact-keeper#5055) by @brandonrc in #1059
• chore(release): web 1.11.2 prep: CHANGELOG section with Sponsors and Thank You, version bump by @brandonrc in #1063

Full Changelog: v1.11.1...v1.11.2