artifact-keeper/artifact-keeper v1.1.9-rc.1

v1.1.9-rc.1 — stability release candidate

on GitHub

First release candidate of the v1.1.9 stability line. This is a maintenance release for the v1.1.x branch focused on auth, security, and reliability fixes. Please test against your staging environments and report findings on #887.

What's in v1.1.9

Auth and identity

• #947 — Refresh-token rotation via JTI blocklist (closes #929)
• #955 — Download-ticket consumer middleware (closes #930)
• #954 — Invalidate API-token cache on user deactivation (closes #931)

Security fixes

• #960 — Maven: escape user-supplied LIKE wildcards in SNAPSHOT lookups (closes #880)
• #988 — Backport LIKE wildcard escape to npm/helm/rpm/rubygems handlers (closes #984)
• #998 — Close LIKE wildcard-injection in pypi + shared proxy_helpers::local_fetch_by_path_suffix
• #959 — goproxy: prevent SSRF in proxy_sumdb via host allowlist (closes #879)
• #900 — Block IPv6 SSRF bypasses and extra cloud metadata IPs (closes #881)
• #971 — Upgrade wasmtime to 36.0.7 to close aarch64 sandbox-escape CVE (closes #861)
  • Subsequently bumped to 36.0.8 in #992 to address RUSTSEC-2026-0114
• #992 — Backport webhook delivery producer (closes #909)
• #993 — Require admin role on webhook write handlers (close cross-tenant gap exposed by #909)
• #996 — Scanner silent-success fix on type-mismatched artifacts + migration 075 (closes #994)
• #985 — Git LFS: require auth on GET /:repo/locks (closes via #987)
• #995 — RATE_LIMIT_EXEMPT_USERNAMES config support (closes flakes from #697 forward-port gap)

Bug fixes

• #878 — S3: fail fast on missing credentials with custom endpoint (closes #871)
• #862 — Maven: resolve SNAPSHOT artifacts through virtual repos (closes #839)
• #863 — nexus-migration: yum/maven2 formats and checksum comparison
• #897/#899 — Mark scan FAILED when Trivy pod is unreachable (closes #888)
• #891 — Debian: resolve matchit route conflict from #814 (closes #832, #854)
• #944 — OCI: support Docker daemon registry-mirrors via env-configured fallback
• #892 — Resolve OTLP NoHttpClient panic, jsonwebtoken test failures, rustls-webpki CVE (closes #835)

Test reliability

• #997 — Scope GC tests to per-test user_id to fix llvm-cov parallel race
• #972 — Build :1.1-dev image on release/1.1.x pushes (closes #890)

Known issues — non-blocking

Tracked for resolution in v1.1.10:

• #1001 — Pre-seed Grype vulnerability DB in backend Dockerfile. Currently the Grype subprocess scanner fails on first scan because the DB is fetched at scan time and ARC runner pods can't reach grype.anchore.io. Quality gate is last-scanner-wins so Trivy (which works) satisfies block_unscanned policy. Already addressed on main in PR #1002.
• artifact-keeper-test#132 — Stress test test-sustained-load.sh reports 38–53% error rate at ~150 req/s. 0 timeouts (not a crash); likely the test isn't authenticating as a RATE_LIMIT_EXEMPT_USERNAMES-listed admin and hits 429s under burst.

In-flight v1.1.10 PRs (informational)

• #1000 / #1004 — Extend LIKE-escape to remaining 8 medium-severity package handlers (ansible/cran/hex/puppet/alpine/huggingface/debian/terraform)
• #1002 — Grype DB pre-seed (closes #1001)
• #1003 — docker-publish versioned-tag verification gate (closes #905)
• #1005 — Expand ScanResponse with scan_result_id, is_reused, source_scan_id (closes #906, #907)
• #1006 — Populate scanner_version and started_at in ScanResult (closes #902)

Container images

• ghcr.io/artifact-keeper/artifact-keeper-backend:1.1.9-rc.1
• ghcr.io/artifact-keeper/artifact-keeper-backend:1.1.9-rc.1-alpine
• ghcr.io/artifact-keeper/artifact-keeper-openscap:1.1.9-rc.1

(Multi-arch manifests for linux/amd64 + linux/arm64. Published by docker-publish on tag push.)

Validation

Validated by release-gate run 25269109541: 25 of 27 jobs green, 2 documented soft-fails. All blocking gates passed.

Sponsors

Thank you to the sponsors making sustained work on Artifact Keeper possible. Sponsorship support directly funds the security and reliability work in releases like this one.

If you rely on Artifact Keeper in production and would like to support development, see https://github.com/sponsors/brandonrc.

Thank you

Thanks to everyone who reported bugs, validated previous release candidates, contributed PRs, and pushed back on partial fixes. Special thanks to the v1.1.8 reporters whose Debian-route panic crash report (#885) kicked off this release line.

Tracking issue: #886
Validation thread: #887