What's Changed
- fix(api): align OpenAPI spec with runtime behavior on six endpoints by @brandonrc in #2335
- fix(api): resolve 5 OpenAPI schema-name collisions and empty the ratchet by @brandonrc in #2340
- fix(auth): return 503 not 401 from guest_access_guard on AuthOutcome::Overloaded by @ssorathia in #2315
- fix(npm): raise packument cache buffer cap by @Dreamacro in #2313
- fix(storage): sign the Azure health-check HEAD probe in Shared Key mode by @garrettKelleyCyOne in #2295
- fix(storage): backdate Azure SAS signed start 15 minutes to tolerate clock skew by @garrettKelleyCyOne in #2294
- fix(swift): aggregate release versions across all virtual repo members by @brandonrc in #2342
- fix(signing): normalize key_type so RSA algorithm variants no longer 500 at key creation by @brandonrc in #2344
- fix(scanner): record not_applicable when the trivy CLI is absent instead of failing by @nicexe2e4 in #2324
- fix(upload): serialize concurrent duplicate chunk uploads (#2316) by @brandonrc in #2348
- fix(auth): grant authenticated users the anonymous read baseline on public repositories by @brandonrc in #2346
- fix(oci): populate the packages catalog on manifest push by @garrettKelleyCyOne in #2337
- fix(downloads): record presigned redirect downloads in download_statistics by @brandonrc in #2349
- fix(migration): persist storage_backend for auto-provisioned repos (#2336) by @BonjeBongo in #2338
- fix(pypi): make virtual repo dependency-confusion isolation priority-aware by @brandonrc in #2351
- fix(auth): tolerate app-vs-DB clock skew in credential watermark check by @brandonrc in #2350
- test(auth): gate invalid-bearer guard test on DATABASE_URL by @brandonrc in #2343
- fix(security): validate scan-policy max_severity and repository_id before insert by @brandonrc in #2345
- chore(release): bump version to 1.4.1 by @brandonrc in #2356
New Contributors
- @ssorathia made their first contribution in #2315
- @BonjeBongo made their first contribution in #2338
Full Changelog: v1.4.0...v1.4.1