v0.15.1

0.15.1 (2026-10-21)

Bug Fixes

• docker: refuse to build an image with PHP below 8.4.27 (2681845)

0.15.0 (2026-09-17)

Features

• scanner: health checks, the scanner service and operator documentation (953b202)
• scanner: per-registry blocking threshold with a preview before saving (8bdc2b5)
• scanner: refuse artifacts whose findings outlived the grace period (5a8a577)
• scanner: run scans and persist verdicts without resetting first_seen_at (96fcf83)
• scanner: scan on push, nightly and on demand (b3212fd)
• scanner: schema for OCI vulnerability reports and findings (e3fc778)
• scanner: show findings on the image pages and in the customer portal (e52d76e)
• scanner: speak the Harbor pluggable scanner adapter API (47f0118)

Bug Fixes

• scanner: clean up placeholder verdicts, cap the unique lock, and reach the pending state (784a396)
• scanner: correct the blocking hint, surface save errors, throttle the preview (c1ba4d9)
• scanner: decode scanner responses strictly and refuse every redirect hop (35dacf2)
• scanner: derive severity_rank on save instead of trusting the caller (a366ac5)
• scanner: keep the nightly rescan rotating and off the shared queue (0717bf7)
• scanner: move the scanner off Redis DB 1, which the cache store owns (357430b)
• scanner: pin the grace boundary with frozen time and one shared predicate (54c973c)
• scanner: pin the scanner image, bound the health check's own timeout (e2a4139)
• scanner: refuse a top-level JSON list as an undecodable scanner body (bc21ef3)
• scanner: send the adapter the media type the manifest actually records (03dee2a)
• scanner: stop a cleared grace field from silently becoming zero (9bbf614)
• scanner: stop the portal card from leaking operator internals and mis-timed blocking (ff15986)
• scanner: survive a queue outage on push and refuse a disabled scanner on demand (fb25099)
• scanner: use GREATEST, not COALESCE, for the rescan sort key (0f8ba42)

Performance Improvements

• scanner: bound the blocking preview and scope it to assigned packages (0940398)
• scanner: key the scan cards by manifest and cap the findings they carry (a29c795)

0.14.0 (2026-09-15)

Features

• api: revoke an API key instead of deleting it (65315cd)
• auth: record a rejected registry token or API key (01a3e0d)
• auth: warn the account holder when their second factor is under attack (ca7cbbb)
• licence: add the org licence write surface (565ca7f)
• licence: add the organization_package licence table (abb27a2)
• licence: make the org licence the ceiling on a registry assignment (6c68c1e)
• licence: manage org licences from the customer page (d9b005b)
• licence: manage org licences from the package page (ccca6a8)
• licence: offer org-licensed packages at /o/ and withdraw lapsed ones (c9e6740)
• licence: read an org licence and intersect two version windows (99e4e75)
• licence: refuse a registry assignment outside the org licence (332047b)
• licence: serve the licence window at the org endpoint (9d4857a)
• licence: show what a licence narrowing will do before it is saved (080f794)
• licence: write org licences through the single assignment writer (cbb7821)
• oidc: rotate a client secret without unlinking every SSO identity (2c7d332)
• portal: list packages an org licence alone makes reachable (8b5a772)

Bug Fixes

• licence: agree on Y-m-d for available_until across both licence payloads (0007cdb)
• licence: apply the licence ceiling to the second attach path too (f4d3acb)
• licence: compute the effective window server-side, not with a second comparator (c072af9)
• licence: fail closed on single-sided unparseable bounds and guard Docker in compareBounds (c14bc2b)
• licence: match the customer pages licensable-packages prop casing (92b88e3)
• licence: read organization_package by primary key, not through a join (c1e33a3)
• licence: refuse un-sharing a package that still carries an org licence (8601aed)
• licence: stop merging partial assignment edits against the licence-narrowed bounds (ebebc0d)
• licence: treat a touching intersection as empty, not as a window (f4ffe77)
• security: encrypt packages.repository_url at rest (c324aec)
• security: harden three shipped defaults the audit left as backlog (ceff146)
• tests: move Licence unit tests to Feature to get RefreshDatabase (aa8ad0c)

0.13.0 (2026-09-14)

Features

• activity: fold repeated activity-log entries into an expandable burst row (dbfe477)

Bug Fixes

• activity: collapse burst counts by subject and stop folding non-contiguous matches (7c77c05)
• auth: bound and record guessing at the second factor ([0e4a0c8](0...

v0.15.0

0.15.0 (2026-09-17)

Features

• scanner: health checks, the scanner service and operator documentation (953b202)
• scanner: per-registry blocking threshold with a preview before saving (8bdc2b5)
• scanner: refuse artifacts whose findings outlived the grace period (5a8a577)
• scanner: run scans and persist verdicts without resetting first_seen_at (96fcf83)
• scanner: scan on push, nightly and on demand (b3212fd)
• scanner: schema for OCI vulnerability reports and findings (e3fc778)
• scanner: show findings on the image pages and in the customer portal (e52d76e)
• scanner: speak the Harbor pluggable scanner adapter API (47f0118)

Bug Fixes

• scanner: clean up placeholder verdicts, cap the unique lock, and reach the pending state (784a396)
• scanner: correct the blocking hint, surface save errors, throttle the preview (c1ba4d9)
• scanner: decode scanner responses strictly and refuse every redirect hop (35dacf2)
• scanner: derive severity_rank on save instead of trusting the caller (a366ac5)
• scanner: keep the nightly rescan rotating and off the shared queue (0717bf7)
• scanner: move the scanner off Redis DB 1, which the cache store owns (357430b)
• scanner: pin the grace boundary with frozen time and one shared predicate (54c973c)
• scanner: pin the scanner image, bound the health check's own timeout (e2a4139)
• scanner: refuse a top-level JSON list as an undecodable scanner body (bc21ef3)
• scanner: send the adapter the media type the manifest actually records (03dee2a)
• scanner: stop a cleared grace field from silently becoming zero (9bbf614)
• scanner: stop the portal card from leaking operator internals and mis-timed blocking (ff15986)
• scanner: survive a queue outage on push and refuse a disabled scanner on demand (fb25099)
• scanner: use GREATEST, not COALESCE, for the rescan sort key (0f8ba42)

Performance Improvements

• scanner: bound the blocking preview and scope it to assigned packages (0940398)
• scanner: key the scan cards by manifest and cap the findings they carry (a29c795)

0.14.0 (2026-09-15)

Features

• api: revoke an API key instead of deleting it (65315cd)
• auth: record a rejected registry token or API key (01a3e0d)
• auth: warn the account holder when their second factor is under attack (ca7cbbb)
• licence: add the org licence write surface (565ca7f)
• licence: add the organization_package licence table (abb27a2)
• licence: make the org licence the ceiling on a registry assignment (6c68c1e)
• licence: manage org licences from the customer page (d9b005b)
• licence: manage org licences from the package page (ccca6a8)
• licence: offer org-licensed packages at /o/ and withdraw lapsed ones (c9e6740)
• licence: read an org licence and intersect two version windows (99e4e75)
• licence: refuse a registry assignment outside the org licence (332047b)
• licence: serve the licence window at the org endpoint (9d4857a)
• licence: show what a licence narrowing will do before it is saved (080f794)
• licence: write org licences through the single assignment writer (cbb7821)
• oidc: rotate a client secret without unlinking every SSO identity (2c7d332)
• portal: list packages an org licence alone makes reachable (8b5a772)

Bug Fixes

• licence: agree on Y-m-d for available_until across both licence payloads (0007cdb)
• licence: apply the licence ceiling to the second attach path too (f4d3acb)
• licence: compute the effective window server-side, not with a second comparator (c072af9)
• licence: fail closed on single-sided unparseable bounds and guard Docker in compareBounds (c14bc2b)
• licence: match the customer pages licensable-packages prop casing (92b88e3)
• licence: read organization_package by primary key, not through a join (c1e33a3)
• licence: refuse un-sharing a package that still carries an org licence (8601aed)
• licence: stop merging partial assignment edits against the licence-narrowed bounds (ebebc0d)
• licence: treat a touching intersection as empty, not as a window (f4ffe77)
• security: encrypt packages.repository_url at rest (c324aec)
• security: harden three shipped defaults the audit left as backlog (ceff146)
• tests: move Licence unit tests to Feature to get RefreshDatabase (aa8ad0c)

0.13.0 (2026-09-14)

Features

• activity: fold repeated activity-log entries into an expandable burst row (dbfe477)

Bug Fixes

• activity: collapse burst counts by subject and stop folding non-contiguous matches (7c77c05)
• auth: bound and record guessing at the second factor (0e4a0c8)
• docs: serve the API browser's renderer from this origin instead of a CDN (f90d76d)
• health: surface a trusted-proxy set that ...

v0.14.0

0.14.0 (2026-09-15)

Features

• api: revoke an API key instead of deleting it (65315cd)
• auth: record a rejected registry token or API key (01a3e0d)
• auth: warn the account holder when their second factor is under attack (ca7cbbb)
• licence: add the org licence write surface (565ca7f)
• licence: add the organization_package licence table (abb27a2)
• licence: make the org licence the ceiling on a registry assignment (6c68c1e)
• licence: manage org licences from the customer page (d9b005b)
• licence: manage org licences from the package page (ccca6a8)
• licence: offer org-licensed packages at /o/ and withdraw lapsed ones (c9e6740)
• licence: read an org licence and intersect two version windows (99e4e75)
• licence: refuse a registry assignment outside the org licence (332047b)
• licence: serve the licence window at the org endpoint (9d4857a)
• licence: show what a licence narrowing will do before it is saved (080f794)
• licence: write org licences through the single assignment writer (cbb7821)
• oidc: rotate a client secret without unlinking every SSO identity (2c7d332)
• portal: list packages an org licence alone makes reachable (8b5a772)

Bug Fixes

• licence: agree on Y-m-d for available_until across both licence payloads (0007cdb)
• licence: apply the licence ceiling to the second attach path too (f4d3acb)
• licence: compute the effective window server-side, not with a second comparator (c072af9)
• licence: fail closed on single-sided unparseable bounds and guard Docker in compareBounds (c14bc2b)
• licence: match the customer pages licensable-packages prop casing (92b88e3)
• licence: read organization_package by primary key, not through a join (c1e33a3)
• licence: refuse un-sharing a package that still carries an org licence (8601aed)
• licence: stop merging partial assignment edits against the licence-narrowed bounds (ebebc0d)
• licence: treat a touching intersection as empty, not as a window (f4ffe77)
• security: encrypt packages.repository_url at rest (c324aec)
• security: harden three shipped defaults the audit left as backlog (ceff146)
• tests: move Licence unit tests to Feature to get RefreshDatabase (aa8ad0c)

0.13.0 (2026-09-14)

Features

• activity: fold repeated activity-log entries into an expandable burst row (dbfe477)

Bug Fixes

• activity: collapse burst counts by subject and stop folding non-contiguous matches (7c77c05)
• auth: bound and record guessing at the second factor (0e4a0c8)
• docs: serve the API browser's renderer from this origin instead of a CDN (f90d76d)
• health: surface a trusted-proxy set that is wider than the proxy (d1943d0)
• licence: degrade the dedupe gracefully on a cache-store outage (d0bd201)
• licence: make VersionEntitlement::boundsFor() fail closed on a missing assignment (d1eb26e)
• licence: parse PEP 440 local versions and implicit post shorthand (384d851)
• licence: surface the swallowed cache throwable instead of discarding it (5a0b8bc)
• licence: time-box the unparseable-version/bound log dedupe (b10fc01)
• mirror: redact dist-url credentials before they reach sync_error (ba8f771)
• oidc: confine email-based account linking to the provider's organization (3975ad8)
• oidc: require TLS for every provider endpoint (67cdde9)
• registry: keep publishing a shared-package registry the operator's decision (a770f93)
• registry: stop /o/ confirming which companies are customers (0bdbd83)
• release: point the deployment at the Docker Hub image, not Harbor (dbaf8c9)
• upstream: cap the metadata an upstream may answer with (f3ad963)
• upstream: connect to the address the SSRF check validated (1f62353)
• vcs: keep an in-url git credential off argv and out of the mirror remote (c168086)

0.12.0 (2026-09-11)

Features

• licence: a PEP 440 version comparator for python bounds (2ae43d2)
• licence: composer serves only licensed versions (d85e27d)
• licence: confirm before revoking a shared assignment, warn on bounds that exclude everything (2dbd5f6)
• licence: manage a package's customer releases from the package page (fa92b84)
• licence: npm serves only licensed versions, tags repointed (1df6f4b)
• licence: one service decides which versions a licence admits (6a55b0c)
• licence: one writer for assignment period and bounds (5cf8655)
• licence: the pypi index respects licence bounds (b4c9d7d)
• licence: version bounds on a package assignment (c3526a5)
• portal: show when newer versions are outside the licence (fe34293)

Bug Fixes

• licence: normalize semver bounds and refuse an empty version window ...

v0.13.0

0.13.0 (2026-09-14)

Features

• activity: fold repeated activity-log entries into an expandable burst row (dbfe477)

Bug Fixes

• activity: collapse burst counts by subject and stop folding non-contiguous matches (7c77c05)
• auth: bound and record guessing at the second factor (0e4a0c8)
• docs: serve the API browser's renderer from this origin instead of a CDN (f90d76d)
• health: surface a trusted-proxy set that is wider than the proxy (d1943d0)
• licence: degrade the dedupe gracefully on a cache-store outage (d0bd201)
• licence: make VersionEntitlement::boundsFor() fail closed on a missing assignment (d1eb26e)
• licence: parse PEP 440 local versions and implicit post shorthand (384d851)
• licence: surface the swallowed cache throwable instead of discarding it (5a0b8bc)
• licence: time-box the unparseable-version/bound log dedupe (b10fc01)
• mirror: redact dist-url credentials before they reach sync_error (ba8f771)
• oidc: confine email-based account linking to the provider's organization (3975ad8)
• oidc: require TLS for every provider endpoint (67cdde9)
• registry: keep publishing a shared-package registry the operator's decision (a770f93)
• registry: stop /o/ confirming which companies are customers (0bdbd83)
• release: point the deployment at the Docker Hub image, not Harbor (dbaf8c9)
• upstream: cap the metadata an upstream may answer with (f3ad963)
• upstream: connect to the address the SSRF check validated (1f62353)
• vcs: keep an in-url git credential off argv and out of the mirror remote (c168086)

0.12.0 (2026-09-11)

Features

• licence: a PEP 440 version comparator for python bounds (2ae43d2)
• licence: composer serves only licensed versions (d85e27d)
• licence: confirm before revoking a shared assignment, warn on bounds that exclude everything (2dbd5f6)
• licence: manage a package's customer releases from the package page (fa92b84)
• licence: npm serves only licensed versions, tags repointed (1df6f4b)
• licence: one service decides which versions a licence admits (6a55b0c)
• licence: one writer for assignment period and bounds (5cf8655)
• licence: the pypi index respects licence bounds (b4c9d7d)
• licence: version bounds on a package assignment (c3526a5)
• portal: show when newer versions are outside the licence (fe34293)

Bug Fixes

• licence: normalize semver bounds and refuse an empty version window (6c30ce2)
• licence: one query for windowsForOrganization, fail closed on bad bounds, refuse Docker (0aec7f5)
• licence: serve npm versions and dist-tags as objects when a licence admits none (66db52d)
• licence: stop polling sync status for a viewer who cannot resync (b08e8bd)
• licence: stop the 403/404 assignment-existence oracle (ae8a048)
• licence: trim the Freigaben page for a receiving customer, gate row edits by scope (a561269)
• licence: validate effective bounds and pull all assignment guards into the writer (b182e03)
• licence: withhold per-version download and size figures from a receiving customer (e044d76)
• licence: withhold the source reference from a receiving customer (bc430dc)

0.11.0 (2026-09-11)

Features

• portal: organization-wide setup tab with org-scoped tokens (feabd4b)
• registry: mount the read-only org-level endpoint prefix (79bb006)
• registry: org-level access checks and the org-wide package union (fc2383f)
• registry: organization-wide setup snippets (7599db0)
• registry: serve composer metadata and dists organization-wide (6a48c83)
• registry: serve npm packuments and tarballs organization-wide (d8c5411)
• registry: serve the pypi simple index organization-wide (5b2e4e0)

Bug Fixes

• admin: close the scope oracle in UpdateUpstreamRequest and remove dead helper (f71abea)
• admin: finish the scope sweep on domains, upstreams and tokens (e80497a)
• admin: make registry, mirror-source and git-credential guards respect the active scope (d10a62d)
• admin: make webhooks, recipients, user/robot lists and the portal link honour org scope (4258838)
• portal: give the Einrichtung tab a revoke control for org-wide tokens (33b8c81)
• registry: apply own-beats-shared ordering to the org package pool (600f26f)
• registry: drop unenforced version-constraint filter, gate /o/ by registry type (3d94b7b)
• registry: exclude proxy-download routes from the /o/ org mount (5d4acc2)
• registry: give each /o/ route its own name, close the write-route fail-open gap (31a5835)
• registry: per-registry docker host in the org snippet set, single-source the /o/ path (89ebb8a)
• registry: use Sie-form in the org write-refusal message (bc095c9)

[0.10.0](v0.9.0...v0.10...

v0.12.0

0.12.0 (2026-09-11)

Features

• licence: a PEP 440 version comparator for python bounds (2ae43d2)
• licence: composer serves only licensed versions (d85e27d)
• licence: confirm before revoking a shared assignment, warn on bounds that exclude everything (2dbd5f6)
• licence: manage a package's customer releases from the package page (fa92b84)
• licence: npm serves only licensed versions, tags repointed (1df6f4b)
• licence: one service decides which versions a licence admits (6a55b0c)
• licence: one writer for assignment period and bounds (5cf8655)
• licence: the pypi index respects licence bounds (b4c9d7d)
• licence: version bounds on a package assignment (c3526a5)
• portal: show when newer versions are outside the licence (fe34293)

Bug Fixes

• licence: normalize semver bounds and refuse an empty version window (6c30ce2)
• licence: one query for windowsForOrganization, fail closed on bad bounds, refuse Docker (0aec7f5)
• licence: serve npm versions and dist-tags as objects when a licence admits none (66db52d)
• licence: stop polling sync status for a viewer who cannot resync (b08e8bd)
• licence: stop the 403/404 assignment-existence oracle (ae8a048)
• licence: trim the Freigaben page for a receiving customer, gate row edits by scope (a561269)
• licence: validate effective bounds and pull all assignment guards into the writer (b182e03)
• licence: withhold per-version download and size figures from a receiving customer (e044d76)
• licence: withhold the source reference from a receiving customer (bc430dc)

0.11.0 (2026-09-11)

Features

• portal: organization-wide setup tab with org-scoped tokens (feabd4b)
• registry: mount the read-only org-level endpoint prefix (79bb006)
• registry: org-level access checks and the org-wide package union (fc2383f)
• registry: organization-wide setup snippets (7599db0)
• registry: serve composer metadata and dists organization-wide (6a48c83)
• registry: serve npm packuments and tarballs organization-wide (d8c5411)
• registry: serve the pypi simple index organization-wide (5b2e4e0)

Bug Fixes

• admin: close the scope oracle in UpdateUpstreamRequest and remove dead helper (f71abea)
• admin: finish the scope sweep on domains, upstreams and tokens (e80497a)
• admin: make registry, mirror-source and git-credential guards respect the active scope (d10a62d)
• admin: make webhooks, recipients, user/robot lists and the portal link honour org scope (4258838)
• portal: give the Einrichtung tab a revoke control for org-wide tokens (33b8c81)
• registry: apply own-beats-shared ordering to the org package pool (600f26f)
• registry: drop unenforced version-constraint filter, gate /o/ by registry type (3d94b7b)
• registry: exclude proxy-download routes from the /o/ org mount (5d4acc2)
• registry: give each /o/ route its own name, close the write-route fail-open gap (31a5835)
• registry: per-registry docker host in the org snippet set, single-source the /o/ path (89ebb8a)
• registry: use Sie-form in the org write-refusal message (bc095c9)

0.10.0 (2026-09-09)

Features

• admin: warn when a registry's organization has no customer portal (34a8227)
• api-docs: add German summaries and groups for the API browser (dc43fc9)
• mirror: continuous mirror sync — job, scheduler and publish exclusion (a105b06)
• mirror: create and maintain mirror packages from the admin (6ed22a0)
• mirror: import composer packages from a mirror source, dists included (4a405a6)
• mirror: import npm packages from a mirror source, integrity-checked (a6d5dd7)
• mirror: import python distributions via the PEP 691 simple API (7b9b53d)
• mirror: let an operator retarget a mirror package's source (01fb3fa)
• mirror: manage org-level mirror sources in the admin (dd5f8c8)
• mirror: schema for org-level mirror sources and the mirror source mode (ee14445)
• oci: a keep_untagged rule — untagged images survive N days by rule (1e09fa0)
• oci: add the Docker registry's interface (setup, empty state, tags) (2fda534)
• oci: add the retention policy schema and the columns the sweeper reads (6b1504b)
• oci: address a registry by path namespace on the instance host (5895a43)
• oci: administer retention policies, with an editor, dry run and guarded apply (f8d6d56)
• oci: evaluate retention rules with OR, and a shield that vetoes rather than selects (194188a)
• oci: exercise docker push/pull against a real docker client in E2E (b48ed75)
• oci: honour keep_untagged windows in the sweep, as timestamps (bbd234e)
• oci: let an operator opt into push-time repository creation (6c293b7)
• oci: let an owning org admin assign retention and write inline rules ([4c48452](https...

v0.11.0

0.11.0 (2026-09-11)

Features

• portal: organization-wide setup tab with org-scoped tokens (feabd4b)
• registry: mount the read-only org-level endpoint prefix (79bb006)
• registry: org-level access checks and the org-wide package union (fc2383f)
• registry: organization-wide setup snippets (7599db0)
• registry: serve composer metadata and dists organization-wide (6a48c83)
• registry: serve npm packuments and tarballs organization-wide (d8c5411)
• registry: serve the pypi simple index organization-wide (5b2e4e0)

Bug Fixes

• admin: close the scope oracle in UpdateUpstreamRequest and remove dead helper (f71abea)
• admin: finish the scope sweep on domains, upstreams and tokens (e80497a)
• admin: make registry, mirror-source and git-credential guards respect the active scope (d10a62d)
• admin: make webhooks, recipients, user/robot lists and the portal link honour org scope (4258838)
• portal: give the Einrichtung tab a revoke control for org-wide tokens (33b8c81)
• registry: apply own-beats-shared ordering to the org package pool (600f26f)
• registry: drop unenforced version-constraint filter, gate /o/ by registry type (3d94b7b)
• registry: exclude proxy-download routes from the /o/ org mount (5d4acc2)
• registry: give each /o/ route its own name, close the write-route fail-open gap (31a5835)
• registry: per-registry docker host in the org snippet set, single-source the /o/ path (89ebb8a)
• registry: use Sie-form in the org write-refusal message (bc095c9)

0.10.0 (2026-09-09)

Features

• admin: warn when a registry's organization has no customer portal (34a8227)
• api-docs: add German summaries and groups for the API browser (dc43fc9)
• mirror: continuous mirror sync — job, scheduler and publish exclusion (a105b06)
• mirror: create and maintain mirror packages from the admin (6ed22a0)
• mirror: import composer packages from a mirror source, dists included (4a405a6)
• mirror: import npm packages from a mirror source, integrity-checked (a6d5dd7)
• mirror: import python distributions via the PEP 691 simple API (7b9b53d)
• mirror: let an operator retarget a mirror package's source (01fb3fa)
• mirror: manage org-level mirror sources in the admin (dd5f8c8)
• mirror: schema for org-level mirror sources and the mirror source mode (ee14445)
• oci: a keep_untagged rule — untagged images survive N days by rule (1e09fa0)
• oci: add the Docker registry's interface (setup, empty state, tags) (2fda534)
• oci: add the retention policy schema and the columns the sweeper reads (6b1504b)
• oci: address a registry by path namespace on the instance host (5895a43)
• oci: administer retention policies, with an editor, dry run and guarded apply (f8d6d56)
• oci: evaluate retention rules with OR, and a shield that vetoes rather than selects (194188a)
• oci: exercise docker push/pull against a real docker client in E2E (b48ed75)
• oci: honour keep_untagged windows in the sweep, as timestamps (bbd234e)
• oci: let an operator opt into push-time repository creation (6c293b7)
• oci: let an owning org admin assign retention and write inline rules (4c48452)
• oci: live retention preview in the policy form and inline editor (1998f3d)
• oci: mark push-created repositories so the sweeper can reclaim the empty ones (cd4e0bf)
• oci: resolve and apply retention policies, with an audit trail (5880506)
• oci: resolve retention through four tiers, inline rules first (4aeb20a)
• oci: schema for inline retention rules, global policies and shared git credentials (3af64dc)
• oci: share git credentials across organizations, checked at sync time (a35c605)
• oci: show and assign a repository's retention policy on the package page (6dd0d13)
• oci: sweep unreachable storage, expired uploads and empty push-created repositories (b36e272)
• oci: the storage sweeper view (0e37f00)
• portal: offer setup for every type a registry may serve (33e89b1)
• portal: show a repository's retention policy and the next run's removals (12aefd6)
• portal: show how to connect before the package list (13aa57d)
• registry: accept oci blob uploads, chunked and monolithic (5e6dbfa)
• registry: add docker as a fourth package type (3b7d6db)
• registry: add OCI manifests and tags (0dcb80e)
• registry: add the oci blob, manifest, tag and upload tables (7911e96)
• registry: open the /v2/ endpoint with a basic-auth challenge (f67b75b)
• registry: serve oci blob bytes on GET, local stream and s3 redirect (81b474e)
• sidebar: nest E-Mail and Storage under System as a submenu (b5f4c25)

Bug Fixes

• admin: measure Docker repository size from referenced blobs, not manifest documents ([fc2a53c](htt...

v0.10.0

0.10.0 (2026-09-09)

Features

• admin: warn when a registry's organization has no customer portal (34a8227)
• api-docs: add German summaries and groups for the API browser (dc43fc9)
• mirror: continuous mirror sync — job, scheduler and publish exclusion (a105b06)
• mirror: create and maintain mirror packages from the admin (6ed22a0)
• mirror: import composer packages from a mirror source, dists included (4a405a6)
• mirror: import npm packages from a mirror source, integrity-checked (a6d5dd7)
• mirror: import python distributions via the PEP 691 simple API (7b9b53d)
• mirror: let an operator retarget a mirror package's source (01fb3fa)
• mirror: manage org-level mirror sources in the admin (dd5f8c8)
• mirror: schema for org-level mirror sources and the mirror source mode (ee14445)
• oci: a keep_untagged rule — untagged images survive N days by rule (1e09fa0)
• oci: add the Docker registry's interface (setup, empty state, tags) (2fda534)
• oci: add the retention policy schema and the columns the sweeper reads (6b1504b)
• oci: address a registry by path namespace on the instance host (5895a43)
• oci: administer retention policies, with an editor, dry run and guarded apply (f8d6d56)
• oci: evaluate retention rules with OR, and a shield that vetoes rather than selects (194188a)
• oci: exercise docker push/pull against a real docker client in E2E (b48ed75)
• oci: honour keep_untagged windows in the sweep, as timestamps (bbd234e)
• oci: let an operator opt into push-time repository creation (6c293b7)
• oci: let an owning org admin assign retention and write inline rules (4c48452)
• oci: live retention preview in the policy form and inline editor (1998f3d)
• oci: mark push-created repositories so the sweeper can reclaim the empty ones (cd4e0bf)
• oci: resolve and apply retention policies, with an audit trail (5880506)
• oci: resolve retention through four tiers, inline rules first (4aeb20a)
• oci: schema for inline retention rules, global policies and shared git credentials (3af64dc)
• oci: share git credentials across organizations, checked at sync time (a35c605)
• oci: show and assign a repository's retention policy on the package page (6dd0d13)
• oci: sweep unreachable storage, expired uploads and empty push-created repositories (b36e272)
• oci: the storage sweeper view (0e37f00)
• portal: offer setup for every type a registry may serve (33e89b1)
• portal: show a repository's retention policy and the next run's removals (12aefd6)
• portal: show how to connect before the package list (13aa57d)
• registry: accept oci blob uploads, chunked and monolithic (5e6dbfa)
• registry: add docker as a fourth package type (3b7d6db)
• registry: add OCI manifests and tags (0dcb80e)
• registry: add the oci blob, manifest, tag and upload tables (7911e96)
• registry: open the /v2/ endpoint with a basic-auth challenge (f67b75b)
• registry: serve oci blob bytes on GET, local stream and s3 redirect (81b474e)
• sidebar: nest E-Mail and Storage under System as a submenu (b5f4c25)

Bug Fixes

• admin: measure Docker repository size from referenced blobs, not manifest documents (fc2a53c)
• admin: stop hardcoding composer/npm/python lists across the package admin UI (23759d5)
• api-docs: render fully German operation descriptions (acc535b)
• correct stale docblocks, a migration placeholder and a test/name mismatch (1f65e8e)
• e2e: give the worker a real healthcheck instead of disabling it (0c24b99)
• e2e: make clean-store pulls independent of the daemon's image store (9b5a733)
• http: stop exempting the bare /v2 from the post-size guard (4ae0ace)
• i18n: render every relative timestamp in German (aaaf454)
• mirror: close the final-review gaps in the mirror-packages feature (c08e605)
• mirror: make import() iterate the same parsed entries the probe reports (5d75d08)
• mirror: never splice UpstreamException's English text into a German sync_error (0377326)
• mirror: refuse a MirrorSource type change while packages use it (31edd0c)
• mirror: stage npm tarballs behind integrity verification, not just shasum (6437e3f)
• mirror: sweep orphaned .part/.integrity-check staging on import (9de52cb)
• mirror: use replaceHeaders() so PythonMirrorImport's Accept truly overrides (6e97e04)
• oci: 403 on a non-global policy pick, and reset inline rules after clear (7125e96)
• oci: bound the manifest request body at 4 MiB (ab8c660)
• oci: challenge anonymous version pings on the path host (146fecd)
• oci: close the version check's public-domain credential gap and pin path mode (71c7314)
• oci: confine a corrupt inline rule set to its own package ([e677...

v0.9.0

0.9.0 (2026-09-07)

Features

• admin: assign a shared package to any registry, refusing name collisions (51a376c)
• admin: choose who may share packages, and date a shared assignment (9e8d63b)
• admin: let an authorized operator share a package (8cd7322)
• admin: let an operator change a registry slug (e26c2c0)
• admin: let an operator change an organization slug (c12e8ed)
• admin: let only the owner's administrators assign or withdraw a shared package (0cc514f)
• admin: name the portal address in the slug change confirmation (c5f2e06)
• packages: add the shared flag and the setting that governs it (8cd64c0)
• portal: address the portal by organization and let the operator switch it off (172713c)
• portal: carry each registry own availability date on its entry (86dd26f)
• portal: compose the customer package list from what the registries serve (3880fd5)
• portal: give the registries area a way in (dd5fcdf)
• portal: make the package list the customer landing page (85be34f)
• portal: say whose portal an operator is looking at (b9b48fd)
• portal: scope the registry pages to the addressed organization (e0c03ba)
• registry: count an assigned shared package as hosted locally (376a35c)
• registry: redirect pre-org-scoped registry urls to the canonical form (e64e294)
• registry: resolve a shared package assigned to the registry (30035ac)
• registry: scope the registry slug to its organization (5be25aa)

Bug Fixes

• admin: ask the ownership question the resolver asks, over the name and not the row (e38d239)
• admin: honour available_until in the shared-package guard, and fix its copy (09906f3)
• admin: let a share be withdrawn immediately, and stop the note misattributing an outage (afdb3d7)
• admin: name the one legacy address that survives an organization rename (e12ccf9)
• admin: pin the pivot no-op the permitted re-submission rests on (9a2196a)
• admin: show the /r/ path pattern, not bare slugs, in the org slug dialog (7e100df)
• admin: sort and search the registry list on the column it actually shows (7f5eeeb)
• admin: state the ownership rule existentially in the comments and the German too (2625859)
• admin: state the shared-package rule over the resulting set, and close the mirror (a19ce6c)
• admin: stop a partial organization update from disabling a customer portal (3e5037f)
• admin: stop claiming the old /r/ addresses survive an organization rename (d22bd36)
• admin: stop telling an operator to detach a name that detaching will not release (4746c8d)
• api: mark a lapsed registry assignment instead of returning it unmarked (349e766)
• docker: keep bin/ and phpunit.e2e.xml out of the production image (9571d22)
• e2e: escape pip token safely, reject a second bad bin/e2e argument (2e1e617)
• e2e: keep the composer install offline and assert the installed version (138096f)
• e2e: make the composer install test distinguish a dist install from a git fallback (289b6d7)
• e2e: raise the twine pin instead of freezing the fixture's setuptools (d756b14)
• e2e: register the npm package the seeder never created (4899a61)
• e2e: reuse the shared npm auth-key derivation and tighten the PyPI version check (f6e6f21)
• e2e: route the missing-context guard through fail() in bin/e2e (fabf28c)
• e2e: seed the python package and cover both publish-based rows (6f66594)
• e2e: tighten the refusal assertion and centralize the npm auth key (340b1cc)
• e2e: use the read token for the pip install test, not the leftover publish one (463e2c1)
• i18n: unify German address form to formal Sie across user-facing text (703cb78)
• packages: close a same-table slug race and correct guard docs (c7837d2)
• packages: close the organization/registry slug claim race (521a2ff)
• packages: compare python names PEP 503-normalised when refusing a shared collision (7691aa6)
• packages: derive the repository-url scheme guard from config (52be28e)
• packages: govern share-packages by operator-org maintainer, not admin (e1cbca8)
• packages: re-seed the sync status on resync and say when polling gives up (1e069d8)
• packages: reconcile the sync status instead of waiting for a broadcast (166ae97)
• packages: require SlugClaimGuard::claimRegistrySlug's organizationId (07cc85d)
• portal: ask the portal switch before the policy, so one surface has one answer (82c4f23)
• portal: bind the registry pages to the address and to what the registry serves (df7f6fb)
• portal: bind token revocation to the addressed organization (7b06717)
• portal: correct the number and the claim in the portal package copy (430216a)
• portal: drop the package pivot so a wrong date cannot be read off it (ad71dfa)
• portal: gate the setup tab's publish offer and drop th...

v0.8.0

0.8.0 (2026-09-02)

Features

• admin: own a created package where its registries are owned (da329f4)
• packages: give a package an owning organization (7213730)
• packages: scope the package name to its organization (f6ddc25)
• registry: resolve a package within the addressed organization (aebffb7)
• registry: scope the dependency-confusion guard to the organization (a56b2da)

Bug Fixes

• admin: refuse deleting an organization that still owns packages (2191334)
• api: refuse deleting an organization that still owns packages (17da89d)
• migrations: report the org-less registry before the ownerless package (8205adc)
• policies: stop GroupPolicy::view from crashing on a null organization_id (6ec70c5)
• registry: keep the organization null-guard truthful in RegistryAccessService (b8e9053)
• registry: refuse cross-organization package assignments at migration time (5ed6f4f)
• registry: scope the registry access service to the addressed organization (db677fc)
• tests: pair factory packages with their registry's organization (35a1965)

0.7.3 (2026-09-02)

Bug Fixes

• admin: send a submitted create form somewhere that shows the result (c5a7047)
• probe: authenticate the manifest read and stop hiding when it fails (e779888)

0.7.2 (2026-09-02)

Bug Fixes

• admin: allow toggling trusts_email_claim on existing OIDC providers (a6d5e03)
• admin: keep upstream credentials out of the session and say so in the form (522941a)
• admin: redact upstream mirror credentials from the console (d850492)
• admin: surface the real reason a package probe failed (5cc230f)
• auth: gate OIDC email-claim auto-linking behind per-provider trust (11e99dd)
• logging: rotate by default, keep the suite out of the dev log, cap Docker logs (94d8634)

0.7.1 (2026-08-27)

Features

• admin: resync a package from its detail page (84624cf)
• vcs: self-heal a foreign-owned git mirror by displacing it instead of failing forever (4dfda2a)

Bug Fixes

• 0.7.1: address whole-branch review findings across resync, mirrors, and host trust (483c3d4)
• http: let the health endpoint answer under any host (59a9bf0)
• vcs: abort a contended mirror sync instead of racing it, and stop shaving the lock TTL (711489b)
• vcs: close round-six's two Important findings and three cheap Minors (a5a6fa1)
• vcs: pin mirror check to its path and never delete on uncertainty (e847067)
• vcs: re-clone an unusable mirror and name a foreign owner (0f0d49c)
• vcs: size the mirror lock timings against the work they guard (8fc8b69)
• vcs: split the mirror lock budget by caller and close the kill paths (bd73166)

0.7.0 (2026-08-20)

Features

• activity: add a detail dialog showing changed fields and the raw payload (665f375)
• activity: add a JSON viewer that renders values as escaped text (c37f120)
• activity: add a validated page size and a newest/oldest direction toggle (e1347ac)
• activity: group log entries by day as tested logic (40f27eb)
• activity: replace the activity list with a timeline grouped by day (bdbae7c)
• admin: choose a notification cadence per organization (7a72038)
• admin: let an operator retire a package from its detail page (c748e6c)
• admin: manage notification recipients and their subscriptions (244a407)
• admin: move both webhook creation forms onto their own pages (abfa77d)
• admin: move the provider, token and package forms onto their own pages (34bc5c5)
• admin: move the user create and edit forms onto their own pages (c2fb3ee)
• admin: move upstream and git-credential forms onto their own pages (35fa3cd)
• api: expose and set package abandonment over the v1 API (4b06e59)
• auth: implement MustVerifyEmail so the verification gate actually gates (4c69eb0)
• composer: mark abandoned packages in the metadata document (24b50a0)
• docs: let an operator decline the third-party API browser (d3614ec)
• listings: add a sortable, filterable DataTable and use it for users (9c8ded5)
• listings: sort and filter credentials, robots, tokens and upstreams (53d7b49)
• listings: sort and filter domains, organizations, groups and providers (e8ef126)
• listings: sort and filter webhooks, the portal registry and token settings (1fbba72)
• listings: sort packages and activity server-side behind a column whitelist (03e1a6c)
• notifications: add recipients, recorded events and a per-organization cadence (3b41d53)
• notifications: add the event taxonomy and the digest folding rule (a059fcc)
• notifications: record sync and webhook failures for the digest (18d3748)
• notifications: send a folded failure digest per recipient ([9cb42a3](https://github.co...

v0.7.3

0.7.3 (2026-09-02)

Bug Fixes

• admin: send a submitted create form somewhere that shows the result (c5a7047)
• probe: authenticate the manifest read and stop hiding when it fails (e779888)

0.7.2 (2026-09-02)

Bug Fixes

• admin: allow toggling trusts_email_claim on existing OIDC providers (a6d5e03)
• admin: keep upstream credentials out of the session and say so in the form (522941a)
• admin: redact upstream mirror credentials from the console (d850492)
• admin: surface the real reason a package probe failed (5cc230f)
• auth: gate OIDC email-claim auto-linking behind per-provider trust (11e99dd)
• logging: rotate by default, keep the suite out of the dev log, cap Docker logs (94d8634)

0.7.1 (2026-08-27)

Features

• admin: resync a package from its detail page (84624cf)
• vcs: self-heal a foreign-owned git mirror by displacing it instead of failing forever (4dfda2a)

Bug Fixes

• 0.7.1: address whole-branch review findings across resync, mirrors, and host trust (483c3d4)
• http: let the health endpoint answer under any host (59a9bf0)
• vcs: abort a contended mirror sync instead of racing it, and stop shaving the lock TTL (711489b)
• vcs: close round-six's two Important findings and three cheap Minors (a5a6fa1)
• vcs: pin mirror check to its path and never delete on uncertainty (e847067)
• vcs: re-clone an unusable mirror and name a foreign owner (0f0d49c)
• vcs: size the mirror lock timings against the work they guard (8fc8b69)
• vcs: split the mirror lock budget by caller and close the kill paths (bd73166)

0.7.0 (2026-08-20)

Features

• activity: add a detail dialog showing changed fields and the raw payload (665f375)
• activity: add a JSON viewer that renders values as escaped text (c37f120)
• activity: add a validated page size and a newest/oldest direction toggle (e1347ac)
• activity: group log entries by day as tested logic (40f27eb)
• activity: replace the activity list with a timeline grouped by day (bdbae7c)
• admin: choose a notification cadence per organization (7a72038)
• admin: let an operator retire a package from its detail page (c748e6c)
• admin: manage notification recipients and their subscriptions (244a407)
• admin: move both webhook creation forms onto their own pages (abfa77d)
• admin: move the provider, token and package forms onto their own pages (34bc5c5)
• admin: move the user create and edit forms onto their own pages (c2fb3ee)
• admin: move upstream and git-credential forms onto their own pages (35fa3cd)
• api: expose and set package abandonment over the v1 API (4b06e59)
• auth: implement MustVerifyEmail so the verification gate actually gates (4c69eb0)
• composer: mark abandoned packages in the metadata document (24b50a0)
• docs: let an operator decline the third-party API browser (d3614ec)
• listings: add a sortable, filterable DataTable and use it for users (9c8ded5)
• listings: sort and filter credentials, robots, tokens and upstreams (53d7b49)
• listings: sort and filter domains, organizations, groups and providers (e8ef126)
• listings: sort and filter webhooks, the portal registry and token settings (1fbba72)
• listings: sort packages and activity server-side behind a column whitelist (03e1a6c)
• notifications: add recipients, recorded events and a per-organization cadence (3b41d53)
• notifications: add the event taxonomy and the digest folding rule (a059fcc)
• notifications: record sync and webhook failures for the digest (18d3748)
• notifications: send a folded failure digest per recipient (9cb42a3)
• npm: deprecate every version of an abandoned package (b3a55fc)
• packages: add a column for the rendered project readme (1162696)
• packages: add the value object that words an abandonment (b6429df)
• packages: convert existing npm git-mirror packages to publish (6f0ca7b)
• packages: make the enum decide which source modes a type may use (c32a4e9)
• packages: order package versions semantically for both detail pages (62b71b2)
• packages: reject the git-mirror mode for npm on both create paths (e951562)
• packages: store an abandonment with its replacement and reason (8ab60c7)
• pypi: publish a PEP 792 project status for abandoned packages (c8bdeda)
• pypi: serve the Simple API at version 1.1 (1c0490c)
• setup: scope the npm snippet and show both registry addresses (527c2e1)
• sidebar: keep nav sections collapsed unless they hold the current page (7eb93d9)
• sync: store the project readme without ever failing a sync over it (93e6dda)
• types: enforce Ziggy route names and params at compile time ([92ab2d2](https://github.com/NoiXdev/k...