Artifact Keeper Web 1.2.0

Artifact Keeper Web 1.2.0 ships alongside the artifact-keeper 1.2.0 backend. The headline work is the Maven repository browser overhaul, the return of proxy-cached artifacts to the UI, repository-dialog accessibility (WCAG 2.2 AA), and the settings surfaces that back the 1.2.0 backend features (rate-limit exemptions, proxy cache TTL, package age policy, feature-flag gating).

Container images:

• Docker Hub: docker pull artifactkeeper/web:1.2.0 (or :latest)
• GHCR: docker pull ghcr.io/artifact-keeper/artifact-keeper-web:1.2.0 (or :latest)

Sponsors

Thank you to our backers for supporting ongoing development:

• Ash A. (@dragonpaw)
• Gabriel Rodriguez (@injectedfusion)

Become a sponsor to support the project and get your name listed here.

Thank You

This release closes a batch of community-reported bugs and feature requests. Thanks to everyone who filed detailed issues on the Maven browser (#441, #442, #443, #444, #445), the missing proxy-cached artifacts (#424), the host-less download URL (#455), and the sidebar version display (#456). Your reports drove most of this release.

Highlights

• Maven repository browser overhaul: search artifacts by their GAV coordinates (#441), find the POM for a GAV (#442), pagination in grouped mode (#443), open artifact details from a grouped GAV (#444), and a complete file listing including .zip and checksum sidecars (#445)
• Proxy-cached artifacts show in the UI again (#424): remote/proxy repositories list their cached objects in the Artifacts tab, paired with the backend listing reconstruction
• Remote repository cache management: Invalidate cache action on the artifact details dialog (#446), editable proxy cache TTL on the Settings tab (#448), and cached_at / expires_at surfaced on artifact details (#449)
• Repository dialog accessibility (WCAG 2.2 AA): screen-reader feedback on upstream-auth save (#410), form errors linked via aria-describedby + role=alert (#411), focus management on the auth view toggle (#412), and the broader dialog + SSO settings audit (#413)
• Repository settings expansion: release target configuration (#260), routing rules management (#263), package age policy UI (#265)
• Admin and system surfaces: configurable upload size limit (#189), rate-limit exemption management (#270), and feature-flag gating driven by /api/v1/system/config (#271)
• Search UI updates for the OpenSearch backend (#269)
• Fixes: host-less Download URL now resolves to a working absolute URL (#455), the sidebar shows the backend version even when /health is non-2xx (#456), and download/migration ticket resource_path matches the request path so UI downloads succeed (#453)

See CHANGELOG.md for the full categorized list.

---

What's Changed

• fix: skip trailing-slash redirect so /v2/ reaches docker proxy by @brandonrc in #338
• fix(middleware): harden SSE early-return against trailing-slash variants by @brandonrc in #339
• test(e2e): add Docker /v2/* header forwarding suite by @brandonrc in #340
• ci(release): add release/1.1.x branch + :1.1-dev tag rule + v1.1.8 postmortem by @brandonrc in #341
• chore: bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #321
• chore: bump vitest from 4.1.4 to 4.1.5 by @dependabot[bot] in #327
• chore: bump eslint-config-next from 16.2.2 to 16.2.4 by @dependabot[bot] in #328
• chore: bump @tanstack/react-query from 5.99.2 to 5.100.9 by @dependabot[bot] in #329
• chore: bump lucide-react from 1.8.0 to 1.14.0 by @dependabot[bot] in #325
• chore: bump typescript from 5.x to 6.0.3 by @brandonrc in #344
• chore: bump react and react-dom from 19.2.4 to 19.2.5 (combined) by @brandonrc in #343
• chore: bump tailwindcss from 4.2.2 to 4.2.4 by @dependabot[bot] in #322
• chore: bump @artifact-keeper/sdk from 1.1.4 to 1.1.6 by @dependabot[bot] in #324
• chore: bump react-hook-form from 7.72.1 to 7.74.0 by @brandonrc in #345
• chore: refresh fast-xml-parser and @aws-sdk/xml-builder by @brandonrc in #346
• fix(settings): wire Storage tab to runtime config by @ssorathia in #335
• ci: pin third-party GitHub Actions to commit SHAs by @brandonrc in #353
• fix: surface backend error details in mutation toasts by @brandonrc in #357
• fix(a11y): aria attribute coverage audit on admin pages by @brandonrc in #358
• refactor(api): replace double-casts with adapters, narrowing helpers, and zod by @brandonrc in #360
• fix(setup): show Gradle and SBT snippets on Setup Guide for JVM repos by @brandonrc in #363
• fix(migration): add Source Type selector to Add Connection dialog by @brandonrc in #364
• fix(login): hide username/password form when only OIDC/SAML is configured by @brandonrc in #366
• fix(login): protocol-aware SSO button label when provider name is generic by @brandonrc in #367
• fix(utils): harden formatBytes against pathological numeric input by @brandonrc in #370
• refactor: extract mutationErrorToast helper to deduplicate ~120 callsites by @brandonrc in #371
• fix(error-utils): prefix fallback with HTTP status code by @brandonrc in #372
• fix(error-utils): truncate long backend error messages at 240 chars by @brandonrc in #373
• fix(settings): surface load failures in getPasswordPolicy and getSmtpConfig by @brandonrc in #374
• refactor(settings): consolidate three admin-settings useQuery calls into one by @brandonrc in #375
• refactor(api): extend #206 type-safety to monitoring + lifecycle (#359 batch 1) by @brandonrc in #376
• refactor(api): extend #206 type-safety to webhooks + analytics (#359 batch 2) by @brandonrc in #377
• refactor(api): extend #206 type-safety to telemetry (#359 batch 3) by @brandonrc in #379
• refactor(api): extend #206 type-safety to replication (#359 batch 4) by @brandonrc in #380
• refactor(api): extend #206 type-safety to sbom (#359 batch 5) by @brandonrc in #381
• refactor(api): extend #206 type-safety to dependency-track (#359 batch 6) by @brandonrc in #382
• refactor(api): extend #206 type-safety to promotion (#359 batch 7) by @brandonrc in #383
• refactor(api): extend #206 type-safety to security (#359 batch 8) by @brandonrc in #384
• refactor(api): extend #206 type-safety to sso (#359 batch 9, final, closes #359) by @brandonrc in #385
• fix(package-utils): emit Gradle/SBT-native snippets instead of Maven XML (#361) by @brandonrc in #386
• feat(security-tab): surface native scan_findings on per-artifact Security tab (#368) by @brandonrc in #387
• fix(setup): sanitize repo keys for Gradle property names + clearer SSR placeholder (#362, partial) by @brandonrc in #388
• fix(sse): extend EVENT_TYPE_MAP to webhook/artifact/scan/backup/plugin events (#213) by @brandonrc in #389
• chore: enforce PR-issue link via GH Actions by @brandonrc in #426
• chore: bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in #420
• chore: bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in #393
• chore: bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #394
• chore: bump next from 16.2.4 to 16.2.6 by @dependabot[bot] in #401
• chore: bump @tailwindcss/postcss from 4.2.2 to 4.3.0 by @dependabot[bot] in #397
• chore: bump @aws-sdk/client-polly from 3.1032.0 to 3.1045.0 by @dependabot[bot] in #405
• fix(repositories): always render secondary name line for consistent card heights by @dragonpaw in #423
• chore: bump zod from 4.3.6 to 4.4.3 by @dependabot[bot] in #398
• chore: bump @types/node from 25.6.0 to 25.6.2 by @dependabot[bot] in #404
• chore: bump tailwindcss from 4.2.4 to 4.3.0 by @dependabot[bot] in #403
• chore: bump eslint-config-next from 16.2.4 to 16.2.6 by @dependabot[bot] in #402
• fix(ci): count only changed lines in coverage gate; exclude deletions from jscpd by @brandonrc in #428
• chore: bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #395
• chore: bump tailwind-merge from 3.5.0 to 3.6.0 by @dependabot[bot] in #396
• chore: bump react-dom from 19.2.5 to 19.2.6 by @dependabot[bot] in #400
• fix(repositories): sort Format options alphabetically in Create dialog by @dragonpaw in #422
• fix(repositories): reset create form when dialog reopens by @dragonpaw in #421
• feat(artifact-browser): grouped view by Maven component and Docker tag by @brandonrc in #419
• fix(setup): use download endpoint for Generic artifact example by @brandonrc in #409
• chore: bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #391
• chore: bump react-qr-code from 2.0.18 to 2.0.21 by @dependabot[bot] in #399
• fix(forms): persistence bugs in remote-repo create, OIDC/SAML update, webhook payload_template by @brandonrc in #414
• release: web v1.2.0 (milestone batch + review fixes) by @brandonrc in #466

New Contributors

• @ssorathia made their first contribution in #335
• @dragonpaw made their first contribution in #423

Full Changelog: v1.1.3...v1.2.0