v2.1.1

Features

• The upstream metadata documents that proxies hold at once while reading them
  share one budget per instance, proxy.max_metadata_memory_bytes (256 MiB by
  default). A read that would go over it waits for others to finish, up to
  proxy.metadata_timeout_seconds, then answers 503 with Retry-After, where
  before a restore against a cold proxy could grow the process past its memory
  limit and have it killed. The deployment guide's
  Memory section relates it to the pod's limit.
  (#668)
• forge-server allocates memory with jemalloc instead of glibc's malloc.
  Memory freed after a burst of requests, mostly large proxy metadata
  documents, goes back to the system after about 10 s. With glibc it mostly
  stayed with the process, whose resident memory climbed under load toward the
  pod's memory limit and hardly came down. jemalloc takes its run-time options
  from _RJEM_MALLOC_CONF (Memory allocator in the deployment guide);
  glibc's MALLOC_* variables no longer apply.
  (#669)
• Forge can publish patch releases of an older line, from its maintenance
  branch, while main heads for the next minor version: 2.1.1 ships 2.1.0's
  fixes without 2.2.0's changes. The image's :<major>.<minor> tag follows a
  line's newest patch, and :latest the newest release of all.
  (#674)

Fixed

• An npm proxy parsed the whole upstream packument into memory for every
  operation of a packument read, several times its size each: reading the full
  packuments of typescript, @types/node, react-dom, tailwindcss and
  vite at once took over 600 MiB, and OOMKilled pods with a 1 GiB limit. Each
  operation now reads only what it needs of it, a quarter of that. A full
  packument larger than proxy.max_metadata_bytes (vite's, 39 MB) no longer
  answers 500: the full packument Forge serves leaves out the upstream's publish
  times and the README, and a version's manifest comes from the version's own
  document. A document over that limit is not downloaded again until the
  metadata TTL has passed.
  (#671)

Security

• The web UI's router serializes its state with seroval, which before 1.6.11
  let serialized output inject code (GHSA-f86p-h4j2-7qgj, GHSA-9wx9-5pv9-3349);
  the web UI now gets 1.6.12.
  (#677)

Image

ghcr.io/forgepkg/forge on GitHub Packages.

Built from commit 5e06a1a, which v2.1.1 points to. The cosign verify commands below accept only a signature by this repository's release workflow for that tag and that commit.

One image for linux/amd64, linux/arm64: the digest below is that of the index of the platforms' images (listed under it), from which docker pull and Kubernetes take the node's platform. The index and each platform's image are signed: the cosign verify command passes for each of these digests.

docker pull ghcr.io/forgepkg/forge:2.1.1
# digest: sha256:5fab42d1c9545984500615366b5eef2007e581c0ecbd05dadff36151134a4a59
#   linux/amd64: sha256:de0f7d31103d3609ccc6b648013b62e0fb2a2f3eeef788785f0c403a10e5805a
#   linux/arm64: sha256:763ee55d5d68bbb6f2a77afd16f01015eb0bc91112a7d6f586174d2943064fa0
cosign verify ghcr.io/forgepkg/forge@sha256:5fab42d1c9545984500615366b5eef2007e581c0ecbd05dadff36151134a4a59 \
  --certificate-identity https://github.com/forgepkg/forge/.github/workflows/release.yml@refs/tags/v2.1.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-sha 5e06a1acf07f97ddd6c8a5bf87f2126b9f28a261 \
  --certificate-github-workflow-trigger push

Helm chart

oci://ghcr.io/forgepkg/charts/forge on GitHub Packages.
Deploys exactly the image above (by digest).

helm install forge oci://ghcr.io/forgepkg/charts/forge --version 2.1.1
# digest: sha256:b0b2d93ff6cc0757040f82ca7e073462bebd5f357eb24499dc6cf3347e8c22bd
cosign verify ghcr.io/forgepkg/charts/forge@sha256:b0b2d93ff6cc0757040f82ca7e073462bebd5f357eb24499dc6cf3347e8c22bd \
  --certificate-identity https://github.com/forgepkg/forge/.github/workflows/release.yml@refs/tags/v2.1.1 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-github-workflow-sha 5e06a1acf07f97ddd6c8a5bf87f2126b9f28a261 \
  --certificate-github-workflow-trigger push