v0.3.0

Added

• Go module registry adapter — pull Go modules through Jōei
  (GOPROXY=http://<jo-ei>/go) so module zips pass the supply-chain, CVE, and
  malware gates. Metadata endpoints (.info / .mod / @v/list / @latest)
  are proxied transparently. Disabled by default (registries.go).
• Offline by-digest Docker pulls — a by-digest pull with a fresh cached
  verdict is served straight from the cache, without contacting the upstream
  registry; an expired verdict falls back to the cached artifact when the
  upstream is unreachable. By-tag pulls still need the upstream to resolve the
  digest.

Changed

• Coalesced re-checks — concurrent lazy re-checks of one expired cache
  entry, and concurrent Docker evaluations of one image digest, now collapse
  into a single scan (singleflight) whose verdict every waiting request shares.

Docker image: docker pull ghcr.io/ggwplab/jo-ei:0.3.0

v0.2.0

Lazy per-gate TTL re-validation replaces the background sweep: cache
hits re-run only the expired gate (CVE / malware, separate TTLs) and
evict entries that now fail; Docker image verdicts expire and re-run
the full gate with blob cascade. On-demand cache cleanup from the
console. Re-validation load now scales with traffic, not cache size.

See CHANGELOG.md for details.

v0.1.0

First public release.

Added

• Transparent proxy for PyPI, npm (with a Yarn alias), Maven, and RubyGems
  with multi-upstream failover per ecosystem, and a Docker Hub pull-through
  registry mirror (Registry v2 API).
• Supply-chain min-age gate: packages younger than a configurable
  threshold (24h default) are held with HTTP 423; enforce / dry_run /
  off modes.
• CVE gate backed by osv.dev with a configurable severity threshold and
  TTL-cached scan results; fails closed on scanner errors.
• Malware gate: pluggable engines — ClamAV (clamd protocol) and any
  ICAP-speaking scanner (Kaspersky, Dr.Web, …); all engines scan every
  artifact, any detection blocks, verdicts are never allowlisted.
• Trivy image gate for Docker pulls (vulnerability + secret scanning,
  client/server mode); the verdict is decided on the manifest request so a
  rejected image is never served.
• Artifact cache with LRU eviction and periodic revalidation sweeps
  that re-run the gates over cached entries and evict newly failing ones.
• Policy profiles (dev/staging/production) with per-gate allowlists and a
  denylist; runtime edits via the console persist to the database and apply
  without restart.
• Admin console (embedded React SPA, works offline, no npm toolchain) with
  overview dashboard, live request feed (SSE), quarantine queue, policy
  editor, and registries/cache view — behind HTTP Basic auth (bcrypt,
  fail-closed when unconfigured).
• Persistent telemetry: request events, per-day metrics, and lifetime
  counters in embedded SQLite (pure Go) with configurable retention.
• Scanner health probes surfaced in the console.
• Operational hardening: per-upstream-host concurrency caps, token-bucket
  rate limiting, 429/503 circuit breakers, malware-scan concurrency limits,
  structured JSON logging.
• Distroless non-root Docker image and a compose stack with ClamAV and Trivy
  sidecars.

Docker image: docker pull ghcr.io/ggwplab/jo-ei:0.1.0