v1.5.0

MirrorProxy 1.5.0

MirrorProxy 1.5.0 adds public Hugging Face HTTP downloads, local password
accounts, and single-use registration links that work without SMTP. It also
improves reverse-proxy diagnostics and resolves dependency and CodeQL findings.

Public Hugging Face downloads

• Use /huggingface as the endpoint for the official Hugging Face SDK and CLI.
  Model and dataset downloads support metadata requests, snapshots, pagination,
  HTTP Range, and resumed downloads, including streamed transfers from supported
  Hugging Face CDN hosts.
• Set HF_ENDPOINT=https://your-mirror.example/huggingface and
  HF_HUB_DISABLE_XET=1. Native Xet transport is not supported.
• This first version serves public resources only. Client Authorization and
  cookies are not forwarded, and server-side upstream_auth is not applied.
  Private repositories and resources requiring authentication are unsupported.
• Every Hugging Face request bypasses the server cache. This release does not
  add a model cache; SDK-managed local client caches remain independent.
• The shared source catalog, Web console, CLI environment examples, health
  checks, and English/Chinese guides include the new source. Existing
  installations must add huggingface to their effective enabled_proxies
  setting to enable it.
• CDN transfers validate targets and resolved addresses, pin DNS resolutions,
  and check redirects. Unsafe paths and private-address destinations are rejected.

Local accounts and registration invitations

• Administrators can create password accounts directly and assign a billing
  group and quota without configuring an email service.
• Administrators can issue expiring, single-use registration links. Recipients
  choose their own account name and password; administrator-assigned billing
  settings cannot be overridden during registration.
• Invitation tokens are carried in URL fragments. Previewing a link or failing
  registration does not consume it; successful registration redeems it atomically.
• Users can change their passwords. Password hashes use Argon2, and the
  existing authorization, CSRF, login limits, audit, and quota controls remain.
• Existing email invitations, email accounts, identity providers, and passkeys
  remain supported. Disabling new-user registration also blocks issuing and
  redeeming registration links; administrators can still create accounts directly.
• Reverse-proxy connection diagnostics help identify public URL, protocol,
  forwarded-header, and session problems. Invitation navigation and account form
  behavior have additional browser regression coverage.

Security and dependency maintenance

• Update rustls-webpki to 0.103.16 and webpki roots/certificates to 1.0.10
  for certificate trust fixes. Remove SQLx's unused database TLS feature because
  the application uses local SQLite; network clients retain TLS verification.
• Update Vite to 8.1.6 and replace yanked spin and chacha20 versions with
  compatible patches. Release builds enforce Cargo.lock.
• Resolve CodeQL findings and strengthen native HTTPS regression coverage to
  verify certificates.
• RSA advisory exception remains: openidconnect 4.0.1 depends on
  rsa 0.9.10, which has no patched version for RUSTSEC-2023-0071. MirrorProxy
  uses it for OIDC public-key signature verification, not RSA private-key signing
  or decryption. The affected private-key path is not used. CI excludes only
  this advisory; an unfiltered audit still reports it. See
  SECURITY.md
  for the rationale and reassessment conditions. This is not a claim that the
  dependency vulnerability has been fixed.

Compatibility, upgrade, and rollback

• Local-account support automatically upgrades SQLite to schema 4. Back up
  the database before starting the new server. Preserve configuration, cache,
  GeoIP inputs, and any encryption master key.
• Existing routes and configuration remain compatible; local accounts do not
  require new TOML settings. Enabling Hugging Face is optional.
• Verify the archive against SHA256SUMS, keep the previous binary, and
  restart with the existing service configuration after replacement.
• To roll back to v1.4.4, restore the previous binary together with the
  pre-upgrade database backup. Accounts and changes created after that backup
  will not be present in the restored database.
• Publishing this version does not replace an installed production service.

Verification and delivery

Validation covers locked Rust workspace tests, strict Clippy, frontend tests,
browser E2E, administrator API/browser smoke, and dependency audits with the
documented RSA exception. CI and CodeQL must pass for the exact release commit
before tagging.

Hugging Face protocol validation also exercised the official SDK and CLI,
model and dataset payload digests, snapshot downloads, metadata, pagination,
and Range/resume through the deployed public endpoint. A large model was
checked with metadata and partial safetensors reads, not a full-file download.

The release workflow publishes cross-platform clients, Linux server archives,
native Linux packages, checksums, signed APT contents, and Homebrew/Scoop/WinGet
metadata. Release verification downloads a representative archive, verifies its
published checksum, and checks the unpacked binary version. Docker images and
signing run independently and may finish later.

Full comparison: v1.4.4...v1.5.0