Skip to content

CHANGELOG.md

Latest commit

 

History

History
431 lines (264 loc) · 45.8 KB

CHANGELOG.md

File metadata and controls

431 lines (264 loc) · 45.8 KB
Raw

Changelog

0.19.0 (2026-10-30)

⚠ BREAKING CHANGES

  • api: a diff-commit patch that does not apply now gets 409 conflict instead of 422 invalid, and a diff payload that is not a valid patch or that names an invalid path now gets 400 invalid instead of 422.
  • api: GET .../files without recursive lists every file in the tree instead of the direct children. It answers 422 when that listing passes the 64 MiB git output budget. Send recursive=false to get the direct children.
  • api: when another writer moves the branch after the server wrote the commit, commit-pack and diff-commit now answer 409 with result.status failed instead of conflict, and the body carries the written commit in commit and result.new_sha.
  • api: GitHub sync creates during a rolling upgrade. Only an upgraded worker adopts the GitHub default branch for a sync create that omits default_branch. A sync that an older worker runs leaves the repo on main until the next sync by an upgraded worker. An older replica's PATCH /repo to main before that sync does not stop the adoption, so the repo still moves to the GitHub branch. Upgrade every replica before you send GitHub sync creates that omit default_branch, or send default_branch explicitly. Tracked in #609.
  • api: a commit-pack or diff-commit request that changes nothing now gets 412 precondition_failed "no changes to commit" instead of an empty commit. A commit-pack or diff-commit stream that ends before its eof chunk now gets 412 instead of 400.
  • api: GET /api/v1/repos/files/metadata and GET /api/repos/{repo_name}/files/metadata now send only the subject line of each commit message in the commits map (the first paragraph as one line, the same as git's %s). Clients that need the body or the trailers must read GET /api/v1/repos/commit.
  • api: GET /api/v1/repos/commits and GET /api/repos/{repo_name}/commits now send only the subject line of each commit message (the first paragraph as one line, the same as git's %s). Clients that need the body or the trailers must read GET /api/v1/repos/commit.
  • api: files and files/metadata calls without limit and cursor return every entry instead of one page, and files/metadata answers 429 when the files under path have more than 50,000 distinct last commits.
  • api: a failed merge guard on POST /api/v1/repos/merge and POST /api/repos/{repo_name}/merge now answers code ref_guard_failed instead of conflict, with guard and current_sha members. A merge with expected_source_sha whose source branch does not exist answers 409 ref_guard_failed with current_sha 40 zeros instead of 404. Clients that branch on code conflict for a merge guard must check ref_guard_failed.
  • api: a stale expected_target_sha on POST /api/v1/repos/merge and POST /api/repos/{repo_name}/merge now answers 409 with a problem body, code conflict, instead of 412 with result.status precondition_failed. Raw HTTP callers that check for 412 must check for 409 and the conflict code. SDK callers keep the same error type.
  • api: POST /repos now answers 200 with the existing repo instead of 409 for a plain, copy or fork create of a name that a finished repo without an upstream holds. A repeat copy or fork answers before it reads its source.
  • api: POST /repos now answers 503 with Retry-After instead of 409 for a plain, copy or fork create of a name whose fork or copy create has not finished, including one that crashed or whose last step failed. A sync create pending after its upstream link was removed gets the same answer. DELETE /repos/delete clears such a name.
  • s3wal: S3WAL only, PostgreSQL and SQLite are not affected. An S3WAL bucket written by v0.16.0 through v0.18.0 must be converted before this release serves it. Stop serve and wait for it to exit, take a backup, replace the binary, run openstorage s3wal-meta convert --to 2, then start serve. Upgrade an older bucket to v0.18.0 first. To go back, stop serve, take a backup, and run openstorage s3wal-meta convert --to 1 with this release before starting the older release. See docs/how-to/deploy-production.md#upgrading-the-s3wal-metadata-format.
  • api: POST /repos with upstream or a base_repo sync, for a name that a repo with the same upstream and the same forward_pushes holds, now answers 200 with the existing repo instead of 409. A repeat create of a pending sync repo by a token with only repo:write now answers 403 instead of 409.

Features

  • api: a fork or copy is pending until its ref write (#450) (49bc1ac)
  • api: a repeat create of a finished repo answers 200 (#453) (295de82)
  • api: a repeat sync create of the same upstream answers 200 (#438) (0a4994f)
  • api: answer a stale merge expected_target_sha with 409 conflict (#536) (198cc45)
  • api: answer failed merge guards with 409 ref_guard_failed (#571) (d7c1eb8)
  • api: honor expected_source_sha on merge (#535) (0341af9)
  • api: name invalid fields from the single-field body validators (#443) (e1beeeb)
  • api: name the invalid field in invalid_params on body decode failures (#436) (66f5c32)
  • api: send a Deprecation header on the deprecated pull-upstream and base routes (#460) (ea43a01)
  • api: send only the subject line in commit list entries (#575) (f0c975a)
  • api: send only the subject line in files/metadata commits (#579) (5e9bbe6)
  • meta: add the ADR-50 schedule transitions for S3WAL metadata v2 (#448) (27b24bd)
  • meta: add the S3WAL metadata v1/v2 conversion (ADR-51) (#441) (ba8365a)
  • meta: complete the S3WAL local schedule (#449) (ae6e3a0)
  • s3wal: repair or refuse unfinished creates on convert --to 1 (#489) (5b06087)
  • s3wal: run S3WAL upstream syncs on the durable local schedule (#451) (f0153d4)
  • s3wal: schedule upstream syncs from S3WAL git-surface pushes (#454) (f5d362a)
  • s3wal: serve reads metadata format v2; add s3wal-meta convert (#444) (116175f)
  • s3wal: store create state in metadata v2; release-pair harness covers conversion and downgrade (#446) (cb885a7)

Bug Fixes

  • api: add ref_guard_failed problem members to the notes 409s (#573) (0e6133b)
  • api: answer "repository already detached" on DELETE .../upstream without an upstream (#468) (6005169)
  • api: answer 409 conflict when a diff-commit patch does not apply (#611) (77424c8)
  • api: answer 412 no changes to commit on commit writes that change nothing (#605) (54f9bca)
  • api: answer 413 when a commit-pack passes 262144000 decoded bytes (#610) (e491cf4)
  • api: answer a lost commit CAS with 409 failed and the written commit (#606) (9cec7ea)
  • api: answer the pack-reservation 429 with status unavailable (#600) (dc40992)
  • api: list files recursively when the call sends no recursive (#602) (8cb2588)
  • api: page recursive files listings without listing the whole tree (#614) (5620494)
  • api: read path params and tree paths literally in git pathspecs (#578) (0a39336)
  • api: return every entry from file listings without limit or cursor (#572) (3ff6012)
  • api: take the GitHub default branch when a sync create omits default_branch (#607) (f6d96da)
  • compose: give serve 30 s to drain and tear down on docker stop (#493) (a09d656)
  • deploy: stop the AWS systemd unit with KillMode=mixed (#479) (a4be26e)
  • deps: bump Go toolchain to 1.27.3 for GO-2026-6809 (#546) (f58a6f0)
  • deps: bump gocloud.dev to v0.47.0 for the fileblob root-key fix (#510) (0274c7e)
  • deps: bump golang.org/x/net to v0.62.0 (GO-2026-6860, GO-2026-6866) (#622) (7a11b9c)
  • githttp: report stale ref locks and document their manual removal (#485) (dda15af)
  • gitread: frame git log fields with NUL bytes (#582) (6458ece)
  • gitread: read commit dates that git cannot parse (#584) (fca3943)
  • gitread: read grep paths that hold a newline (#585) (e42338e)
  • gitread: return blame original_path unquoted (#591) (d283ba4)
  • image: bump the alpine runtime base to 3.24.3 (#551) (302960e)
  • jobs: bound River.Close when no drain stopped the jobs (#642) (23b715e)
  • jobs: give River jobs a 2-hour deadline instead of River's 1-minute default (#637) (47cc9bc)
  • jobs: rescue crashed sync and push jobs once their claim lease expires (#644) (c82e7dc)
  • s3wal: complete the --force help and share the op-log scope names (#500) (f69d4f6)
  • s3wal: give the meta.json quarantine one clear error and document it at the hook (#528) (e182cba)
  • s3wal: keep serve running when meta.json goes back to an older seq (#496) (287cda6)
  • s3wal: latch the rollback refusal when a cached meta.json stops decoding (#514) (5cbaba6)
  • s3wal: quarantine meta.json until restart when an edit is found after adoption (#523) (d45ad2a)
  • s3wal: refuse a hook ref update on a corrupt meta.json (#476) (aab68a4)
  • s3wal: refuse a hook ref update on a metadata format mismatch (#465) (c3f6d8c)
  • s3wal: reject every row content the background loops rely on at meta.json decode (#518) (3fb638d)
  • s3wal: reject impossible id counters in meta.json instead of panicking (#486) (48076b6)
  • s3wal: route every meta.json latch through one refusal choke point (#522) (c49b99b)
  • s3wal: tag org-key refresh round trips in the S3 op log (#498) (8ae1314)
  • s3wal: turn meta.json lane-shape and counter panics into corrupt-document errors (#509) (2c70de2)
  • serve: stop git children when the shutdown drain times out (#472) (66fedf1)
  • serve: stop REST and hydration git children on drain timeout (#483) (84394f6)

Performance Improvements

  • gitread: diff only what can change a files/metadata answer (#586) (38fb0be)
  • gitread: send last-commit diffs ahead within a window (#589) (e5d34fd)
  • s3wal: reuse the decoded meta.json on a 304 for read-only callers (#495) (1a1a201)

0.18.0 (2026-10-13)

⚠ BREAKING CHANGES

  • sync: a REST write or git push from a token whose ref policies carry any op no longer schedules the inbound upstream sync on PostgreSQL, or for REST writes on SQLite and S3WAL. The write stays local, and the repository converges on the next write, pull-upstream or push-upstream from a token without policy ops. In a mixed fleet, replicas on an older binary still schedule the sync for such writes until they are upgraded.

Features

  • api: add RFC 9457 instance to problem-details error bodies (#420) (6b23ae9)
  • api: emit upstream's specific not-found and conflict problem codes (#435) (5cadc73)
  • api: emit upstream's specific problem codes from the central helpers (#428) (b14fa58)
  • api: pull-upstream finishes a pending sync create (#432) (deef8b1)

Bug Fixes

  • deps: bump Go toolchain to 1.27.2 for stdlib security fixes (#434) (04a3eea)
  • jobs: a PostgreSQL sync create completes only while its upstream is linked (#423) (c034b20)
  • release: keep release binaries' VCS stamp clean (#415) (3bd4897)
  • s3wal: restart a pull that crashed holding its claim (#427) (464c1c2)
  • sync: deny the implicit sync poke for ref-policy-restricted tokens (#426) (dacd7cd)

0.17.0 (2026-10-12)

⚠ BREAKING CHANGES

  • config: openstorage no longer reads CODESTORAGE_* environment variables. Rename each one to its OPENSTORAGE_* name before you upgrade. A process that still sets an old name without its replacement refuses to start and names the variables to rename.

Features

  • compose: accept a registry image in the Docker-only quickstart (#406) (22346a4)
  • config: remove the CODESTORAGE_* environment fallback (#413) (f70ee39)

0.16.0 (2026-10-09)

⚠ BREAKING CHANGES

  • api: Commit.date now means the author date. Read the new committer_date field for the committer date.
  • api: POST /api/v1/repos returns 201 instead of 200 for a new repository, the success message text changes, and a create of a deleted repo's name returns 404 instead of 409. The Go and TypeScript SDKs accept any 2xx.
  • auth: RSA organization public keys must be at least 2048 bits. The server checks this at key ingestion and on every request, including keys already stored, so rotate weaker keys before you upgrade. (#253)
  • webhooks: send outbound push-upstream runs as repo.push_upstream.* events (#358)
  • The Go module path is now github.com/coder/openstorage (was github.com/coder/open-storage). Update go install commands, go.mod requirements and imports. (#225)

Features

  • api: accept optional repo_name in POST /repos (#299) (3a68bc9)
  • api: accept restore-commit base_ref with the spec's 412 preconditions (#383) (b0ddce7)
  • api: accept upstream on repo create and expose it on repo GET (#361) (f6a6d33)
  • api: add organization metadata endpoint (#286) (536e096)
  • api: add RFC 9457 problem-details fields to the error envelope (#351) (1f392ac)
  • api: add topological order rank to files/metadata commits (#337) (516ee3d)
  • api: allocate omitted branch targets (#239) (3663fae)
  • api: answer POST /repos 201 on create and 404 for a deleted name (#390) (127be7d)
  • api: bound memory, time and concurrency of read-side git subprocesses (#324) (0fec21e)
  • api: serve the path-style notes/append, upstream/pull and DELETE upstream routes (#382) (718d3a5)
  • cli: add fail-closed keygen bootstrap mode (e32d58f)
  • compose: add a local-build Docker-only quickstart (#256) (e374aad)
  • deploy: add Terraform AWS EC2 reference (#254) (d94125f)
  • githttp: bounded push-publication wait primitive (#332) (474791e)
  • githttp: commit-graph refreshes join the shared git chokepoint; outcome log contract and metric (#338) (cb8b33a)
  • meta: add CreateLinkedRepo, an atomic repo + upstream (+ credential) create (#389) (c3af22a)
  • meta: record a per-repository create state (#391) (f677626)
  • meta: SQLite local schedule state and transitions (#336) (549d37c)
  • metrics: add opt-in Prometheus metrics listener (#327) (372a4b3)
  • sync: schedule a sync create's first sync with its create mark (#392) (0c6c2c2)
  • sync: SQLite git-surface pushes schedule sync and forwarding (#345) (897ccd1)
  • sync: SQLite local worker and schedule sweep (#341) (edb0eeb)
  • webhooks: send org, type and repository.repo_name (#368) (05f083a)
  • webhooks: send outbound push-upstream runs as repo.push_upstream.* events (#358) (c69bcc7)

Bug Fixes

  • api: accept current upstream field names and DELETE query params (#379) (a26fcc3)
  • api: accept uppercase full SHAs and reject duplicate strict-JSON members (#384) (87b06ec)
  • api: accept uppercase guard SHAs and walk strict request types (#386) (9efd9d7)
  • api: deny sync repo creates for ref-policy-restricted tokens (#395) (db465a2)
  • api: omit exhausted pagination cursors and refresh upstream spec (#377) (6851ff9)
  • api: report the author date as Commit.date and add committer_date (#401) (cf05eff)
  • api: resolve a relative cache dir once at startup and in api.New (#366) (b590932)
  • api: stage the fork pack on the pack dir's filesystem (#362) (fcb7816)
  • auth: reject non-canonical base64url in JWT segments (#323) (2ee1cfb)
  • auth: require 2048-bit RSA organization public keys (5b17f02)
  • ci: make the legacy MinIO qualification lane opt-in (#308) (c01ad82)
  • ci: restore the legacy MinIO fixture source (#251) (5f172c5)
  • deps: update x/crypto to address SSH advisories (#233) (de71d60)
  • githttp: serialize cold cache initialization (#252) (915d4be)
  • gitread: pin git's message locale so heap-cap failures classify as 422 (#340) (870a647)
  • jobs: keep River sync runs uncounted across serve shutdown (#347) (b224898)
  • s3wal: name missing lease holder in corruption diagnostics (#302) (6bf383a)
  • s3wal: preserve evidence in lease refusal diagnostics (#270) (84101df)
  • sync: keep in-flight local runs' requests across serve shutdown (#344) (bba1986)
  • sync: send upstream's default username when none is stored (#402) (ed1b409)
  • sync: send x-token-auth for Bitbucket credentials without a username (#398) (6cb11d3)
  • test: accept trailing slash on fake S3 bucket requests (#330) (347f59d)
  • use the canonical openstorage repository and Go module (#225) (c877535)

Performance Improvements

  • githttp: write split commit-graphs for cache repositories (#321) (84e2125)

0.15.0 (2026-09-07)

⚠ BREAKING CHANGES

  • rename project to open.storage (#220)

Features

0.14.6 (2026-08-29)

Bug Fixes

  • githttp: stop the boot sweep from contaminating the s3wal push op census (#210) (8325954)

0.14.5 (2026-08-28)

Bug Fixes

  • githttp: make holdFileID stat folding portable across platforms (#199) (fb29408)

0.14.4 (2026-08-28)

Bug Fixes

  • githttp: coalesce held-marker validation across claimed push generations (#197) (950995d)

0.14.3 (2026-08-28)

Bug Fixes

  • githttp: release committed and denied push-hold refs via append-only tombstones (#195) (aa24498)

0.14.2 (2026-08-28)

Bug Fixes

  • githttp: make identical concurrent pack publication idempotent (#187) (#190) (c878adb)
  • githttp: persist pack-path JIT verdicts, kernel-lock hold reaping, ABA-safe hold fingerprints (#189) (71f514b)

0.14.1 (2026-08-28)

Bug Fixes

  • githttp: skip in-flight push refs during hydration to stop spurious receive-pack rejections (#170) (#173) (c7c291b)

0.14.0 (2026-08-27)

Features

  • bench: s3wal push-path e2e benchmark + Phase 4 results publication (#171) (dea8da0)
  • s3wal: Phase 3 — zero-infra serve mode with S3 meta backend, sync-claim write-through, and instance lease (#168) (7ea41d2)

Bug Fixes

  • blob: carry LocationConstraint on CreateBucket and probe on constraint rejection (#180) (520916d)
  • blob: gate SeaweedFS test harness readiness on the shared write roundtrip (#178) (ceb0847)
  • s3wal: align lost-race backoff with §2.3 and make the contention runner faithful (#181) (#184) (c230b79)
  • s3wal: gate SeaweedFS harness readiness on a write roundtrip, hardening qualification against boot-window 5xx (#172) (d0b4f6b)
  • serve: release s3wal instance lease on SIGTERM/SIGINT via graceful shutdown (#176) (74aa93b)

Performance Improvements

0.13.0 (2026-08-26)

Features

  • api: sync upstream drift — diff base_sha and notes object_ref revisions (#163) (f88cdf3)
  • ref: s3wal RefStore — full driver and conformance over single-manifest CAS (#156) (96c12e4)

0.12.0 (2026-08-26)

Features

  • blob: SeaweedFS replaces MinIO as the tested self-hosted S3 store (#145) (0eb03e0)

0.11.1 (2026-08-26)

Bug Fixes

  • githttp: disarm LFS proxy-upload body read deadlines after body consumption (#154) (0f888e7), closes #141

0.11.0 (2026-08-26)

Features

  • jobs: fleet-persistent scan state — observed reap watermarks and resumable cursors (#132) (daa59c3)

0.10.0 (2026-08-25)

Features

  • api: emit the IETF RateLimit header alongside Retry-After on every 429 (#151) (d1e8d71), closes #150
  • s3wal: store qualification harness, conditional CAS primitive, and Phase 1a benches (#142) (39f1ba7)

0.9.0 (2026-08-25)

Features

  • api: add repo_name to the delete-repo response; refresh vendored OpenAPI snapshot (#148) (8a8e25d), closes #147

0.8.0 (2026-08-25)

Features

  • sync: unify sync egress policy behind one dial-time destination guard (#144) (5ce9f8f), closes #139

0.7.0 (2026-08-25)

Features

  • sync: forward local pushes to the linked upstream (push-upstream) (#137) (3f985b5)

0.6.2 (2026-08-25)

Bug Fixes

  • jobs: heal truncated registered originals from quarantine and never purge unverifiable backups (#135) (ca608f0)

0.6.1 (2026-08-25)

Bug Fixes

  • jobs: spare legacy LFS source when canonical copy is size-deficient (#130) (fdf9c01), closes #127

0.6.0 (2026-08-25)

Features

  • jobs: reconcile registered-but-missing blobs against the quota ledger (#123) (d73e087)

0.5.1 (2026-08-25)

Bug Fixes

  • githttp: bound ref materialization in the shared hydration path (#124) (366d609), closes #119

0.5.0 (2026-08-24)

Features

  • lfs: reclaim registered-but-unreferenced objects (#117) (c428e82)

0.4.0 (2026-08-24)

Features

  • blob: optional expected-bucket-owner enforcement across all S3 operations (#115) (fe39b73)

0.3.1 (2026-08-24)

Bug Fixes

  • lfs: canonical o2 object keys immune to legacy presigned-PUT replay (#104) (3cda233)

0.3.0 (2026-08-23)

Features

  • storage: reclaim soft-deleted repositories — retention purge + purge-repo CLI (#105) (eb057d2)

0.2.0 (2026-08-23)

Features

  • lfs: quota-metered, digest-verified uploads and lfs/ sweep reconciliation (#51) (583f369)

0.1.4 (2026-08-23)

Performance Improvements

  • githttp: eliminate git subprocess forks from the hydration fast path (#98) (cab32ca)

0.1.3 (2026-08-23)

Bug Fixes

  • sync: lease the sync claim so a dead holder can never wedge syncing (#89) (8c7ba19)

0.1.2 (2026-08-23)

Bug Fixes

  • sync: never drop pull-upstream requests accepted while a sync claim is held (#85) (5ef8da6)

0.1.1 (2026-08-23)

Bug Fixes

  • githttp: bound upload-pack gzip negotiation bodies (f5e6c8f)

0.1.0 (2026-08-22)

Features

  • release: adopt release-please and ship cross-platform release binaries (#65, #66) (#72) (0af923f)