Skip to content

openartifact: 0.16.1 (app 0.19.1) #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
M0Rf30 merged 1 commit into from
Nov 4, 2026
Merged

openartifact: 0.16.1 (app 0.19.1) #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions charts/openartifact/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ description: >-
Docker/OCI, Hugging Face, Helm, Debian, RPM, Go, Cargo, NuGet, RubyGems, Conda, Conan, Ivy,
sbt, Terraform, Alpine, Arch, Nix, Ansible and raw.
type: application
version: 0.16.0
appVersion: "0.19.0"
version: 0.16.1
appVersion: "0.19.1"
kubeVersion: ">=1.29.0-0"
home: https://github.com/openartifact/openartifact
icon: https://raw.githubusercontent.com/openartifact/openartifact/main/docs/assets/logo.png
Expand All @@ -31,15 +31,15 @@ annotations:
artifacthub.io/license: AGPL-3.0-or-later
artifacthub.io/changes: |
- kind: changed
description: Default image OpenArtifact 0.19.0. Migrations 010 to 013 run on start (no action needed). Deb and RPM repositories publish gzip indexes only (no .xz), Docker pushes in progress during the upgrade must be retried, the repository list counts lag up to 15 s, and the image ships one binary (oa is a link to the server binary). On filesystem storage uploads are spooled under the storage path (spool directory). Chart templates unchanged.
description: Default image OpenArtifact 0.19.1, a fix release (blob locking, orphan collection, trash and tier races, upload size caps, proxy cache headers, release bundles kept by openartifact rebuild). Migration 014 runs on start (no action needed). Chart templates unchanged.
- kind: security
description: Known issue - the optional Collector sidecar image (otel/opentelemetry-collector-contrib 0.163.2, off by default) carries go-jose/v4 4.1.5 (CVE-2026-116587, HIGH, DoS when parsing JWKs with RSA keys; fixed in 4.1.6). No collector release ships the fix yet; it is ignored in CI until 2026-11-27 and the sidecar does not parse untrusted JWKs in the chart's configuration.
artifacthub.io/signKey: |
fingerprint: 2CB218184F573BAAFC532E84D4DE9B5D6FDD2ACD
url: https://openartifact.github.io/helm-charts/pgp_keys.asc
artifacthub.io/images: |
- name: openartifact
image: ghcr.io/openartifact/openartifact:0.19.0
image: ghcr.io/openartifact/openartifact:0.19.1
platforms:
- linux/amd64
- linux/arm64
Expand Down
5 changes: 5 additions & 0 deletions charts/openartifact/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,11 @@ Schema migrations run at startup under a Postgres advisory lock
waits up to `database.connectTimeout` (default `60s`) for the database at startup;
`database.waitForDatabase=false` makes it fail at once.

## Upgrading to 0.16.1 (OpenArtifact 0.19.1)

- Fix release. Migration `014` (journal triggers for release bundles) runs on start; nothing to do.
The chart templates and values are unchanged.

## Upgrading to 0.16.0 (OpenArtifact 0.19.0)

- Migrations `010` to `013` run on start; nothing to do. The chart templates and values are unchanged.
Expand Down
Loading