October 12th, 2026 · 1 commits
Fix zero-byte S3 uploads
Empty-file publishes now send Content-Length explicitly, avoiding GCS 411 errors and failed retries.
Read the issue →jsr-io/jsr
October 10th, 2026 · 2 commits
Axum migration and dependency refresh
The API router moved from routerify to axum/hyper 1, alongside a broad dependency refresh that updated docs, highlighting, and S3 tooling.
Read the issue →
October 3rd, 2026 · 1 commits
Service account unlocks self-serve account deletion
Adds a no-limit service account, admin/self user deletion, and scope ownership transfer when a sole member is removed.
Read the issue →
September 24th, 2026 · 1 commits
CI hardening: pin GitHub Actions by digest
A workflow-only security pass pins third-party actions, tightens default token permissions, and closes many scorecard alerts.
Read the issue →
September 14th, 2026 · 1 commits
Security alert cleanup and major dependency refresh
Updated core Rust dependencies and lockfiles to clear all open Dependabot security alerts, including several API-version bumps.
Read the issue →
September 4th, 2026 · 1 commits
JSR skips wasteful docs probes
Frontend avoids hitting the docs API for non-latest versioned doc URLs and tells crawlers not to index them.
Read the issue →
September 3rd, 2026 · 4 commits
Ticket outreach and immutability get upgrades
Staff can now open user-addressed tickets, scope admins can delete fresh low-use versions, and symbol search loads only when used.
Read the issue →
August 29th, 2026 · 1 commits
Cache hot paths and cap symbol listings
A single fix cuts R2 re-downloads for docs/source and prevents oversized all-symbols docs responses from hammering render time.
Read the issue →
August 28th, 2026 · 2 commits
Dependency graphs get much faster
JSR speeds up dependency graph builds from published metadata and fixes a CI bundle regression caused by Deno’s sourcemap parsing change.
Read the issue →
August 27th, 2026 · 4 commits
Fix manifest purges and package version pages
A cache invalidation bug blocked fresh manifests, version pages no longer 302 away, and CI Docker builds get a shared registry cache.
Read the issue →
August 26th, 2026 · 2 commits
JSR fixes npm d.ts rewrites and stale score meta
Staff can now recompute stale version score metadata, and npm tarball generation now correctly rewrites remapped declaration specifiers.
Read the issue →
August 25th, 2026 · 17 commits
Docs, source views, and ticket handling improved
Added markdown previews, linked specifiers, create-command support, and several support-ticket fixes; also patched docs rendering and sanitization.
Read the issue →
August 24th, 2026 · 5 commits
Support email and docs scoring get fixed
JSR fixes inbound ticket email delivery, tightens docs scoring, and patches a publishing deadlock plus oversized docs handling.
Read the issue →
August 22nd, 2026 · 4 commits
Repository metadata and dependent counts improved
JSR now exposes GitHub repo links in metadata, counts npm-mapped dependents correctly, and fixes a user timestamp field bug.
Read the issue →
August 21st, 2026 · 10 commits
+3
Fallback registries and security hardening
Adds fallback registries and a publish fix, while tightening CSP, telemetry, and frontend privacy/perf.
Read the issue →
August 20th, 2026 · 4 commits
Search filters and OIDC publishing fix
Added richer package search filters and tightened docs scoring, while fixing trusted publishing for GitHub Enterprise Cloud issuers.
Read the issue →
August 19th, 2026 · 1 commits
Navbar, docs, and downloads get a UI refresh
Mobile navigation, package docs links, overflow fixes, and download charts/widgets were improved across the site.
Read the issue →
August 15th, 2026 · 2 commits
SPDX data sync and WAF rollback
License-list metadata was refreshed from upstream, while a frontend scraping-protection rollout was backed out after CF access issues.
Read the issue →
August 7th, 2026 · 1 commits
Frontend scraping protection moved to WAF
JSR shifted expensive frontend rate limiting out of the worker and into the WAF, saving invocations on blocked scrapers.
Read the issue →
August 4th, 2026 · 2 commits
Provenance fix and DB downsizing
Provenance verification now checks the published manifest digest, while production Cloud SQL is downsized to a zonal instance.
Read the issue →
July 9th, 2026 · 1 commits
Turnstile captcha now gates login
Login now requires a POST with Cloudflare Turnstile verification, blocking direct GETs and tightening the OAuth start flow.
Read the issue →
July 6th, 2026 · 2 commits
Docs locked to latest; symbol indexing off
The repo now serves docs only for the newest package version and disables the diff UI, while also turning off Algolia symbol indexing.
Read the issue →
July 3rd, 2026 · 1 commits
Provenance now binds to uploaded tarballs
jsr hardened provenance checks by storing publish-time tarball hashes and verifying attestations against the exact bytes released.
Read the issue →
June 18th, 2026 · 1 commits
JSR analytics now records user agents
Download tracking now captures client user agents for both JSR and npm package fetches, improving analytics detail.
Read the issue →
June 17th, 2026 · 2 commits
Algolia search migration lands and gets tuned
JSR switches search infrastructure to Algolia, with a follow-up fix to scope filtering and ranking.
Read the issue →
June 15th, 2026 · 5 commits
Security fixes, tracing sampling, and hardening
JSR tightened provenance verification and auth state handling, added 5% OTLP sampling, and hardened frontend responses.
Read the issue →
June 11th, 2026 · 1 commits
Publish hangs and stale cache fixed
Stops caching live publish-status and routes package caching by public URL so metadata invalidates correctly after publish.
Read the issue →
June 10th, 2026 · 1 commits
Stuck publish tasks now self-heal
Adds a reaper for stale publishing tasks so stranded publishes can regenerate package metadata and unblock versions.
Read the issue →
June 9th, 2026 · 5 commits
Docs crawls get throttled and cached
Major cache and crawl-control work reduced origin load on docs/diff pages, while API tracing was upgraded to report errors more accurately and export logs.
Read the issue →
June 8th, 2026 · 3 commits
API cutover, then rolled back
A DB-first Worker cutover landed, caching was widened, then the cutover was reverted the same day while keeping the DB auth pre-step.
Read the issue →