Add fallback registry support for self-hosted JSRs (
7b09dfb)
This introduces FALLBACK_REGISTRY_URL plus fallback artifact URLs so an instance can resolve and serve packages it doesn't host locally. It also updates publish-time dependency resolution and the dependency graph to understand fallback-backed dependencies, making self-hosted deployments much more practical.
Fix stranded publishes so new uploads don’t wait 30 minutes (
627f97b)
If a processing task has been stuck longer than STALE_PUBLISHING_TASK_SECS, a new publish for the same version now marks it failed in the same transaction and proceeds immediately. That closes a deadlock window between worker loss and the reaper, reducing stuck publish failures.
Harden docs-page CSP against javascript: iframe execution (9cbcf04)
The frontend CSP now uses a nonce-based script-src with strict-dynamic and adds frame-src restrictions, blocking an iframe-based XSS bypass that could execute same-origin script from package-controlled docs. This is a meaningful security fix for rendered package content.
Refactor OIDC publish auth around a reusable provider abstraction (
d1f5631)
GitHub Actions OIDC verification has been extracted into a provider abstraction and a shared IAM-building flow, laying groundwork for additional OIDC providers. The refactor should make publish authentication easier to extend without changing current behavior.
