Aug 31 – Sep 6, 2026 · 5 commits
JSR trims docs traffic and expands admin controls
Admins can now delete bad fresh releases and start user outreach tickets, while docs/search work was tuned to avoid wasted loading and crawling.
Read the issue →jsr-io/jsr
Aug 24–30, 2026 · 31 commits
JSR tightens docs, metadata, and ticketing flows
Weekly updates improved inbound support email, docs/source performance, package pages, and fixed stale metadata and manifest caching bugs.
Read the issue →Aug 17–23, 2026 · 19 commits
JSR adds fallback registries, search filters, and security fixes
Search got filter UI, self-hosted registries can fall back upstream, and docs publishing received a CSP hardening fix.
Read the issue →Aug 10–16, 2026 · 2 commits
SPDX metadata refreshed, WAF rollout reverted
JSR updated bundled SPDX license data and backed out an attempted WAF-based scraping protection change after Cloudflare access issues.
Read the issue →Aug 3–9, 2026 · 3 commits
WAF hardens scraping defense; provenance check fixed
Provenance verification now matches the published manifest, while frontend anti-scraping moved into Cloudflare WAF to save Worker capacity.
Read the issue →Jul 6–12, 2026 · 3 commits
JSR tightens docs access and hardens login with captcha
Docs and diffs were restricted around latest versions, symbol indexing was disabled, and login now requires Turnstile verification.
Read the issue →Jun 29 – Jul 5, 2026 · 1 commits
Provenance verification now locks to published tarballs
Provenance checks now compare attestations against the exact uploaded tarball hash, preventing mismatched-byte verification.
Read the issue →Jun 15–21, 2026 · 8 commits
Security hardening, Algolia search migration, and richer analytics
JSR tightened provenance and auth flows, migrated search to Algolia, and added user-agent capture to download analytics.
Read the issue →Jun 8–14, 2026 · 10 commits
API caching tightened as publish pipeline self-heals
A week of CDN/cache hardening and publish reliability fixes, plus a brief API cutover attempt that was rolled back.
Read the issue →Jun 1–7, 2026 · 19 commits
JSR starts splitting its API into Cloudflare Workers
A new edge Worker takes over read-only endpoints, shared types are extracted, and observability plus key packaging/provenance fixes land.
Read the issue →May 25–31, 2026 · 9 commits
JSR shifts frontend to Workers and expands CDN caching
Frontend migrated to Cloudflare Workers, docs rendering was fixed under Vite, and CDN caching was added to key read and sitemap endpoints.
Read the issue →