Jul 6–12, 2026 · 3 commits
JSR tightens docs access and hardens login with captcha
Docs and diffs were restricted around latest versions, symbol indexing was disabled, and login now requires Turnstile verification.
Read the issue →jsr-io/jsr
Jun 29 – Jul 5, 2026 · 1 commits
Provenance verification now locks to published tarballs
Provenance checks now compare attestations against the exact uploaded tarball hash, preventing mismatched-byte verification.
Read the issue →Jun 15–21, 2026 · 8 commits
Security hardening, Algolia search migration, and richer analytics
JSR tightened provenance and auth flows, migrated search to Algolia, and added user-agent capture to download analytics.
Read the issue →Jun 8–14, 2026 · 10 commits
API caching tightened as publish pipeline self-heals
A week of CDN/cache hardening and publish reliability fixes, plus a brief API cutover attempt that was rolled back.
Read the issue →Jun 1–7, 2026 · 19 commits
JSR starts splitting its API into Cloudflare Workers
A new edge Worker takes over read-only endpoints, shared types are extracted, and observability plus key packaging/provenance fixes land.
Read the issue →May 25–31, 2026 · 9 commits
JSR shifts frontend to Workers and expands CDN caching
Frontend migrated to Cloudflare Workers, docs rendering was fixed under Vite, and CDN caching was added to key read and sitemap endpoints.
Read the issue →