• English

    • OSA Proxy Changelog

    Archived changelog

    Changes for the archived Java/Spring implementation are available in the OSA Proxy archive changelog.

    [2026.22.1] - 2026-06-05

    Fixed

    • Fixed an issue where the HTTP_PROXY and HTTPS_PROXY environment variables were not applied to outgoing HTTP(S) requests.

    [2026.22.0] - 2026-05-27

    Added

    • Added the new implementation of OSA Proxy. See documentation
    • Added support for Composer/Packagist repositories: metadata checks, dist archive checks, and dist URL rewriting through OSA Proxy. See documentation
    • Added support for RubyGems repositories: RubyGems metadata checks and downloaded .gem package checks. See documentation
    • Added host/subdomain-based routing for multiple Docker Registry API v2 repositories: the subdomain name matches repository[*].name, while Docker client requests keep the standard /v2/... and /token paths. See documentation
    • Added repository-level file type filtering through repository[*].file-type-filter to limit which artifacts are sent to package scanning.

    Changed

    • Prometheus metrics are exposed directly at /metrics; Spring Boot Actuator endpoints /actuator/metrics and /actuator/prometheus are not used.