Clojars Worklog - 2024

This worklog covers work performed on Clojars under a contract from the Clojurists Together Foundation. The contract covers general maintenance.

CHANGELOG | clojars-web commits

• Added a new API to provide a release feed

CHANGELOG | clojars-web commits | infrastructure commits

• Worked with a new contributor (Osei Poku) to implement a sitemap
• Constrained heap usages for cron tasks to prevent competition with the webapp (this was causing the server instance to become unavailable on occasion)

CHANGELOG | clojars-web commits | infrastructure commits

• Increased max upload size from 20MB to 30MB This is to allow larger artifacts to be uploaded, now that we see native builds more often.
• Addressed CVEs

CHANGELOG | clojars-web commits | infrastructure commits

• Upgraded to clojure 1.12.0
• Upgraded to java 21
• Added hcaptcha to signup form
• Fixed status-message sending on validation failure

CHANGELOG | clojars-web commits | infrastructure commits

• Bug fix: Ensure jetty patch to send status message is always applied
• Bug fix: Properly rotate log files
• Upgrade to Clojure 1.12.0-rc1
• Upgrade to clojure 1.12.0-rc2

CHANGELOG | clojars-web commits | infrastructure commits

• Bug fix: Properly delete artifacts from S3
• clj-kondo ugrade and linting cleanup
• Upgrade to Clojure 1.12.0-beta2
• Use latest AL2023 AMI as base when building our AMI

CHANGELOG | clojars-web commits | infrastructure commits

• Upgrade nippy to address CVE-2024-36124
• Upgrade LoadBalancer SSL policy
• Clean up many typos (also in infrastructure)

CHANGELOG | clojars-web commits | infrastructure commits

• Add wrappers for hashicorp tools to ensure consistent version usage
• Ensure emails are downcased; don’t allow future duplicate email usage
• Upgrade to Jetty 11

CHANGELOG | clojars-web commits

Mostly maintenance work this month related to error handling and tightening error boundaries.

• Tighten search page error handling
• Address CVEs with bouncycastle
• Remove usage of clj-time in favor of java.time
• Remove /error route
• Fix logback to actually roll logs
• Reject non-flat http params in an attempt to reduce errors from fuzzing
• Return invalid params response as json

CHANGELOG | clojars-web commits | infrastructure commits

• Upgrade from Amazon Linux 2 to Amazon Linux 2023
• Updates to error handling and reporting to allow more to be reported
• Upgrades to address CVEs

CHANGELOG | clojars-web commits

This month was a smattering of small changes/fixes:

• Display username on all pref/admin pages
• Use a Thread for SQS receive loop to allow UCE to work
• Report validity to GitHub on secret scanning requests
• Add admin tooling to soft-delete users
• Upgrade postgresql driver to address CVE-2024-1597

clojars-web commits | infrastructure commits

• I upgraded the PostgreSQL database from v12.1 to v15.5.