Releases

This release fixes organization access checks and two-factor authentication for OAuth logins.

Fixes

• Fixed repository creation accepting SSH keys from another organization. Key ownership is now checked when adding a repository and before Git uses the key. (#182)
• Fixed forbidden organization pages including private package and repository search data. Search results are now limited to organization members. (#183)
• Fixed GitHub and GitLab logins skipping local two-factor authentication. Users with two-factor enabled now complete the existing authenticator or recovery-code challenge before signing in. (#184)

A security release. Upgrading is recommended.

Fixes

• Fixed registry mirrors allowing server-side requests to private or internal network addresses through mirror URLs, Composer metadata, distribution URLs, or redirects. Mirror requests are now validated and DNS-pinned before connecting, redirects are revalidated, and credentials are only sent to the configured mirror origin. Trusted internal mirrors can be explicitly enabled with MIRROR_ALLOWED_PRIVATE_HOSTS.

Documentation

• Removed the broken star history chart.

This release fixes Composer installs from lock files that pin older branch commits and improves reliability around installation and queued repository syncs.

Fixes

• Fixed composer install returning a 404 for branch versions when the lock file pins an older commit. Pricore now tracks dist archives by commit and keeps superseded branch archives available instead of leaving them unreachable. Dist metadata is also cleared when a branch reference moves, preventing an archive from the previous commit being advertised for the new one. Superseded archives are retained indefinitely by default; set DIST_KEEP_DETACHED_DAYS to configure a retention window. (#178, #179)
• Fixed manual installations enabling public sign-ups because .env.example did not match the documented invite-only default. The manual deployment and contributing guides now use pricore:install to create the first account. (#173)
• Fixed queued repository sync completion failing when its organization was deleted before the sync finished. (#180)

Improvements

• Dependencies: Updated Recharts to 3.10.1. (#175)

A security release. Upgrading is recommended.

Fixes

• Fixed repository identifiers not being validated before being passed to Git. Generic Git repositories are now restricted to https, http, ssh and git URLs, or scp-style user@host:path. GitHub, GitLab and Bitbucket repositories are restricted to owner/repository. Existing repositories are re-checked on their next sync.

Improvements

• Dependencies: Composer and npm dependencies updated to their latest versions.

0.53.3 (2026-07-20)

Fixes

• Fixed dist downloads returning 404 for lock files created before version tags kept their v prefix. Running composer install with an existing lock file now works again without requiring a composer update.

This release adds support for mirroring Composer v2 registries and corrects how version tags with a v prefix are handled.

New Features

• Mirror Composer v2 registries (#138): You can now mirror packages from any Composer v2-compatible registry, not just Packagist, broadening the upstream sources Pricore can proxy.

Fixes

• Fixed package versions dropping the v prefix, which made composer outdated and composer show report duplicate versions (1.2.0 and v1.2.0) and flag phantom updates for packages already on the latest version (#146).
• Fixed {$version} placeholders in extra.download-dist URLs resolving without the v prefix, causing installs to fail with a 404 when fetching release files (#156).

This release focuses on making organization member management easier to navigate.

New Features

• Member sorting & filtering (#149): Search organization members by name or email, filter by role, and sort the members table by member, role, or join date. Makes finding people in large teams much quicker.

This release focuses on a redesigned package detail experience and a GitLab self-hosted authentication fix.

New Features

• Package detail page (#131): The package view now uses a tabbed layout with the README rendered inline, version stats, and download metrics, making it easier to evaluate a package at a glance.

Fixes

• Fixed GitLab self-hosted authentication dropping the configured instance URL on OAuth, so subsequent webhooks and API calls now hit the correct GitLab host (#134).

Fixes

• Fixed connecting Generic Git repositories on the official Docker image, which previously failed with a "git not found" error.

Security

• Organization access control: Fixed an authorization issue affecting organization-scoped routes. Only relevant to multi-tenant setups (instances hosting more than one organization). Upgrading is recommended.