Skip to content

Changelog

Every release's changes, written by release-please from Conventional Commits. The same notes are on the releases page.

Changelog

1.0.0 (2026-10-18)

Features

  • api: add clock skew and configuration doctor checks (d5c5158)
  • api: add Discover, Pulls, Mirrors, Dependencies and admin Upstream endpoints (35af26d)
  • api: diff a pull request's files against its fork point (c2b4dff)
  • api: expose ui.external_images on /auth/providers and document history-only Pulls (5b4e8b3)
  • api: let users change their own profile and password (38cb14a)
  • api: list a file's scan findings for the file page (2cea799)
  • api: list every Organisation for Instance admins (766fdfa)
  • api: name the Repo in the payload of every Repo-scoped Job (7f9f3c2)
  • api: report the S3 upload mode on /admin/system and the System page (a23e48e)
  • api: serve metadata, discussions, Collections and webhooks in the native API (3c24740)
  • auth: require sign-in for Namespace profiles while anonymous_read is off (81390e5)
  • cli: add --json to hangar logout and check every command has it (4f9d363)
  • cli: add the hangar client, import, LM Studio, Ollama and admin backup commands (4c5ed59)
  • cli: check the quant is in the Arsenal before hangar ollama install (e9c3747)
  • cli: find a proxy that cuts long Blob store reads with doctor --large-read (87f07c3)
  • cmd: add admin create-user, reset-password, gc and reindex, and open the Blob store for backup, restore and doctor (078923b)
  • cmd: take --json on the server and admin commands (dbe58b2)
  • cmd: wire every workstream's real implementation into hangar server and worker (05fed11)
  • collections: store Collections with visibility-aware items (c1efec3)
  • community: store discussions, pull requests, likes and download counts (3a272bb)
  • config: add viewer.max_request_bytes for the Dataset Viewer budget (594f1ea)
  • datasets: Dataset Viewer API, signed media assets, Croissant and dataset metadata (19e04cd)
  • datasets: dataset.convert and dataset.stats Jobs with the refs/convert/parquet export (18f61cf)
  • datasets: features, layout, Arrow IPC and Parquet IO, conversion readers and statistics (85fcb11)
  • datasets: native configs endpoint and compat/viewer suite (717f386)
  • datasets: where and orderby parser and evaluator for /filter, with fuzz targets (d0ef69a)
  • deploy: add Grafana and Kibana dashboards, load tests and protocol labels on HTTP metrics (ed09aa5)
  • deploy: add the Compose examples and the smoke test scripts (dc6d178)
  • deploy: add the container image, GoReleaser config, Helm chart and LM Studio compat suite (0a33964)
  • hfapi: enforce scan.block_unsafe_downloads on Hub API downloads (93f90b8)
  • hfapi: serve liker listings and comment edit and hide (aebc1ca)
  • index: index Commits with ranged safetensors and GGUF header reads (467ff6e)
  • index: record a dataset's rows and size category from its Parquet export (962f32a)
  • index: store rows, bytes and columns per Split and link datasets with models (2f6f88e)
  • integration hooks for Pull-through, mirror status, safe downloads and admin password resets (e3e0c0e)
  • ollama: serve GGUF Repos as an Ollama registry (f970124)
  • repo: check LFS object references at Commit (64fd267)
  • repo: filter Repo listings by dataset row count (e2f4ef8)
  • repo: wait at most lfs.verify_wait for LFS verification in Commits and pushes (ee83f5b)
  • scan: make the download gate's level a setting (e1b57c2)
  • scan: scan pickles, PyTorch archives and integrity of model files (4a9d5ae)
  • scope Repo Jobs, add auth.cleanup and Namespace search for the integration (c4790b4)
  • server: wait for the Blob store at start instead of exiting (22eded4)
  • ui: add the mock demo for demo.hangar.page as a Cloudflare Worker (df87593)
  • ui: build every page against the native API with an OpenAPI mock server (962614a)
  • ui: edit the profile and change the password in Settings (a0706a9)
  • ui: polish the interface with motion, shared primitives and consistent details (a670c48)
  • ui: separate Models and Datasets sections, Taxiway teal accent and optional dataset links (6fd838a)
  • ui: show pending emails and confirm them from their link (30d1998)
  • uploads: continue the upload in progress when a client plans again (e114f75)
  • upstream: add bulk import from a Hugging Face cache, LM Studio, a directory and Ollama (0e3c166)
  • upstream: add the Upstream client, registry, Pull planner, transfers, Pull-through and Discover (2cc3a0d)
  • webhook: store webhooks and deliver signed events with retries (3ce11ad)
  • web: send Cross-Origin-Opener-Policy and Permissions-Policy with UI pages (4b609f3)
  • xet: ingest Xet uploads and reassemble them into LFS objects (ee75dcc)
  • xet: parse and verify xorbs and shards against the Xet reference vectors (3af7bc0)

Bug fixes

  • answer 499 to client-closed requests in the Viewer, Ollama and sign-in writers (9d8d29d)
  • api: answer 499 to client-closed requests in every error writer (6c93d86)
  • api: carry scan results forward while a Commit's scan is pending (1622a27)
  • api: check Repo access before showing or changing a Job (18191e4)
  • api: keep gating keys a Repo settings update does not send (8715a05)
  • api: make the Mirror update check budget explicit and log a missed check (1430d64)
  • api: stop a Token creating a Token that outlives it (5199150)
  • auth: answer a client-closed request with 499 and log authentication store errors (6caf784)
  • auth: answer sign-in throttling with a sentence users can read (7369255)
  • auth: bind email confirmation links to the address the admin saw (c937c8e)
  • auth: bound concurrent password hashing to stop sign-in floods exhausting memory (89631fa)
  • auth: let a write Token administer Repos its user administers (54e5307)
  • auth: let a write Token administer Repos only through the Hub API (425a744)
  • auth: make self-set emails wait for a confirmation link (f9f6421)
  • auth: refuse cross-origin changes made with browser credentials (5ad144f)
  • auth: treat a stale session cookie as anonymous and clear it (53a90a9)
  • blob: copy large S3 objects server-side in 512 MiB parts (7972a2c)
  • blob: fail a filesystem install at once when the key's path is a directory (1355a1f)
  • blob: record sanitised exception events on Blob store spans (a917701)
  • blob: retry S3 uploads over slow links and report a missing bucket (8f8f3dc)
  • blob: serve every download as an octet-stream attachment (e76e619)
  • CI after the interface polish (#6) (d09e7af)
  • cli: create the branch hangar push --branch names when it does not exist (320939d)
  • cli: follow links to Hugging Face cache blobs when uploading a folder (f7c80a7)
  • cli: give every command a help heading in sentence case (73b7664)
  • cli: keep presigned URLs out of error output and drop the Token on cross-origin redirects (9aeefd2)
  • cli: leave other quants out when GGUF files are regular blobs (b0624c4)
  • cli: never upload files that symbolic links point to outside the folder (9cf64d1)
  • cli: pull imported files into the Mirror so the Instance marks them present (c786af3)
  • cli: put every subcommand's help headings in sentence case (87cbc4d)
  • cli: read the generated Instance key in hangar admin doctor (0ca4552)
  • cli: retry part uploads and downloads, and say what an import waits for (66a9488)
  • cli: say what an upload completion waits for and scale its timeout (8a78d5c)
  • cli: say when Ollama needs the key in hangar ollama install (23fd187)
  • cli: send an upload completion again after 503 with Retry-After (071ee7d)
  • cli: upload the other files when one fails after its retries (1d0e599)
  • compat/hf: pass AnonymousRead as a setting func in the real backend (148ab3b)
  • compat: pass AnonymousRead as a function in the Xet real backend (bad5714)
  • compat: remove the hangar binary the harness builds when the tests end (1e0b1cb)
  • compat: retry and verify the viewer fixture downloads (4a79651)
  • config: refuse a URL DSN with the sqlite driver (04678aa)
  • datasets: adopt a Mirror's Parquet export once it is pulled (bb95881)
  • datasets: charge decoded Parquet data to a per-request budget (3eb0655)
  • datasets: check delta byte-array lengths and decimal scales before reading Parquet (9fa386e)
  • datasets: check Parquet sizes and counts before parquet-go reads them (4001461)
  • datasets: log a dataset with no Configs at DEBUG in the conversion (f210b05)
  • datasets: read LZ4 frame compressed Arrow IPC buffers (bda64e7)
  • datasets: read zip archives as datasets does and hide failure detail (754a1a9)
  • datasets: report source sizes for Mirrors that keep the Upstream's Parquet export (a690d1d)
  • datasets: retry dataset Jobs on transient Repo read errors (a8f4654)
  • db: make concurrent migrators wait on a Postgres advisory lock (026bd0a)
  • deploy: define the scopes Hangar requests in the Keycloak realm (ee4b2bb)
  • deploy: let readiness probes outwait a bounded /readyz (4b440b7)
  • deploy: let the migrate init container wait for the database (d237fa9)
  • deploy: make the Postgres health checks wait for TCP (8daab65)
  • deploy: render GitOps installs without the helm test Pod (9b1ca9b)
  • deploy: require every Compose secret and keep admin ports on loopback (ea7b194)
  • deploy: turn off service links in every chart Pod (0d7a32d)
  • docs: cite each threat model test at its own file and drop spaces before percent signs (8257431)
  • docs: repair a broken spec link in decisions and check Markdown links (8dbcf62)
  • gc: walk whole prefixes in orphan sweeps and sweep filesystem staging (601e102)
  • git: bound what pushed and pulled packs and trees can expand to (dc3918b)
  • gitserver: name oversized files when two pushed objects share a first byte (b0ddde7)
  • gitserver: refuse git fetches of refused files stored in git (f65ba44)
  • gitstore: report a cancelled context when git is killed mid-read (56fd278)
  • helm: migrate in an init container for GitOps, refuse to generate secrets without cluster access, size the cache volume above the pack cache (29d2073)
  • helm: point NOTES at the generated password only when the chart generates it (8a4f1a5)
  • hfapi: answer Pull-through policy refusals with 403 (da5dfe5)
  • hfapi: check a create_pr commit before opening its pull request (8d197b1)
  • hfapi: discard a create_pr pull request whose Commit failed (b1dd72b)
  • hfapi: issue no presigned link on HEAD for a download the gate refuses (8fe5fd3)
  • httpx: keep a probe timeout out of the readiness cache and log failed checks (2ad5361)
  • httpx: make the signed form of a URL unambiguous (c1d1038)
  • httpx: name the request ID in server errors and on every request log line (1c40413)
  • image: give admin backup a /backups folder it can write (6cdba58)
  • index: serve GGUF header metadata as plain values, the shape the UI reads (ab5e5a5)
  • jobs: fence a run's writes on the attempt it claimed (5e5c716)
  • jobs: fence Job writes on the attempt number as well as the lease owner (d587bbb)
  • jobs: redact the whole query when it holds quotes or angle brackets (f933253)
  • jobs: redact URLs in Job errors and keep panic stacks in the log (68672ed)
  • loadtest: make upload.js send the bytes it plans (1044d4c)
  • loadtest: upload new bytes to one Repo per VU in upload.js (2581fd6)
  • quieten health probes, create_repo on an existing Repo and the UI's first /me (80fc37e)
  • release: sign release checksums into cosign 3 bundles and rehearse OPS-7 locally (0b39255)
  • repo: apply the stored anonymous_read setting to Repo listing (0d4eaa8)
  • repo: bound server-side Commits by the same tree limits as pushes (aa8a2ce)
  • repo: finish an upload completion after its caller goes away (a3e3502)
  • repo: only Hangar commits to refs/convert/* (0386845)
  • repo: resume broken reads when completing an upload and keep its parts on failure (2284992)
  • repo: retry concurrent Commits to one branch with jittered backoff (bd2b887)
  • repo: sign no headers on presigned LFS PUTs and promote verified uploads by copy (6707273)
  • repotest: store LFS-tracked adds as LFS objects and map Namespace IDs, as the real service does (555d9b7)
  • scan: end scan and index Jobs quietly when their Repo is deleted mid-run (7f308b9)
  • scan: enforce scan.block_unsafe_downloads on every download route (7208565)
  • scan: fail closed for object downloads that no scanned file covers (cc8e372)
  • scan: gate signed Pull-through and zip export links, and enumerate every download path (ae23e84)
  • scan: read files by content and fail closed on partial scans (4e62696)
  • scan: read pickles as CPython and joblib do (bdcd21b)
  • scripts: clone without credential helpers in the smoke test (059f5ff)
  • scripts: fail kind-chart-test.sh at once when the Hangar image is not local (cebfa8f)
  • scripts: read fuzz targets line by line so shellcheck passes (2b4d8b4)
  • scripts: remove the anonymous volumes test containers leave behind (8c1610c)
  • server: keep /readyz at 503 until every route is mounted (25a6ce8)
  • server: keep /readyz at 503 until the full handler is installed (621f734)
  • server: name the Blob store in /readyz only when start-up waits for it (36e4444)
  • server: report not ready until the Instance serves (0e2c605)
  • server: report ready only once every route is served (a772e09)
  • storage: add storage.s3.upload_mode proxy for buckets clients cannot reach (62c1181)
  • test failures from the first public CI run (#4) (39761a4)
  • ui: call the owner part of a Repo ID a Namespace, as CONTEXT.md asks (25320df)
  • ui: describe Token scopes as the Hub-actions-only decision does (c4fc196)
  • ui: focus the search input on open, wrap long IDs and scroll Markdown tables in focusable regions (45eca07)
  • ui: keep the search palette's listbox valid while results load (46fa2a3)
  • ui: match the docs in Discover, the landing page and Token scopes (4f57f3f)
  • ui: nest Markdown headings under the page's h1 (874ff55)
  • ui: resume browser uploads after a reload when the plan starts a new upload (13121dc)
  • ui: stop pages scrolling sideways and let the keyboard scroll Markdown code (4a03a21)
  • ui: stop the mock's OIDC sign-in redirecting to other sites (9229225)
  • ui: use the hangar lmstudio install syntax from 08 in the LM Studio snippet (88f76f9)
  • upstream: bound the refs read from an Upstream's advertisement (8bf25b8)
  • upstream: enforce Namespace quotas on Pulls (6469737)
  • upstream: keep another Namespace's quota refusal out of joined Pulls (1bdb098)
  • upstream: make the Upstream connection test one bounded attempt (4f0af00)
  • upstream: plan a Pull again at once when another run stored its history (aff755a)
  • upstream: read an anonymous 401 from huggingface.co as not found (33e5dc7)
  • upstream: refuse redirects into the local network and reserved addresses (65f13b7)
  • upstream: stop another Namespace's quota starving a joined Pull (7897293)
  • upstream: wait for the history of a Mirror that planning has just created (7421fa9)
  • upstream: wait for the history of a Mirror that planning has just created (bf664e3)
  • viewer: check the scan time limit only after rows are read (0733bd8)
  • xet: bound shard work, shard bodies and concurrent shard ingests (266dab8)
  • xet: bound the xorb index memory and file check memory of a shard (9690a7c)
  • xet: charge xorb index loads against what a shard names (c155bfe)

Performance

  • auth: skip the linked OIDC providers when authenticating a request (39d739b)
  • hfapi: check read and the action with one permission check (7857795)
  • hfapi: look a Repo up once per Hub read request (ed2ef92)
  • repo: check small server-side Commits against the tree limits without git (2188682)
  • repo: read a file's tree row before checking the tree cache (8ae082e)
  • repo: read trees for the push check with one git process (bdd53d3)
  • repo: start a fixed number of git processes per request (6332b50)
  • upstream: fetch a Discover detail's card, dependencies and Viewer answers at once (8dc2c71)

Documentation

  • add a script that records the Home page demo (99ac4ab)
  • add load test results and the Phase 3 performance handoff (14e859e)
  • add the 30-second demo to the Home page (29baf84)
  • add the documentation site, repository files and release, docs and compatibility workflows (07ec929)
  • blob: say PresignGet forces the octet-stream Content-Type (7436132)
  • build: add the phase 3 gaps handoff (9ec1c60)
  • build: add the W6 handoff and requests, and the real-backend Upstream suite (43ea957)
  • build: add the W7 handoff, requests and pickle scanning research (3ce6a86)
  • build: add the W8 handoff and requests, and record the UI dependencies (ccb75a5)
  • build: add the W9 handoff and requests, and record build tool dependencies (85540b0)
  • build: close the items left open after Phase 3 (871d1bf)
  • build: close W8 8 in the integration report with its commits and suite results (a765ec0)
  • build: correct the W10 handoff on read errors and compat coverage (ea82bca)
  • build: correct the W9 handoff and record the verifier fixes (c7c3930)
  • build: file the phase 3 decisions and open questions under their reviews (d9c0eab)
  • build: hand off the phase 3 authz review (0c1b8a0)
  • build: hand off the Phase 3 review of untrusted input (d49578f)
  • build: record James's Phase 3 decisions and the final check of every suite at a998d78 (9815b88)
  • build: record Pull quota enforcement in the W6 handoff and requests (c99b311)
  • build: record round 8 results, the Hub API MUSTs and the open import failure in the integration report (c79363e)
  • build: record sanitised Blob span errors and the AWS gap in the W1 handoff (a119388)
  • build: record that the release is on hold until James says go (2c15e82)
  • build: record the Compose and Helm smoke rerun and the download-path enumeration (8d32835)
  • build: record the create_pr fix, upload_large_folder cells and Postgres runs in the W4 handoff (e74034c)
  • build: record the final check of every suite at cd42d2b (382cc88)
  • build: record the measured responsive result and the follow-up fixes in the W8 handoff (948c7dc)
  • build: record the merges after 5975bec and the request ID fix in the integration report (4462828)
  • build: record the Namespace copy fix and the .gitkeep plugin in the W8 handoff (fdbbc1a)
  • build: record the phase 3 docs walk-through and its handoff (4ff146c)
  • build: record the Phase 3 input test runs (858ee9c)
  • build: record the pre-release check of every suite at 97d17c1 (98fa3f2)
  • build: record the requests phase 2 round 1 completed (065fc0a)
  • build: record the rerun-script revert and the Postgres health check fix (a25474e)
  • build: record the round 9 chart fixes in the integration report (f2e22bc)
  • build: record the second W9 check and its fixes in the handoff (2a1a631)
  • build: record the shared-transfer quota fix and the real quota run in the W6 handoff (cf7d08b)
  • build: record the third W9 check and its fixes in the handoff (3ed34a2)
  • build: record the v1.0.0 release dry run (ea2215e)
  • build: record the W1 security fixes in the handoff and requests (cac9d3e)
  • build: record the W11 index memory fixes and correct the follow-ups (2da4b1b)
  • build: record the W11 requests for wiring, auth and docs (3587b4f)
  • build: record the W11 security fixes and the xet.max_file_size request (1ff5f52)
  • build: record the W6 compat run figures in the handoff (6267b1d)
  • build: record W2 request 10 and rounds 2 and 3 in the integration report (8176449)
  • build: record W2 request 10 in RESOLUTIONS.md (3fc6cbe)
  • build: record W6 phase 2 fix round 1 in the handoff (1c2ab8a)
  • build: record W6 phase 2 fix round 2 in the handoff (5a68862)
  • build: record W6 phase 2 round 4 fixes in the handoff (89ef2b4)
  • build: record W6 phase 2 round 5 in the handoff (a17f874)
  • build: record W7 coverage in the handoff (29aeaa3)
  • build: report the Phase 3 hardening and its round 4 suite results (55ee4e2)
  • build: report the preview feedback round and its round 6 results (c3eebeb)
  • build: report the verification round at 9f08db7 in the preview feedback section (2954384)
  • build: update the W1 handoff after verification (8fb372f)
  • build: update the W2 handoff with the verification wait, fake changes and cross-branch runs (468dbe4)
  • build: update the W8 handoff for upload resume, the LM Studio snippet and axe coverage, and ask W2 to reuse uploads in progress (c00fbbe)
  • build: write the integration report (55c7064)
  • build: write the W11 handoff and fix the token refresh assertion (29b2e39)
  • compat: describe the Upstream Pull suite; feat(api): add the Mirror summary for Repo responses (7a499dd)
  • correct the demo GIF note and describe what the recording shows (277065d)
  • datasets: correct the W10 handoff on fuzzing, load and Postgres (5cf8406)
  • datasets: record the delta and decimal fixes in the W10 handoff (289ff65)
  • datasets: say a Mirror's Viewer needs the Upstream's Parquet export pulled (13dd831)
  • datasets: W10 handoff, requests and Hub differences (ac3c768)
  • fix what the get-started pages and guides got wrong (5554cb5)
  • helm: read the generated Secret by the name the chart gives it (1a0622e)
  • hfapi: bring the W4 handoff in line with discard and likers (08fa95d)
  • operate: document admin gc, reset-password, create-user and reindex (bfa4af3)
  • publish the website at hangar.page (0a1c993)
  • readme: set publicURL in the Helm install command (54d944b)
  • readme: show W8's screenshots of the Arsenal, a model card, the GGUF viewer and the Dataset Viewer (203fde8)
  • record phase 2 request resolutions and apply the doc changes they ask for (5ec1bc2)
  • record self-service profile and password changes (1cb7d6f)
  • record that self-set emails need a confirmation link (ef94378)
  • record the bellatrix upload fixes in the CLI help, guides and handoffs (dbbe9fb)
  • record the input limits, network policy and symbolic link rules (1b1d401)
  • record the scanner and download gate review (ad9cf7e)
  • reference: regenerate the CLI reference with the new admin commands (03953da)
  • regenerate the screenshots (aad25d7)
  • research: record the AWS S3 results (1c4e256)
  • research: use British spellings in the Xet upload research (13fadae)
  • research: use British spellings in the Xet upload research (da93189)
  • run the chart with Argo CD, use MinIO's own region and stream large files through nginx (d91688f)
  • say only, not just, where a quant or Split is chosen (6bfb7e9)
  • security: add the threat model (132da07)
  • security: link the threat model to spec 04 on GitHub, which the site does not publish (9ca750d)
  • serve hangar.page from Cloudflare Pages (41740e9)
  • spec: record the bound on concurrent password hashing (98a6457)

Dependencies

  • update github.com/getkin/kin-openapi to v0.151.0 (c4668be)

Changelog

All notable changes to Hangar are recorded here, in the Keep a Changelog style. release-please writes each entry from the Conventional Commits merged since the last release, and the project follows semantic versioning.

Nothing has been released yet.