All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Sort packages by name instead of title for a more stable and deterministic sort order. #1689
- Require proxy targets to be HTTPS by default. #1647
- Require local indexers to include signatures for packages. #1646
- Update Go runtime to 1.26.2 #1675
- Update Go runtime to 1.25.8 1613
- Add
requiresfield to package index and search responses so clients can inspect package dependencies (input and content) before downloading. #1612 - Support for referencing inputs and streams by
package:type(for inputs) andinput(for streams) are no longer required whenpackageis set (format_version 3.6.0+, aligns with package-spec and composable packages). #1605 - Sort packages by semver when searching, after existing title sorting. #1585
- Package registry container image runs by default as a non-root user (UID 1000). #1503
- Optimize package loading by reading package ZIP archives and package folders concurrently. #1489
- Allow empty package paths on startup. #1482
- Update Go runtime to 1.25.3. #1468
- Fix performance issues when parsing some invalid certificates. #1468
- Add new
agent.versioncondition to search and categories endpoints. #1460 - Avoid parsing JSON columns in queries performed to artifacts related endpoints (SQL storage indexer). #1386
- Include SQL functions to improve filtering (SQL storage indexer). #1442
- Return just latest packages based on semantic versioning if
all=false(SQL storage indexer). #1445 - Apply a capabilities filter at database level if capabilities query parameter is set (SQL storage indexer). #1448
- Apply the discovery filter at database level if discovery query parameter is set (SQL storage indexer). #1454
- Include ingestion method also for input packages. #1431
- Update Go runtime to 1.25.1. #1426
- Fix context propagation in APM instrumentation in proxy mode. #1424
- Added "ingestion_method" mapping to data_streams to provide a high-level understanding of data collection in order to support downstream documentation. #1402
- Add data_streams to search policy_templates. #1408
- Added Security Subcategory "misconfiguration_workflow" and "vulnerability_workflow" #1414
- Add "opentelemetry" category for packages related to OpenTelemetry. #1415
- Added APM information (trace.id, transaction.id, service.name, service.version, service.environment) to the logs in order to correlate signals in Kibana. #1413
- Fix filtering by category in search endpoint (SQL Storage Indexer). #1394
- Update -allow-unknown-query-parameters flag to allow unknown query parameters by default. #1395
- Narrow the scope of the endpoints that validate the unknown parameters to just /search and /categories. #1395
- Fix filtering by capabilities in search and categories endpoint (SQL Storage Indexer). #1396
- Fail requests with 400 error code if there are unknown query parameters. This can be disabled via flag (-allow-unknown-query-parameters). #1382
- Update Go runtime to 1.24.6. #1388
- New Security subcategory "asset_inventory" #1357
- Update default value for the batch size used in SQL storage indexer. #1372
- Skip adding to cache requests containing package query parameter. #1378
- Added cache for categories endpoint (SQL storage indexer). #1379
- Update default values for cache search and TTL settings search (SQL storage indexer). #1379
- Storage indexer based on Google Cloud Storage is now GA. #1374
- This release includes a breaking change introduced in #1382. Requests with unknown query parameters fail with a 400 error code. This behaviour changes in the next release: Elastic Package Registry will accept any unknown query parameters by default. If you choose to enable query parameter validation, it will only affect the search and categories endpoints.#1395
- Reorder fields in primary key to keep same ordering as before (technical preview). #1348
- Add new method
MustParsePackageto create new packages, running more validations. #1333 - Allow to customize settings related to SQL storage indexer (technical preview). #1334 #1337
- Cleanup SQL storage indexer backup database only when a new index version is downloaded (technical preview). #1334
- Add support to discover content packages based on the datasets defined in the discovery parameter. #1338
- Include deployment modes in responses when they are defined at inputs of the policy templates. #1345
- Update Go runtime to 1.24.4. #1324
- Ignore unknown categories instead of producing fatal errors. #1297
- Fix usages of time.Since in defer statements used to obtain duration Prometheus metrics in the indexer. #1304
- Rename some spans to avoid conflicts. #1306
- Change license from Elastic License to Elastic License 2.0. #1298
- Add APM spans for proxy requests and storage indexer Get calls. #1306
- Add SQL storage indexer in technical preview. #1313 #1326
- Update Go runtime to 1.24.1. #1286
- Added new security subcategory
siem. #1284
- Remove support for TLS1.0. #1259
- Update Go Runtime to 1.23.4. #1261
- Include summary of data streams in search responses. #1264
- Add Access-Control-Allow-Origin header for all origins. #1266
- Expose
is_defaultflag in agentless deployment modes. #1269
- Update Go Runtime to 1.23.2. #1242
- Add new
discoveryparameter to search and category endpoints. #1235 - Expose
policy_templates.*.deployment_modesfield in both search and package endpoints. #1244 - Expose
policy_templates_behaviorfield in both search and package endpoints. #1244
- Update Go Runtime to 1.23.1. #1222
- Added support for content packages and its discovery fields. #1220
- Update Go Runtime to 1.22.6. #1215
- Fix context propagation in APM transaction for watcher backend process. #1150 #1152
- Update Go Runtime to 1.22.2. #1170
- Add support for multi-platform container images. #1162
- Use Wolfi as base for container images. #1169
- Reuse HTTP client when proxifying resolver requests. #1147
- Update Go Runtime to 1.21.7. #1144
- New Security subcategory "cloudsecurity_cdr" #1142
- Update Go Runtime to 1.21.4. #1124
- Add package and datastream agent privileges in the package endpoint #1109
- Add owner.type to the package endpoint #1109
- Update Go runtime to 1.21.3. #1102
- Raise an error if the value of environment variables used to set parameters are not valid #1103
- Add new parameter to specify minimum TLS version #1103
- Update Go runtime to 1.20.7. #1075
- Return all packages when using proxy mode and "all" query parameter is not set #1055
- Add new query parameter "capabilities" in search endpoint #1054
- Add new query parameter "capabilities" in categories endpoint #1061)
- Add new query parameters "spec.min" and "spec.max" in search endpoint #1058
- Add new query parameters "spec.min" and "spec.max" in categories endpoint #1059
- Update Go runtime to 1.20.4. #987 #1002
- Add fields related to subcategories into categories entrypoint with proxy mode #1004
- New Security subcategory "Advanced Analytics (UEBA)" #997
- Update Go runtime to 1.20.2. #957
- Deprecate Infrastructure category. #970
- Capitalize "Email" category title. #952
- New Security subcategory "Vulnerability Management". #953
- Add support for Windows. #956
- Fix internal server error when proxy mode is used and a package that doesn't exist is requested. #925
- Don't forward headers when requesting files from the package storage, just download them. #935
- Remove range headers when forwarding requests to package storage. #932
- Update Go runtime to 1.19.4. #924
- Fix headers forwarding when forwarding artifacts requests to the package storage. #928
- Updated titles of some categories. #914
- Forward requests from package-storage instead of doing http redirects. #915
- Update default value for
proxy-urlparameter to be Elastic Package Registry production. #899 - Add additional categories and subcategories. #914
- Support subcategories. Include parent category in categories API. #914
- Update Go runtime to 1.19.3. #919
- Search results for requests including
experimental=truedon't return prerelease versions of packages that have been released at least once as GA. #893
- Return experimental packages on searches with
prerelease=trueand withoutexperimental=true. #894
- Add support for "Infrastructure" category. #888
- Reduce peak memory footprint of recycling indices from storage. #881
- Use retriable HTTP client in proxy mode. #883
- Don't use io.ReadAll while recycling indices. #878
- Update favicon to be the Elastic Package Registry logo. #858
- Implement proxy mode. #860 #871 #873
- Update Go runtime to 1.19.1. #872
- Return only the latest version of each package when a combined index is used. #849
- Return only first appearance of the same version of a package when it is available in multiple indexes. #849
- Rename indexer metrics related to get operations and add the indexer name label to it. #853
- Add
elastic.subscriptioncondition to package index metadata, use this value for backwards compatibility with previouslicensefield. #826 - Add
source.licenseto relevant API responses when available. #854
- Update Go version and base Ubuntu image. #821
- Add support for "threat_intel" category. #841
- Instrument package registry with Prometheus metrics. #827
- Data streams are properly read from Zip packages without entries for directories. #817
- Prepare stub for Storage Indexer. Disable fetching packages from Package Storage v1. #811
- Support input packages. #809
- Implement storage indexer. #814
- Implement remote resolver for storage indexer. #823
- Structured logging following JSON ECS format. #796.
- Apply release fallback to datastreams validation. #804.
- Packages with major version 0 or with prerelease labels are only returned by search requests when they include
prerelease=trueorexperimental=true. #785 - Release level of a package without release tag is based on its semantic versioning now, previously it was experimental. #785
- Release level of a data stream without release tag is the same as the package that contains it, previously it was experimental. #785
- Add the
prereleaseparameter in search requests to include in-development versions of packages. #785
experimentalparameter in search requests is deprecated. #785
- Ignore the
internalparameter in packages and/searchrequests. #765
- Fix panic when opening specially crafted Zip file. #764
- Fix unbounded memory issue when handling HTTP/2 requests. #788
- Update APM Go Agent to 1.14.0. #759
- Update Gorilla to 1.8.0. #759
- Support package signatures. #760
- Update Go runtime to 1.17.6. #788
- Use Ubuntu LTS as base image instead of CentOS #787
- Properly handle modification headers (
If-Modified-Since,Last-Modified) for static resources. #756
- Fix: remove duplicated Categories property. #748
- Configuration file path can be selected with the
-configflag. #745 - Configuration flags can be provided using environment variables. #745
- Add
-tls-certand-tls-keyflags to configure HTTPS. #711 #746 - Support for
elasticsearch.privileges.clusterin package manifest. #750 - Update Go runtime to 1.17.1. #753
- Fix issue with relative paths when loading data streams. #742
- Decouple API from backend "indexers". #703
- Add support to serve packages stored as zip archives. #703
- Individual packages cannot be load if their path is specified with a trailing slash. #742
- Change format of responses to
/packageto make{"constraint": {"kibana.version": "7.16.0"}}be{"constraint": {"kibana": {"version": "7.16.0"}}}. #733
- Added
constraintsandownerfields to/searchresponses. #731 #734 - Add categories to /search output. Categories are added to the package and policy-templates. #735
- Fix: don't list old packages with categories incompatible with latest revisions. #719
- Support
elasticsearch.privileges.indicesin data stream manifests. #713
- Add -httpprof flag to enable HTTP profiling with pprof. #709
- Adjust counting logic for categories/policy templates. #716
- Update Go to 1.16.7 #706.
- Add instrumentation with the APM Go Agent #702.
- Support filtering /categories using
kibana.versionquery param #695
- Disable Handlebars parsing. [#692] (#692)
- Add input groups support. [#685] (#685)
- Support "synthetics" type. [#688] (#688)
- Fix the package not loading if it has an accidental file left in the package root directory. Add semver validation of the version directory. [#673] (#673)
- Add "dataset_is_prefix" field to data stream. [#674] (#674)
- Package validation can be disabled via command line option. [#667] (#667)
- Add "hidden" field to data stream. [#660] (#660)
- Add "ilm_policy" field to data stream. [#657] (#657)
- Set cache headers for 404 for all API endpoints to private, no-store.#652
- Set cache headers for 404 and 400 to 0. #649
- Expose proper EPR version. #644
- Rename config template to policy template and dataset to data stream. #641
- Add validation for icons and screenshots. #537
- Rename version to service.version in index handler. #633
- Remove config
public_dirwhich is replaced bypackage_paths. #632 - Ship packages as zip instead of tar.gz #628
- Rename image src to path and have src as the original value from the manifest. #629
- Add
cache_time.indexas config option. #631
- Change dataset.* fields to data_stream.* fields. #622
- Change dataset.* fields to datastream.* fields. #618
- Allow numbers in package names. #614
- Always populate template_path. #600
- Fix Gogle Cloud tag typo. #592
- Remove development mode. #597
- Change stream.* fields to dataset.* fields. #492
- Remove
solutionentry support in package manfiest. #504 - Remove support for Elasticsearch requirements #516
- Rename
kibanaquery param tokibana.version. #518 - Remove
removableflag from package manifest. #532 - Rename
datasourcestoconfig_templatesin dataset manifest. #570 - Remove support for logs and metrics category. #571
- Remove
dataset.type: eventas suported type. #567 - Remove support for requirements. Use conditions instead. #574
- Use filepath.Walk to find valid package content data. #438
- Validate handlebarsjs stream configuration templates. #445
- Serve favicon as embedded resource. #468
- Generate index.json file. #470
- Stream archived package content. #472
- Generate package index.json files. #479
- Add validation for dataset type. #501
- Add -dry-run flag. #503
- Encode fields in Kibana objects if not encoded. #506
- Validate required fields in datasets. #507
- Do not require "config.yml". #508
- Validate version consistency. #510
- Remove package code generator. #513
- Support multiple packages paths. #525
- Added support for ecs style validation for dataset fields. #520
- Use BasePackage for search output data. #529
- Add support for owner field in package manifest. #536
- Introduce development mode. #543
- Add additional supported categories to package. #533
- Apply rule: first package found served. #546
- Implement package watcher. #553
- Add conditions as future replacement of requirements. #519
- Introduce
elasticsearch.ingest_pipeline.nameas config option. #
- Delete package index.json from archives. Don't serve index.json as resource. #488
- Change package path from /package/{packagename}-{version} to /package/{packagename}/{version} #300
- By default /search?package= now only returns the most recent package. #301
- Stream configuration filenames have
.hbssuffix appended #308 - Align package storage directories with public dir structure #376
- Use index template v2 format for pre-built and generated index templates. #392
- Remove caching headers in case of errors. #275
- Allow to set cache times through config. #271
- Make README.md file a required file for a package. #287
- Add stream fields to each dataset #296
- Add
allquery param to return all packages. By default is set false. #301 - Add
multipleconfig for datasource. By default true. #361 - Add
removableflag to package manifest. Default is true. #359 - Add stream template to package json. #335
- Add support for multiple inputs per dataset. #346
- Add experimental releases for packages and datasets. #382
- Handle invalid query params and return error. #382
- Add basic access logs. #400
- Validate ingest pipeline during packaging phrase. #426
- Use http.FileServer to serve package content and define HTTP headers #425
- Remove requirement for streams definition in dataset manifest. #483
- Change
requirements.kibana.version.min/maxtorequirements.kibana.versions: {semver-range} - Encode Kibana objects during packaging. #157
- Prefix package download url with
/epr/{package-name}. - Remove dataset.name but introduce dataset.id and dataset.path. #176
- Fix header for
tar.gzfiles fromapplication/jsontoapplication/gzip. #154
- Add
/healthand/health?ready=1endpoint for healthcheck. #151 - Add
defaultconfig to dataset manifest. #148 - Update Golang version to 1.13.4. #159
- Add missing assets from datasets. #146
- Add
format_versionto define the package format. - Add dataset array to package info endpoint. #162
- Add path field to search and package info endpoint. #174
- Add download field to package info endpoint. #174
- Add
packagefield to dataset. #189 - Add support for datasources. #216 #212
- Package Kibana compatiblity version is changed to
"kibana": { "max": "1.2.3"}#134 - Rename
integrations-registrytopackage-registry. #138 - Remove
packages.pathconfig and replace it withpublic_dirconfig. #118
- Change empty /search API output from
nullto[]. #111
- Add validation check that Kibana min/max are valid semver versions. #99
- Adding Cache-Control max-age headers to all http responses set to 1h. #101
- Validate packages to guarantee only predefined categories can be used. #100
- Cache all manifest on service startup for resource optimisation. #103
- Fix Docker image to specific Golang version. #107
- Add .dockerignore file for slimmer image. #104
- Move package generation to its own package. #112
- Remove not needed files in Docker image. #106
- Add healthcheck to docker file. #115
- Make caching headers configurable per endpoint. #116
- Add readme entry to package endpoint. #128
First tagged release. No changelog existed so far.