| 2026-11-05 | Alerts | One problem now sends one System health alert instead of a Cluster health and a System check alert, updated in place as it gets worse, changes or clears, with a daily reminder while it lasts; a new problem the hourly system check finds is checked again two minutes later before it alerts, and a paused server's scheduled jobs get 15 minutes to catch up before they count as overdue. See Alert tuning. |
| 2026-11-05 | Alert tuning | New Settings → Advanced → Alert tuning: mute a problem, a check, a server or a whole alert category for a while, until it clears or until removed (with Mute… on alerts, the system check and Clustering), turn a check's notifications off or keep only failures, and change how long it waits, how often it reminds and its thresholds (overdue jobs, failed runs, disk space, late heartbeats). |
| 2026-11-02 | Quarantine | Quarantine rules can hold versions with known vulnerabilities of their own the moment a proxy fetches them or they're uploaded (Enterprise, with vulnerability data); proxies leave such versions out of the lists clients resolve from, so ranges pick the fixed version, and a refused download names the advisories and the version that fixes them. Stored versions are judged again when new advisories name them, following the re-check setting, and versions held until checked are released once found clean. |
| 2026-11-02 | Conan | Conan archives are checked against each revision's manifest in the background, and a mismatch quarantines the version; version pages show the recipe's licence, description, homepage, topics and sources, and each binary's integrity, size and package revisions; and SBOMs a package ships under metadata/ appear under Security (C/C++ components, and a package's own SBOM listing only itself, stay not covered). |
| 2026-11-02 | Conda | Pro: conda versions get SBOMs from their dependencies, and packages fetched through proxies of conda-forge, Bioconda and Anaconda's channels are read with Syft, so the Python and CRAN R packages inside them are checked for vulnerabilities; conda packages themselves, Bioconductor and other R packages, and the few C/C++ libraries Syft recognises show as not covered (most C/C++ libraries inside conda packages aren't listed). |
| 2026-11-02 | SBOM | Components of a kind no vulnerability data covers (such as C/C++ Conan packages, conda packages or generic entries) now show as not covered instead of clean, a version made only of them no longer gets the green check, versions where only some components are covered (for example container images whose SBOMs list generic or GitHub entries) show "No known vulnerabilities" without the green check, sbom.scan.complete says how many were checked and not covered, and CRAN, Hackage, Swift and Bitnami packages are checked from OSV's data files too. |
| 2026-11-02 | Conan | Conan proxies and groups leave blocked versions, and with Hide quarantined versions on the ones quarantine holds, including versions not fetched yet that an age rule would hold by their upstream revision time, out of a version's revisions, its latest revision and search, so a version range such as [>=1.0 <2] installs the newest version that passes (Hidden versions; search looks up the age of at most 50 versions per answer); block-list rules for Conan read Conan version ranges such as >=1.0 <2, ~1.2, ^1.2 and 1.2.*. |
| 2026-11-02 | Conda | Conda proxies and groups leave blocked builds out of the metadata conda, micromamba and pixi solve from, and, with Hide quarantined versions on, the builds quarantine holds, including ones not fetched yet that an age rule would hold by when the proxy first saw them, so clients pick the newest build that passes (Hidden versions); block-list rules for conda read conda version specs such as 1.8.*, =1.8 and 1.8|1.9, and existing conda rules are now read the conda way (<2.3 also covers 2.3rc1), while Maven ranges such as (1.0,2.0) keep their meaning. |
| 2026-11-01 | Promotion | Pro: promote versions to another repository of their format, in the same space or another, by id or by tag, copied or moved (the source keeps them in its trash), from a tag's Promote button, a version's menu, the API, in the background for up to 5000 versions, or by an AI agent's promote_version tool; works for every format that takes browser uploads and for Docker images, and a policy can require tags first. |
| 2026-11-01 | Tags | Pro: spaces have tags with a description and attributes to put on versions from the Tags tab, the API or CI uploads (the X-Depotex-Tag header); tags show on version pages and in search results, and cleanup policies can keep tagged versions. |
| 2026-11-01 | Repositories | A repository's Metadata card checks or repairs what it serves to clients against its stored files (index files, package lists, manifest records), and Settings → Repositories does it for every repository or every one of a format; Rebuild metadata. |
| 2026-11-01 | Cleanup | Versions a cleanup policy removed can be restored from the space's new Trash tab or purged for good at once, and a policy's last run can be undone in one step. |
| 2026-11-01 | Proxy repositories | A proxy's Proxy cache card has Re-check now, which makes it ask its upstream again for everything it cached, and lists the remembered "not found" answers so you can forget one, a folder or all of them; see Re-check with the upstream. |
| 2026-10-29 | Clustering | Jobs that repeat at an interval (system check, vulnerability sync, quarantine expiry and others) now run on one server per interval instead of on every server of a cluster. |
| 2026-10-29 | Performance | Many uploads at once into one space no longer wait for each other: in a cluster of three servers, uploads are about 60% faster and their slowest responses about 2.5 times quicker. |
| 2026-10-29 | Installation | Pool settings in DATABASE_URL (pool_max_conns and the other pool_ options) no longer make setup and upgrades fail with "unrecognized configuration parameter". |
| 2026-10-29 | Block list | In a cluster, a block list's dry run (Check) now includes a rule saved on another server a moment ago, instead of up to 5 seconds later. |
| 2026-10-26 | Conan | Conan proxy repositories (Pro): a proxy caches ConanCenter (with the new ConanCenter upstream preset), an Artifactory or conan_server remote or another Depotex, on its own or in a group, checks each revision's manifest against its revision ID before keeping it, and keeps revisions installable after the upstream removes them; new Conan proxies follow Settings → Security → Proxy checksums. |
| 2026-10-25 | Repository groups | A group's largest upload now also applies to uploads sent without their size (chunked): they are refused once they pass it, with nothing stored. |
| 2026-10-25 | Conan | Conan groups: one remote for Conan 2 over several repositories, with revisions, binaries and search merged from the members and conan upload routed by the group's write rules (when a binary's recipe revision is in another member, the refusal names it and conan upload --force completes the upload); a recipe name any hosted member has hides upstream recipes of that name, for downloads too (on by default, in the group's Conan settings). |
| 2026-10-25 | Conan | Conan repositories: hosted repositories for Conan 2 (2.0 or later) take recipe revisions and their binaries from conan upload (a revision appears complete when its manifest arrives, and uploading it again with --force keeps it), sign in with an API token as the password, answer install, list, search, download and remove with revisions and metadata files, and show each version's recipe revisions and binaries in the browser, where a revision can be deleted. |
| 2026-10-25 | RubyGems | RubyGems group repositories: one address for hosted gems and RubyGems.org, with hosted names shadowing upstream ones, pushes routed to a hosted member, and Bundler downloading only what changed |
| 2026-10-25 | RubyGems | Proxy repositories of RubyGems.org and other gem registries (Pro): Bundler and gem install through them, each .gem checked against the registry's SHA-256 (new proxies follow Settings → Security → Proxy checksums), quarantine age rules judged by each version's publish date, and hidden versions left out of what Bundler resolves |
| 2026-10-25 | Block list | Version ranges are read in each format's own syntax where it has one, so a rule for RubyGems takes requirements such as ~> 1.2 or >= 1.0, < 2 and reads them as gem and Bundler do, and a range is kept as you type it (Maven-style ranges, and spaces inside a version, are still saved without spaces). |
| 2026-10-25 | Conda | Conda groups: one channel for conda, micromamba and pixi over hosted channels and proxies, with sharded and whole repodata merged from the members and uploads from rattler-build routed by the group's write rules; hosted package names hide upstream packages of the same name, for downloads too (on by default); and conda proxies also serve an upstream channel whose repodata.json points its packages at another address. |
| 2026-10-24 | RubyGems | Hosted RubyGems repositories, on every license tier: gem push and rake release (a version RubyGems counts as one already pushed, such as 1.0.0 after 1.0, is refused as on RubyGems.org, and pushing a gem again restores its file when the integrity check found it missing), installs with Bundler and gem, platform builds as files of one version, gem yank per platform, gem owner (owners listed by email address, user name or id, each of which --remove takes) and reserved gem names, and .gem files in the upload form. |
| 2026-10-24 | Conda | Conda channels: hosted repositories take .conda and .tar.bz2 packages from rattler-build, curl or the web (a rerun upload of the same file passes), serve repodata and, when turned on, sharded repodata to conda, micromamba and pixi, and can yank builds; proxy repositories (Pro) cache conda-forge, Bioconda or another channel, fetching only files the upstream lists and checking each against its sha256; new conda proxies follow Settings → Security → Proxy checksums. |
| 2026-10-23 | Vibe artifacts | Enterprise: gems a Gemfile.lock locks for a platform (such as nokogiri 1.16.8-x86_64-linux) are checked at their version, so vulnerabilities fixed in that version no longer show on check-ins, gems.locked files are read too, and check-ins already pushed are read again in the background after the upgrade (with several servers, re-inspect vibe repositories once every server runs this version). |
| 2026-10-23 | API tokens | Package managers can send an API token as the user name with an empty password (Bundler's token-only setting), and an OAuth access token on its own with no scheme, so a CI job can publish with the access token it gets through workload identity. |
| 2026-10-23 | Proxy repositories | Settings → Security has a Proxy checksums switch (on by default, PROXY_STRICT_CHECKSUMS until saved) that proxy repositories set to the new Checksums value Use the Security setting follow: on, a file whose checksum doesn't match the upstream's is refused; off, it is served with a warning; repositories set to Strict, Warn or Off keep their own setting, and a repository's settings show what Use the Security setting means at the moment. |
| 2026-10-23 | Policies | The Compliance tab of a policy on depot.repository.create now sees each existing repository's type, space, upstream and proxy checksum setting, so a condition such as payload.type == "proxy" && payload.checksum_policy != "strict" lists the proxy repositories that aren't Strict. |
| 2026-10-23 | APT and YUM | Generated indexes now carry Last-Modified and answer an unchanged If-Modified-Since with 304, so apt-get update no longer downloads an unchanged index again. |
| 2026-10-23 | Repositories | The Browse format filter and the block-list, quarantine and cleanup rule dialogs list formats in the order the API does (Terraform, Composer and Hugging Face move), and a repository's Largest artifact setting explains that, left empty, the format's own limit applies when it is smaller than the installation's, and that a limit set there replaces both. |
| 2026-10-23 | Browse | A version with several files, such as wheels and a source archive or a jar and its POM, has a File picker on its page that Download, the curl command and the checksums follow, and the AI tools' download link lists the version's files to choose from. |
| 2026-10-22 | Performance | Each server keeps spaces, repositories, roles, access grants and repository settings in memory and drops them as soon as they change on any server, so a download reads the database twice instead of eight times; READ_CACHE_ENABLED=false turns this off on a server. |
| 2026-10-17 | Plugins | Connect an AI agent in the profile menu has a Vibepack skill tab to download the agent skill and see how to use it, and plugin screens can offer a .zip from their package to download. |
| 2026-10-17 | Vibe artifacts | Enterprise: the vibepack skill connects an AI agent with the Depotex AI tools or a saved API token, asks for the project's name, status and other details before its first save, and offers screenshots, captured pages or mock-ups; its script saves a check-in from a terminal without an agent, asking the same questions step by step. |
| 2026-10-14 | Quarantine | Enterprise: quarantined versions can be blocked (kept, and refused from then on) or deleted and blocked, in their repository, their space or every space, for one version or every version of the name; repository admins get a Quarantine tab for their repository. |
| 2026-10-14 | Block list | Block-list rules now refuse uploads and proxy caching of the versions they match too, and rules made from quarantine also refuse their files' content under any name. |
| 2026-10-14 | Vibe artifacts | Enterprise: check-ins record what must keep working, the environment they need and whether their tests passed; the project page offers the last passing check-in to go back to, and milestones can be named or renamed from the Vibe browser. |
| 2026-10-14 | Vibe artifacts | Enterprise: Settings can let pushes with secrets or hidden characters through as high findings, and download the typosquat check's popular-package list from an address you set, daily or on demand, falling back to the built-in list. |
| 2026-10-14 | Vibe artifacts | Enterprise: every push is checked: secrets and hidden characters in AI instruction files refuse it, and packages that don't exist or are new, open database rules, lockfile vulnerabilities and risky code show as findings on the check-in's new Findings tab. |
| 2026-10-14 | Vibe artifacts | Enterprise: AI coding tools can search, pull, compare and publish vibe projects through the Depotex AI tools (MCP); every publish answers with the check-in's link in the Vibe browser. |
| 2026-10-14 | Vibe artifacts | Enterprise: the Vibe browser searches projects, milestones, what changed and screenshot captions, with project and check-in pages, a timeline, a screenshot wall and a zip download of each check-in. |
| 2026-10-13 | Vibe artifacts | Enterprise: vibe artifact repositories hold projects pushed as numbered check-ins with files and screenshots; every push answers with a link to the check-in in the Vibe browser. |
| 2026-10-13 | Vibe artifacts | Enterprise: turn on vibe artifacts in Settings → Repositories → Vibe artifacts to add the Vibe browser to the menu, beside Browse. |