chore(release): v1.0.1 (#851)

Patch release over 1.0.0:

- Gate the browse web UI on private (auth-enabled) deployments — closes an
  inventory-disclosure gap where /ui, /api/ui and /api-docs were served
  unauthenticated with anonymous_read off (#850)
- Native Google Cloud Storage backend (storage.mode = "gcs") (#842)
- Streaming raw uploads and downloads — bounded memory at any size (#845)
- rpm/deb repository reconcile (POST /{rpm,deb}/{repo}/-/reindex) (#847)

Author: devitway

CHANGELOG.md

@@ -1,6 +1,8 @@
 # Changelog
 ## [Unreleased]
 
+## [1.0.1] - 2026-07-13
+
 ### Security
 - **The browse web UI is now gated on a private deployment.** With auth enabled and `anonymous_read` off, the UI, its JSON API (`/ui`, `/api/ui`), and the API docs (`/api-docs`) were served without authentication — enumerating every repository and package a private registry exists to hide. They now require credentials unless `anonymous_read` (which already exposes the same names through the registry read APIs) or the new `auth.public_web_ui` (`NORA_AUTH_PUBLIC_WEB_UI`, default false) opens them; an unauthenticated request gets a Basic challenge so browsers prompt. Health/readiness probes stay unconditionally public. `/metrics` gets its own `auth.public_metrics` (`NORA_AUTH_PUBLIC_METRICS`, default **true** — scrapers rarely carry credentials and labels name registry formats, not repositories); set it false to gate metrics too. **Behavior change:** operators who relied on an anonymous web UI while keeping the registry APIs authenticated must set `public_web_ui = true` (or enable `anonymous_read`).
 

Cargo.lock

@@ -6,7 +6,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.0.0"
+version = "1.0.1"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT"

Cargo.toml

@@ -21,7 +21,7 @@ use crate::AppState;
 #[openapi(
     info(
         title = "Nora",
-        version = "1.0.0",
+        version = "1.0.1",
         description = "Multi-protocol package registry supporting Docker, Maven, npm, Cargo, PyPI, Go, Raw, RubyGems, Terraform, Ansible, NuGet, pub.dev, Conan, RPM, and Debian",
         license(name = "MIT"),
         contact(name = "The NORA Authors", url = "https://getnora.dev")