SirBerg · Oct 16, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/builder/pyproject.toml b/builder/pyproject.toml
@@ -3,7 +3,7 @@ requires = ["setuptools>=80.0", "wheel"]
 
 [project]
 name = "iglu-builder"
-version = "0.1.0"
+version = "0.0.2"
 description = "WebSocket-based build system interface for iglu"
 requires-python = ">=3.13"
 dependencies = [

diff --git a/cache/lib/determine_version.ts b/cache/lib/determine_version.ts
@@ -22,6 +22,7 @@ export default async function determine_version(): Promise<void> {
     const fetch_options: RequestInit = {
         method: "GET",
     };
+    const package_json = require("../package.json");
     const versions = await fetch(
         `https://api.github.com/repos/iglu-sh/iglu/tags`,
         fetch_options,
@@ -53,7 +54,6 @@ export default async function determine_version(): Promise<void> {
         return;
     }
 
-    const package_json = require("../package.json");
     if (current_version.name.replace("v", "") !== package_json.version) {
         Logger.info(`** NEW VERSION AVAILABLE **`);
         Logger.info(`You're on version: ${package_json.version}`);

diff --git a/docs/docs/02-cache/03-nixos-module.mdx → docs/docs/02-cache/05-nixos-module.mdx b/docs/docs/02-cache/03-nixos-module.mdx → docs/docs/02-cache/05-nixos-module.mdx
diff --git a/docs/docs/04-development/04-versioning.mdx b/docs/docs/04-development/04-versioning.mdx
diff --git a/docs/docs/04-versions/index.mdx b/docs/docs/04-versions/index.mdx
@@ -0,0 +1,39 @@
+---
+title: Versions & Update Guide 
+slug: versioning 
+---
+Hey there! If you're looking to update your Iglu services you've come to the right place. A version update usually should not require you to
+have to do anything. Sometimes Iglu does require more involvement on major updates this is usually while jumping from one major version to another.  
+
+See below for all supported versions and if there's an upgrade guide available for it.
+## Support policy
+We support the latest major version and all minor versions or patches in that major version window. We do not backport anything to past major versions, except for very critical security fixes.
+For security advisories see this page: [Security advisories](../security/security-advisories) 
+
+## Versions
+
+:::warning
+
+Iglu is currently in heavy development and we do not currently "support" any version after they are released. Releases are tested before going out and they are expected to work 
+in a vacuum but they may contain bugs and unfinished features. We do not plan on porting back any security fixes to any version in the v0.x.x phase, except in extraordinary circumstances. 
+
+If you do encounter any issues please, please, PLEASE report them to us at https://github.com/iglu-sh/iglu/issues
+
+:::
+
+Currently supported Major Versions: None until v1.0.0  
+Currently supported Versions:
+- v0.0.2
+
+
+Legend:
+- ✅ Full support, backported security fixes, etc.
+- 🚧 Limited support, some backported security fixes, no new features
+- ❌ Unsupported, no backported security fixes
+- 📅 Pre-release, active development but released as a tag for you to use and try out the latest features. This is inherently unstable and you should only use these tags as a testbench for upcoming features 
+
+|Version|Supported|Lifecycle state|Update Guide |Release Notes   |
+|-------|---------|---------------|-------------|----------------|
+|v0.0.3 |📅       |Pre-release    |None yet     |None yet        |
+|v0.0.2 |🚧       |Released       |None required|[v0.0.2](v0.0.2)|
+
diff --git a/docs/docs/04-versions/v0.0.2.mdx b/docs/docs/04-versions/v0.0.2.mdx
@@ -0,0 +1,74 @@
+---
+title: v0.0.2 
+slug: v0.0.2
+sidebar_position: 0
+---
+## Meta Information
+- Link to Github release: [Github](https://github.com/iglu-sh/iglu/releases/tag/v0.0.2) 
+
+---
+## Original Github Release
+This is the initial alpha release of Iglu. 
+
+---
+## Features
+### Cache
+- Derivation Upload by a cachix client
+- Cachix Deploy Feature
+- Basic Nix Derivation retrieval by a Nix client
+- Server Side or Client Side signing of derivations
+- Typescript SDK and Rest API for interacting with the Cache Service
+- S3 or local storage file backend for serving derivations
+- Postgres or SQLite Support
+- Deploy as Container or Nix Service
+
+### Builder
+- Basic Nix Derivation Builder implementation 
+
+## What's Changed
+* feat(DB)!: Initial DB Configuration, DAOs by @SirBerg in https://github.com/iglu-sh/iglu/pull/1
+* feat(cachix+nix): Base Caching Implementation by @SirBerg in https://github.com/iglu-sh/iglu/pull/2
+* feat(nix)!: Implement cache invalidation by @SirBerg in https://github.com/iglu-sh/iglu/pull/3
+* Feat builder init by @Svenum in https://github.com/iglu-sh/iglu/pull/4
+* chore(cachix): Fix reflected cross site scripting vulnerability in cachix narinfo endpoint by @SirBerg in https://github.com/iglu-sh/iglu/pull/5
+* chore(db): Introduce DB schemas for supporting cachix deploy by @SirBerg in https://github.com/iglu-sh/iglu/pull/6
+* feat(flake): package builder by @Svenum in https://github.com/iglu-sh/iglu/pull/7
+* feat(flake): add pre-commit hook by @Svenum in https://github.com/iglu-sh/iglu/pull/8
+* tests(DAOs): Introduce DAO tests by @SirBerg in https://github.com/iglu-sh/iglu/pull/11
+* feat(flake): dockerize builder by @Svenum in https://github.com/iglu-sh/iglu/pull/10
+* chore(workflow): add code check for PRs by @Svenum in https://github.com/iglu-sh/iglu/pull/9
+* feat(builder): add cache settings to config.toml + fix some bugs by @Svenum in https://github.com/iglu-sh/iglu/pull/12
+* feat(deploy)!: Introduce the cachix deploy endpoints by @SirBerg in https://github.com/iglu-sh/iglu/pull/15
+* chore!: Initialize the workspace reorganization by @SirBerg in https://github.com/iglu-sh/iglu/pull/17
+* test(routes): Introduce tests for the REST routes of the cache by @SirBerg in https://github.com/iglu-sh/iglu/pull/18
+* chore: fix biome + lint everything by @Svenum in https://github.com/iglu-sh/iglu/pull/19
+* feat(db): Feat postgres support by @SirBerg in https://github.com/iglu-sh/iglu/pull/21
+* feat: dockerize cache by @Svenum in https://github.com/iglu-sh/iglu/pull/22
+* chore: add build action by @Svenum in https://github.com/iglu-sh/iglu/pull/23
+* fix: add missing arch in tag by @Svenum in https://github.com/iglu-sh/iglu/pull/24
+* fix: fix some build failures + increase debugging capability of the build action by @Svenum in https://github.com/iglu-sh/iglu/pull/25
+* feat(rest): Introduce a REST Api for interacting with the basic cache functions by @SirBerg in https://github.com/iglu-sh/iglu/pull/26
+* feat(builder): add pre defined build options by @Svenum in https://github.com/iglu-sh/iglu/pull/27
+* feat(s3): Introduce S3 compatibility by @SirBerg in https://github.com/iglu-sh/iglu/pull/29
+* docs: Create templates for how to use the iglu cache by @SirBerg in https://github.com/iglu-sh/iglu/pull/30
+* feat(info): Add an info page for tenants by @SirBerg in https://github.com/iglu-sh/iglu/pull/31
+* chore(flake): restructure flake by @Svenum in https://github.com/iglu-sh/iglu/pull/32
+* chore: fix module + improve its check by @Svenum in https://github.com/iglu-sh/iglu/pull/33
+* feat: enable derivation deduplication by @Svenum in https://github.com/iglu-sh/iglu/pull/37
+* feat(docs): document all routes in openapi zod schemas by @SirBerg in https://github.com/iglu-sh/iglu/pull/34
+* feat: add IGLU_CACHE_RAW_CONF to load the config from a env by @Svenum in https://github.com/iglu-sh/iglu/pull/38
+* feat(logger): Enable the logger to display which function called the log by @SirBerg in https://github.com/iglu-sh/iglu/pull/39
+* chore(pre-commit): enable write for biomejs by @Svenum in https://github.com/iglu-sh/iglu/pull/43
+* fix(upload): Fix the upload logic to not allow 'cross-contamination' by @SirBerg in https://github.com/iglu-sh/iglu/pull/45
+* feat(sdks/typescript): Init of Typescript SDK by @SirBerg in https://github.com/iglu-sh/iglu/pull/40
+* feat(workflows): Add workflows to publish npm packages by @SirBerg in https://github.com/iglu-sh/iglu/pull/47
+* fix(workflows): Fix npm workflows by @SirBerg in https://github.com/iglu-sh/iglu/pull/48
+* feat(docs): init by @Svenum in https://github.com/iglu-sh/iglu/pull/41
+* fix(docs): increase the sidbar width by @Svenum in https://github.com/iglu-sh/iglu/pull/50
+* feat(signing): Implement serverside signing of derivations by @SirBerg in https://github.com/iglu-sh/iglu/pull/49
+
+## New Contributors
+* @SirBerg made their first contribution in https://github.com/iglu-sh/iglu/pull/1
+* @Svenum made their first contribution in https://github.com/iglu-sh/iglu/pull/4
+
+**Full Changelog**: https://github.com/iglu-sh/iglu/commits/v0.0.2
diff --git a/docs/docs/04-versions/v0.0.3.mdx b/docs/docs/04-versions/v0.0.3.mdx
@@ -0,0 +1,7 @@
+---
+title: v0.0.3
+slug: v0.0.3
+sidebar_position: -1
+---
+
+## Placeholder page for the v0.0.3 Releasenotes
diff --git a/docs/docs/05-security/Issues/.template b/docs/docs/05-security/Issues/.template
@@ -0,0 +1,83 @@
+
+# IGLU-YYYY-NNNN: *Short, specific title — what kind of flaw, in which component*
+
+> **Summary:** One or two sentences a user can read to decide whether they are
+> affected and how urgent it is. Example: *"A path traversal in the static file
+> handler of iglu ≤ 2.3.1 allows unauthenticated attackers to read arbitrary
+> files. Upgrade to 2.3.2."*
+
+|||
+|---|---|
+| **Severity** | High (CVSS 4.0: 8.7) |
+| **Affected versions** | `>= 2.0.0, < 2.3.2` · `< 1.9.8` |
+| **Fixed versions** | `2.3.2`, `1.9.8` |
+| **Published** | YYYY-MM-DD |
+
+<details>
+    <summary>CVSS Calculator v4 values</summary>
+    <code>
+    <CVS-Calc-Values> 
+    </code>
+</details>
+Use this calculator to get them: https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator
+
+## Impact
+
+What an attacker can achieve and under which conditions. Be concrete:
+
+- Who can exploit it (unauthenticated remote attacker, local user, malicious input file, …)
+- What they gain (code execution, data disclosure, denial of service, …)
+- Preconditions or non-default configuration required
+- Whether exploitation in the wild is known
+
+## Affected configurations
+
+Describe who is *not* affected as clearly as who is — e.g. "Only deployments
+with `serve_static = true` are affected."
+
+## Remediation
+
+**Upgrade** to a fixed version:
+
+```
+*install / upgrade command*
+```
+
+### Workarounds
+
+If users cannot upgrade immediately, list mitigations here — or state
+explicitly: *"No workaround is available."*
+
+## Technical details
+
+Root cause and how the fix addresses it. Keep exploit detail proportionate:
+enough for users and downstream packagers to verify the fix, not a ready-made
+exploit. Consider holding back a full proof-of-concept for a period after
+publication.
+
+## Timeline
+
+| Date | Event |
+|---|---|
+| YYYY-MM-DD | Report received |
+| YYYY-MM-DD | Report acknowledged |
+| YYYY-MM-DD | Issue confirmed, severity assessed |
+| YYYY-MM-DD | CVE requested / assigned |
+| YYYY-MM-DD | Fix released, advisory published |
+
+## Credits
+
+Thanks to *name / handle, affiliation* for reporting this issue responsibly.
+*(Only with the reporter's consent — ask how they want to be credited.)*
+
+## References
+
+- Fix commit: *url*
+- Release notes: *url*
+- GitHub advisory: *url*
+
+## Revision history
+
+| Date | Change |
+|---|---|
+| YYYY-MM-DD | Initial publication |
diff --git a/docs/docs/05-security/Issues/01-IGLU-2026-001.mdx b/docs/docs/05-security/Issues/01-IGLU-2026-001.mdx
@@ -0,0 +1,85 @@
+---
+title: IGLU-2026-001
+slug: iglu-2026-001
+---
+# IGLU-2026-001: Denial of Service by pushing the same path at the same time 
+
+> **Summary:** A missing unique index in Iglu's Database schema allowed disabling a path by pushing the same path simultaneously 
+
+|||
+|---|---|
+| **Severity** | Medium (CVSS 4.0: 5.8) |
+| **Affected versions** | `<= v0.0.2`  |
+| **Fixed versions** | `v0.0.3` |
+| **Published** | 2026-10-16 |
+
+<details><summary>CVSS Calculator v4 values</summary>
+`CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I`</details>
+
+## Impact
+
+An attacker **with access to a tenant** may disable a given nix store path (making Iglu return 404) by pushing it multiple times at the same time
+
+## Affected configurations
+
+All configurations are affected
+
+## Remediation
+
+**Upgrade** to a fixed version by updating the Iglu Docker or Nix Service:
+
+### Docker Compose:
+
+```diff
+services:
+    postgres:
+        image: "postgres:18.3"
+        environment:
+            POSTGRES_PASSWORD: "changeme"
+            POSTGRES_DB: "iglu"
+    iglu:
+-        image: "ghcr.io/iglu-sh/iglu-cache:v0.0.2"
++        image: "ghcr.io/iglu-sh/iglu-cache:v0.0.3"
+        volumes:
+            - "./binaries:/binaries"
+            - "./config:/config"
+        environment:
+            IGLU_CACHE_CONF: "/config/config.toml" # Sets which directory should be searched for your config.toml
+        depends_on:
+            - "postgres"
+        ports:
+            - "80:80"
+```
+
+### Nix Service:
+Run `nix flake update` and re-start the Iglu service.
+
+
+### Workarounds
+
+Make sure no untrusted person can access your Iglu Tenant. 
+
+## Technical details
+
+The root cause was a missing unique index over the fields `derivations_id` and `tenants_id` in the Table `derivations_tenants_links` which allowed inserting more than one link record between a tenant and a derivation (i.e nix store path).
+This caused the associated DAO Class to correctly determine that it couldn't reliably return a database record and it returned null instead causing the endpoint returning nix derivations to no longer return the affected store path. 
+
+## Timeline
+
+| Date | Event |
+|---|---|
+| 2026-10-12 | Report received |
+| 2026-10-12 | Issue confirmed, severity assessed |
+| 2026-10-16 | Fix released, advisory published |
+
+## References
+
+- Fix commit: [Github](https://github.com/iglu-sh/iglu/commit/1172e0ca35edd47a70efa855b0129edd412ca2de) 
+- Release notes: [v0.0.3](../../versions/v0.0.3) 
+- GitHub advisory: None published 
+
+## Revision history
+
+| Date | Change |
+|---|---|
+| 2026-10-16 | Initial publication |