fix(updates): allow update feeds on private repos #421

Merged

jmiller merged 1 commits from dev into main

2026-06-02 14:37:47 +00:00

Author	SHA1	Message	Date
Jonathan Miller	ead620daf9	fix(updates): allow update feeds on private repos via lightweight repo loader Branch Policy Check / Verify merge target (pull_request) Successful in 1s Details Universal: PR Check / Branch Policy (pull_request) Successful in 1s Details Universal: PR Check / Validate PR (pull_request) Failing after 6s Details Branch Cleanup / Delete merged branch (pull_request) Has been skipped Details PR RC Release / Build RC Release (pull_request) Successful in 20s Details Universal: PR Check / Build RC Package (pull_request) Has been cancelled Details Update feed endpoints (updates.xml, dolibarr.json, wordpress.json, packages.json, prestashop.xml, drupal.xml, whmcs.json, changelog.xml) now use RepoAssignmentPublicFeed instead of the full RepoAssignment. The lightweight loader fetches the repo by owner/name without checking user permissions. Feed handlers gate access via license keys, not repo membership. This allows private repos to serve update feeds to anonymous Joomla/WordPress/Composer clients with valid license keys. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-06-02 09:36:06 -05:00