Changelog: release 6.9.0

[github-actions]

Release 6.9.0

• Date: 23. September 2026
• Tag: v6.9.0
• Source: kellnr/kellnr

Added

• (auth) enforce SSO-only login with RP-initiated logout, vol 2 (#1384) (#1384)
• (api) implement pagination for search (#1366)
• (docs) serve generated docs from the pluggable Storage backend (#1364) (#1364)
• (api) search by crate name and description (#1358) (#1358)

Changed

• (deps) bump object_store from 0.14.1 to 0.14.2 (#1390) (#1390)
• (deps) bump the npm-all group in /ui with 5 updates (#1389) (#1389)
• (deps) bump uuid from 1.26.0 to 1.26.1 (#1391) (#1391)
• (deps) bump object_store from 0.14.1 to 0.14.2
• (deps) bump taiki-e/install-action from 2.87.9 to 2.87.13 (#1385) (#1385)
• (deps) bump sea-orm-migration from 2.0.2 to 2.0.3 (#1387) (#1387)
• (deps) bump clap from 4.6.6 to 4.6.7 (#1386) (#1386)
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps) bump uuid from 1.26.0 to 1.26.1
• (deps) bump the npm-all group in /ui with 5 updates
• (deps) bump sea-orm-migration from 2.0.2 to 2.0.3
• (deps) bump clap from 4.6.6 to 4.6.7
• (deps) bump taiki-e/install-action from 2.87.9 to 2.87.13
• (deps) bump syn from 3.0.4 to 3.0.5 (#1382) (#1382)
• (deps) bump the npm-all group in /ui with 7 updates (#1381) (#1381)
• (deps) bump syn from 3.0.4 to 3.0.5
• (deps) bump futures-util from 0.3.32 to 0.3.34 (#1380) (#1380)
• (deps) bump toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0 (#1378) (#1378)
• (deps) bump taiki-e/install-action from 2.87.4 to 2.87.9 (#1377) (#1377)
• (deps) bump reqwest from 0.13.4 to 0.13.5 (#1379) (#1379)
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps) bump the npm-all group in /ui with 7 updates
• (deps) bump futures-util from 0.3.32 to 0.3.34
• (deps) bump reqwest from 0.13.4 to 0.13.5
• (deps) bump toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0
• (deps) bump taiki-e/install-action from 2.87.4 to 2.87.9
• (deps) bump tower-http from 0.7.0 to 0.7.1 (#1373) (#1373)
• (deps) bump hyper from 1.11.0 to 1.11.1 (#1371) (#1371)
• (deps) bump the npm-all group in /ui with 7 updates (#1372) (#1372)
• (deps) bump tower-http from 0.7.0 to 0.7.1
• (deps) bump hyper from 1.11.0 to 1.11.1
• (deps) bump toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0 (#1370) (#1370)
• (deps) bump flate2 from 1.1.9 to 1.1.10 (#1367) (#1367)
• (deps) bump sea-orm-migration from 2.0.1 to 2.0.2 (#1369) (#1369)
• (deps) bump taiki-e/install-action from 2.86.8 to 2.87.4 (#1368) (#1368)
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps) bump the npm-all group in /ui with 7 updates
• (deps) bump toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0
• (deps) bump sea-orm-migration from 2.0.1 to 2.0.2
• (deps) bump taiki-e/install-action from 2.86.8 to 2.87.4
• (deps) bump flate2 from 1.1.9 to 1.1.10
• (deps-dev) bump @humanfs/node from 0.16.7 to 0.16.8 in /ui (#1361) (#1361)
• (deps) update npmDepsHash in flake.nix [dependabot skip]
• (deps-dev) bump @humanfs/node from 0.16.7 to 0.16.8 in /ui
• (auth) deduplicate ID token verifier and split audience tests (#1360) (#1360)

Fixed

• (auth) use cert store from OS (#1376)
• error when Postgres password contains special chars. (#1383)
• (auth) address review findings from SSO enforcement (#1393)
• (ui) paginate crate search instead of capping it at 100 results (#1392)
• (api) enforce the search query length bound on both entry points (#1365) (#1365)
• (index) keep rust_version in served crates.io index entries (#1363) (#1363)
• (auth) allow configurable additional audiences (#1357) (#1357)