Issues

• One cached object larger than the low-water target makes the next eviction sweep empty the whole store, including that object

  bug
  ktsu-dev/GitLfsCache#98 · Filter by author matt-edmondson opened on Oct 7, 2026
  1

• Download whose bytes fail the oid hash check still completes as a clean 200 instead of failing the request

  bug
  ktsu-dev/GitLfsCache#96 · Filter by author matt-edmondson opened on Oct 6, 2026
  1

• The k8s StatefulSet sets no fsGroup, so on block-storage PVCs (EBS, PD, Azure Disk) the non-root pod can't write its store root and crash-loops at startup

  bug
  ktsu-dev/GitLfsCache#94 · Filter by author matt-edmondson opened on Oct 6, 2026
  1

• gitlfscache --store ./cache aborts with an unhandled OptionsValidationException stack trace instead of resolving the relative path like --config does

  bug
  ktsu-dev/GitLfsCache#93 · Filter by author matt-edmondson opened on Oct 6, 2026
  1

  

• Pushing any LFS object larger than ~28.6 MB through the proxy fails with 500: Kestrel's default 30,000,000-byte request body limit is never lifted

  bug
  ktsu-dev/GitLfsCache#92 · Filter by author matt-edmondson opened on Oct 6, 2026
  1

  

• locks/batch unlock-by-path reads the snapshot without credential admission, leaking which paths are locked and their lock ids

  bug
  ktsu-dev/GitLfsCache#91 · Filter by author matt-edmondson opened on Oct 5, 2026
  1

• Percent-encoded ? or # in the request path truncates the upstream URL, letting a non-trailing ** allow-list pattern be bypassed

  bug
  ktsu-dev/GitLfsCache#90 · Filter by author matt-edmondson opened on Oct 5, 2026
  1

• Allow-list enforcement is only tested on 4 of the route kinds; locks spec tests for replaced-snapshot cursors and the shared fan-out limiter are also missing

  enhancement
  ktsu-dev/GitLfsCache#89 · Filter by author matt-edmondson opened on Oct 5, 2026
  1

• Batch responses that pick a non-basic transfer adapter still get their hrefs rewritten to the proxy, breaking tus/multipart/custom adapters (design spec: "anything else falls through")

  bug
  ktsu-dev/GitLfsCache#88 · Filter by author matt-edmondson opened on Oct 5, 2026
  1

• The orphan sweep can delete a staging file between CloseAsync and the publish rename: the open-staging guard lifts at close, not after the move

  bug
  ktsu-dev/GitLfsCache#87 · Filter by author matt-edmondson opened on Oct 5, 2026
  1

• An unreachable upstream (DNS failure, connection refused, TLS error, reset) returns a bare 500 on batch, transfer, verify and relay routes instead of 502/504

  bug
  ktsu-dev/GitLfsCache#86 · Filter by author matt-edmondson opened on Oct 5, 2026
  1

• A 2xx batch response that isn't valid JSON, or has a mistyped field, returns 500 instead of 502 (e.g. an SSO page served with 200)

  bug
  ktsu-dev/GitLfsCache#81 · Filter by author matt-edmondson opened on Sep 29, 2026
  1

  

• No container image has been published since 2026-08-26: the CI migration dropped the ghcr publish job, but README and deploy/k8s still pull ghcr.io/ktsu-dev/gitlfscache:latest

  bug
  ktsu-dev/GitLfsCache#80 · Filter by author matt-edmondson opened on Sep 29, 2026
  1

• locks/batch failure results drop upstream's lock object, so a 409 conflict no longer says who holds the file, and exhausted retries always report 429

  enhancement
  ktsu-dev/GitLfsCache#78 · Filter by author matt-edmondson opened on Sep 29, 2026
  1

• POST locks/batch returns 500 instead of 400 when ref is not an object (e.g. "ref": "refs/heads/main")

  bug
  ktsu-dev/GitLfsCache#77 · Filter by author matt-edmondson opened on Sep 29, 2026
  1

  

• No bytes-evicted metric: eviction sweeps are only visible in logs (spec instrumentation item missing)

  enhancement
  ktsu-dev/GitLfsCache#75 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• One network error on a single locks/batch item turns the whole fan-out into a 500, discarding locks upstream already granted

  bug
  ktsu-dev/GitLfsCache#74 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• A backslash in the request path escapes the upstream base-URL prefix and the repository allow-list

  bug
  ktsu-dev/GitLfsCache#73 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• No lock snapshot-size metric: operators can't see how close a repository is to MaxSnapshotLocks (spec instrumentation item missing)

  enhancement
  ktsu-dev/GitLfsCache#72 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• Unlock by path fails with 404/409 when the snapshot names a released-and-reissued lock id: the spec's one refresh + one retry isn't implemented

  enhancement
  ktsu-dev/GitLfsCache#71 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• A lock created or released during an in-flight lock-list refresh is missing from listings for a full ListTtl: the refresh publishes its stale walk after the invalidation ran

  bug
  ktsu-dev/GitLfsCache#70 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• A staging flush that fails (e.g. disk full) turns an upload upstream accepted into a 500, and leaves the staging file uncollectable until restart

  bug
  ktsu-dev/GitLfsCache#69 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• Batch responses advertise the proxy's 1h token lifetime even when upstream's href expires sooner, so git-lfs never re-batches and gets 401/403

  ktsu-dev/GitLfsCache#66 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

  

• A repository with more locks than MaxSnapshotLocks is re-walked up to the ceiling on every GET locks, then relayed anyway

  ktsu-dev/GitLfsCache#65 · Filter by author matt-edmondson opened on Sep 28, 2026
  1

• A refused lock-list refresh returns a bare status to the client, dropping upstream's body and Retry-After / LFS-Authenticate headers

  ktsu-dev/GitLfsCache#64 · Filter by author matt-edmondson opened on Sep 28, 2026
  1