Clojars and October 2026 Project Updates

Our October report includes an update on the Clojars maintenance and ‘on-call" support work undertaken by Daniel Compton and Toby Crawley during the last 6 months. In addition, Ambrose Bonnaire-Seargent and Cvetomir Dimov share the most recent updates on their projects.

Clojars maintenance and support overview
Malli: Ambrose Bonnaire-Seargent
SciCloj Documentation and Plotting Libraries: Cvetomir Dimov

Clojars maintenance and support overview

Clojurists Together funds Toby Crawley and Daniel Compton to co-maintain Clojars. Their work includes responding to operational issues and community support requests, maintaining the service and its infrastructure, applying security updates, improving publishing and administration tools, and keeping hosting reliable and cost-effective. You can follow this work in the Clojars changelog and in our project updates. For help with Clojars, visit the #clojars channel on Clojurians Slack or open an issue. Clojars itself is open source, and contributions are welcome in the Clojars GitHub organization.
Review period: April to 30 September 2026
Author: Daniel Compton
Context: I took lead maintenance responsibility for Clojars from April-June while Toby Crawley was away and went back to co-maintainer when he returned.

Clojars maintenance & support: April to June 2026

Account and supply-chain security

Stronger password requirements: I increased the minimum Clojars password length from eight to twelve characters #934.

Session invalidation after password changes: I reviewed an earlier proposal for invalidating sessions, then made a smaller implementation #944. When a user changes or resets a password, Clojars now removes that user’s active sessions. This was a fairly low-risk issue, but featured highly in bug bounty submissions.

Deploy and token notifications: I added a migration to enable deploy notification emails for old users created before this preference existed #943. This will help maintainers detect a supply-chain takeover or unexpected deploys.
I also reviewed and merged the work adding email alerts when a deploy token is created #945.

Compromised-password detection: I started working on Have I Been Pwned password detection in #951 but haven’t completed it.

Infrastructure reliability and resilience

IPv6, DNS management, and redundancy: I imported our DNSimple DNS records into Terraform so changes could be reviewed and audited. I also added IPv6 support for `repo.clojars.org.
I also added Route 53 as a second DNS provider alongside DNSimple (closing #60). This increases resiliency to DNS outage issues. This is not a theoretical concern, in February DNSimple had an DNS resolving outage which caused a Clojars outage.

Build and deployment repair: I fixed the Packer build #55. I also fixed the app uberjar so it can build on macOS case-insensitive filesystems #936.

I also made the instance-refresh script wait for AWS Auto Scaling to report success or failure instead of returning as soon as a refresh started. It reports progress and exits unsuccessfully for failed, cancelled, or rolled-back refreshes. I updated the Leiningen version on the production image to resolve a deployment problem.

Infrastructure as code: I moved the Clojars maintainer IAM group and its day-to-day AWS permissions into Terraform. This replaced console-only configuration with a Terraform maintained policy covering the services needed to operate Clojars, billing information, and Route 53 Domains.

I added contributor and coding-assistant guidance to the infrastructure repository and updated its setup documentation for DNS credentials and the Terraform workflow.

Development workflow

I added coding agent guidance to help guide usage of coding agents.

Clojars maintenance & support: July to September 2026

This covers Daniel’s and Toby’s work on Clojars.

Daniel’s work

Infrastructure hardening

Daniel changed the production EC2 launch-template configuration to require IMDSv2 tokens and limited metadata responses to one network hop. Before opening the change, he checked CloudWatch metadata metrics and exercised the real Cognitect AWS client against a local IMDSv2-only endpoint #61.

He prepared dedicated private database subnets with no internet or NAT route, moved the production RDS configuration into a private subnet group, disabled public accessibility, and enabled deletion protection #62.

Daniel also updated the Terraform backend to use the native S3 lockfile supported by current Terraform versions, removing the need for a separate DynamoDB locking table commit 357062b.

Toby identified that the production repository metadata still referred to the old HTTP URL in #966. Daniel then fixed the repo metadata to https://repo.clojars.org and managed the S3 object via Terraform #63.

Application tooling and maintainer review

Daniel updated the bin/clj-kondo bootstrap script to select the correct release for Intel and ARM64 builds on macOS and Linux and to keep architecture-specific cache directories. Commit 32cf33f landed on 20 August.

On Call management

Daniel added more monitoring for Clojars and setup an on-call 24x7 pager rotation for Clojars.

Security review

Daniel began a security review of the Clojars service. No major issues were identified, but some remediation work is in progress and will be published soon.

Toby’s work

Clojure Conj Talk

Toby gave a talk at the 2026 Clojure Conj about the history of Clojars and how it works. The video will be available on the ClojureTV YouTube channel soon.

Account, session, and authentication improvements

Toby simplified the normal login form so it only requests an MFA code after a user with MFA enabled has supplied valid credentials #950.

He moved sessions from the application’s memory into PostgreSQL, added a twenty-four-hour idle expiry, and added database cleanup for expired sessions. This makes longer-lived sessions practical and is one of the required steps for us to run multiple application instances - #964.

Toby tightened what the OAuth workflow returns so unserialisable provider data would not leak into session state, then corrected the workflow response handling after GitHub login failed in production. These fixes landed directly as commit 1896a51 and commit e9542cf.

He also updated GitLab login to accept all email addresses that GitLab marks as verified instead of requiring the address to be primary #971. Separately, #969 added the Clojars account name to notification-email footers, making messages unambiguous for people who have more than one account associated with an address.

Supply-chain and dependency security

Toby updated Jackson, the PostgreSQL driver, and Logback to address reported vulnerabilities in #956, then handled another set of dependency vulnerabilities and cleaned up obsolete or spurious suppressions in #965. A further September dependency update addressed eight CVEs in commit 67727be.

He prevented publication of POM and Gradle module metadata containing dynamic dependency versions, e.g. version ranges like [16,17), RELEASE, or SNAPSHOT #960.

Toby removed the separate Apache HTTP client stack in favour of the http-kit client already in use, reducing the dependency and CVE surface #961. He also switched from a temporary fork of the one-time library back to its official release #962.

Development, CI, and operational reliability

Toby updated clj-kondo, adopted its new constant-condition linter, and fixed the issue the new check found #963.

After removing Apache HttpClient, he fixed Fastly cache purging by switching to Fastly’s POST API, which the http-kit client supports. Commit 0c7e45a landed on 22 July. He also aligned the local Docker Compose environment with the PostgreSQL 18.4 version used in production in commit 61eb196.

Toby replaced the unavailable MinIO test image with S3Mock, updated the CircleCI base image, and repaired Maven dependency caching that had not been using the intended path #970.

His infrastructure maintenance increased Fastly log retention for analysis, corrected that policy so it actually retained 120 days, and fixed the instance-selection script so status messages no longer contaminated the IP address returned to callers. These changes landed as commits 5ebe01a, a994755, and f615c38.

Malli: Ambrose Bonnaire-Seargent

Q2 2026 Final Report 3. Published October 15, 2026

In this project, I am tackling exponential growth related to Malli refs. This is my final update of three. Thanks to Clojurists Together and Metabase for supporting this project.

I concentrated on three activities for this time period.

Draft PR: https://github.com/metosin/malli/pull/1284/changes

First, I added documentation to my branch explaining what the proposed changes to malli.core enables. See the README.md changes in my pull request.

Second, I added more complex test cases for the new cycle detection in schemas. There were a few useful test cases I introduced years ago to test cycle detection in malli.generators, and now I have repurposed them for malli.core tests as the cycle detection has moved there.

Third, I took some time to deeply consider why a subtle condition is needed in malli.generator, that disables caching for generators if we’re currently under a gen/recursive-gen. Again, this was something I added years ago but didn’t fully understand its function. Earlier in this project, I had removed the condition, but it caused the tests to fail. It resulted in this small documentation change. I don’t know if we can improve the caching in this area of code, and it’s a potential area of future work. I suspect there’s more to learn here, and it may reveal a more effective approach to creating generators.

I’m pretty happy with the code, overall it elegantly resolves several hacks deep in Malli’s design while either conserving or improving performance, and exposes them such that extensions can better support recursive schemas. I need to do some work to update the PR description and communicate my proposal to the Malli maintainers.

A goal of this project was to address a hack in Metabase around the performance of ref schemas. I think this work has brought us closer to that goal by better understanding how to detect cycles in schemas and when it is safe to reuse schema objects. The project concentrated on a smaller scope, mainly property registries, and I documented some ideas for how we could generalize the benefits to more complex registries. More importantly, the time spent considering the smaller scope will give greater confidence that such generalizations will actually be correct and a good idea. I hope to find out soon.

SciCloj Documentation and Plotting Libraries: Cvetomir Dimov

Q2 2026 Final Report 1. Published September 30, 2026

During the first month, I worked on both documentation and libraries. In terms of documentation, I mostly finished with the redesign of the Noj website. The website now looks much more modern with a theme inspired by the Macroexpand conference website and a main page. It also makes sure to spell out Noj’s main strengths, it presents the main libraries in an appealing way, and links to Zulip, Github and SciCloj. Moreover, the website is now structured to have separate sections for a quick start, for a book to learn data science with Noj, and for library references.

In terms of library development, initial steps have been made toward a new library for interactive dashboards and for porting the dataset library Tablecloth to ClojureScript. Specifically, the repository of the interactive dashboard library has been initiated, a feature list has been created and the base architecture has been designed. Currently, the process for selecting the required technologies is taking place. For Tablecloth, I have started studying the design of the existing Clojure library.