clojars 2026-07-12

I've been getting e-mails about clojars releases I did and they are getting a bit too much. I can't remember opting into those, but they also don't go away when I unselect the checkbox on clojars

I'm not repl'ed in ATM, but you should be able to disable it at https://clojars.org/mfa. Let me know if that doesn't work!

I can't disable it for seancorfield because I can't login with that user—because it wants 2FA on that account and I can't verify it any more 😞 It is already disabled for GitHub login, it seems—but that no longer shows me all the groups that belongs to, so something seems messed up there.

Let me take a look! I'll DM you.

To followup here on Sean's issue: it was caused by having multiple accounts under the same email address, and using GitHub login. https://github.com/clojars/clojars-web/issues/958 should address the issue when we implement it.

This was a feature we added a few years ago, but made it opt-out for new users, opt-in for existing users. But we decided to make it opt-out for everyone, as a security feature, and released that change a few days ago. But I didn't do a good job (or any job) of announcing it. As far as not being able to turn that off: that's certainly a bug; I'll look at it now.

🙏 1

I see the option is off for you in the db, and the last deploy email in the logs was sent to you at 13:38:38 UTC (for babashka/babashka 1.12.219-SNAPSHOT). I see you've deployed since then (most recently sci 0.14.54). Did you get an email for that?

I have not deployed SCI since then?

maybe CI tried to deploy SCI but that version was already released

every time I merge something to babashka master a snapshot is released and I get an e-mail. but let me check if it persists and then get back to you

I didn't check to see if the sci deploy was successful, I just saw it mentioned in the logs. Thanks! Unfortunately, we don't track when you changed the setting, so I can't correlate that with the deploys in the logs.

Seems to have resolved itself!

oh hmm, now I've been getting one for babashka again: User 'borkdude' just deployed babashka/babashka 1.12.219-SNAPSHOT to Clojars: https://clojars.org/babashka/babashka/versions/1.12.219-SNAPSHOT If you believe this is malicious activity, please reply to this email immediately and let the Clojars staff know! You can turn off these notifications in your settings on https://clojars.org.

and in the web ui my notification prefs are still off

might be an edge case with SNAPSHOT or so?

Ah, I think see the issue. The email goes to every member of the group, and the babashka_nrepl user has your gmail address. So that user is still getting emails (and it would mean you were seeing double the emails earlier, across two users).

I can turn it off for that user if you like; I'm already in there.

please do :)

and thanks for running clojars! it's a lovely and moreover essential piece of infra I use every day

➕ 1

Thanks for the kind words. My pleasure!

And thanks for everything you do: I use multiple tools you have built every day! (mostly clj-kondo & babashka)

➕ 1
🙏 1

I unchecked "Receive deploy notification emails?", pushed an update to HoneySQL which generated a SNAPSHOT, and still got an email. I login via GitHub (I can't login via seancorfield as it wants a 2FA code via an app and I lost that in a phone upgrade ages ago).

(I unchecked it because I already got two deploy emails in less than a minute from earlier pushed to the main branch)

If you can turn 2FA OFF for seancorfield, that would be helpful. I do not have it enabled for GitHub login (since I already have 2FA on GitHub itself).