v1.1.2

• Security and API Hardening

  • fix(httpapi): HMAC-sign and verify upload URLs, rename download signature param to sig
  • fix(httpapi): validate X-Forwarded-* for URL generation and de-reflect OpenAPI server URL
  • fix(auth): require exp claim with clock-skew leeway in JWT validation
  • fix(auth): initialize JWKS verifier eagerly with explicit timeouts and retries
  • fix(cache): pin download response headers to prevent content sniffing

• Storage and Reliability

  • fix(cache): support validated ranged proxy downloads
  • fix(storage): bound reconciliation and cleanup memory usage
  • fix(cache): signal already-exists on reserve for live finalized cache entries
  • fix(cache): keep active uploads alive during cleanup

• Protocol and Compatibility

  • fix(cache): accept proto3 JSON string size_bytes in finalize

• Performance

  • perf(cache): materialize capacity eviction recency for indexed candidate ordering
  • perf(cache): take location row lock on downloads only while merge is possible
  • perf(cache): batch reader lease releases