v1.2.1

Fixes

• Legacy npm/yarn-v1 SHA-1 integrity pins are now verified against fetched bytes instead of reporting an unverifiable pin.
• Go h1: digests no longer mark fetches as unverifiable
• An unsupported digest (e.g. PyPI's blake2b_256/md5) no longer erases verification from a supported digest that matched.
• HTTP refusal status codes (e.g. 404) are recorded on the record's status field rather than only in error text.
• URL extraction trims trailing punctuation (line-continuation backslashes, sentence punctuation, empty fragments) so fewer bogus URLs are fetched.

Optimizations

• Pin verification evaluates manifest pin and PURL checksum qualifier independently with simpler precedence; URL/pin code path simplified.

Full Changelog: v1.2.0...v1.2.1

v1.2.0

Features

• New fetch::resolve_artifacts / ArtifactMatrix enumerates every file a release publishes with its checksums, platform and ABI tags, and runtime constraints;
• Three PURL identities are now distinct and documented: purl::identity (broad lookup key), purl::release_identity (release-distinguishing), and artifact_purl (one exact file).
• Purl::parse repairs safe legacy spellings and emits one canonical PURL; Purl::parse_strict implements the purl-spec contract with no repairs.
• make test-purl-spec runs the upstream purl-spec suite, and PURL→URL→PURL is now tested bidirectionally for registries whose artifact URL is lossless.

Fixes

• Single-segment Go modules (tailscale.com, gioui.org) are accepted instead of rejected as non-PURLs
• Go module paths are matched case-insensitively against the proxy's !x encoding
• The name@version repair now only applies when the coordinate carries no version of its own
• A leading @ is treated as an npm scope, not a version.

v1.1.0

Features

• Added artifact-matrix resolution for npm, PyPI, RubyGems, Go modules, and Cargo crates.

• Added strict ECMA-427 PURL canonicalization and identity normalization.

• Expanded source reference extraction, including escaped imports and package-manager
  commands.

• Improved OCI image flattening and layer metadata handling.

Bugfixes

• Hardened registry fetching against SSRF, malformed coordinates, and unsafe URL
  interpolation.

• Added checksum verification for PURL-selected artifacts.

• Fixed Go proxy escaping, npm dist-tag resolution, and platform-specific artifact selection.

• Made cache writes atomic and bounded decompression resistant to oversized or tampered
  entries.

Optimizations

• Unified cached registry-document reads and stale-cache fallback behavior.
• Added bounded OCI layer counts and total decompressed-size limits.
• Improved artifact ranking and deterministic preferred-candidate selection.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

First release!