v1.2.0
Features
- New fetch::resolve_artifacts / ArtifactMatrix enumerates every file a release publishes with its checksums, platform and ABI tags, and runtime constraints;
- Three PURL identities are now distinct and documented: purl::identity (broad lookup key), purl::release_identity (release-distinguishing), and artifact_purl (one exact file).
- Purl::parse repairs safe legacy spellings and emits one canonical PURL; Purl::parse_strict implements the purl-spec contract with no repairs.
- make test-purl-spec runs the upstream purl-spec suite, and PURL→URL→PURL is now tested bidirectionally for registries whose artifact URL is lossless.
Fixes
- Single-segment Go modules (tailscale.com, gioui.org) are accepted instead of rejected as non-PURLs
- Go module paths are matched case-insensitively against the proxy's !x encoding
- The name@version repair now only applies when the coordinate carries no version of its own
- A leading @ is treated as an npm scope, not a version.