v0.11.3

[0.11.3] - 2026-09-14

Fixed

• Bumped @sproutboat/runtime to ^0.6.4, picking up the encode-side half of
  the same O(n^2) string-building bug v0.11.2 fixed on the decode side.
  __sbToBytes sits behind every crypto.subtle call a handler makes:
  digest, importKey, sign, verify and the PBKDF2/scrypt path all funnel
  their data, keys, salts and signatures through it, so hashing a request body
  was quadratic in the body's size. __sbHexOrBytes, which decodes the
  expected side of an HMAC verify, was worse still; it rewrote its
  accumulator's last character on every odd nibble, copying the whole string
  twice per byte (baronunread/sproutboat#180).

---

Superseded by v0.11.4. Do not use this release. The runtime bump it carries regressed small-input encoding badly: an app hashing ~150-byte values through crypto.subtle on every request lost 64% of its throughput, tripled its p50 and grew 41% in RSS (baronunread/sproutboat#181). Upgrade to v0.11.4, or stay on v0.11.2.