v3.1.0

3.1.0 (2026-08-02)

Features

• deploy: add paas deployment templates (b5da734)
• storage: add gcs storage and readiness probes (06594ee)

Bug Fixes

• harden cache, token, and config paths from adversarial review (#23) (e505599)

v3.0.0

3.0.0 (2026-07-06)

⚠ BREAKING CHANGES

• ADMIN_TOKEN must be at least 16 characters.
• DELETE /v1/admin/tokens/{id} deletes by token id instead of token value.
• the Helm chart rejects replicaCount > 1 because the token database and data/cache volumes are single-writer.

Features

• harden remote cache operations (6303566)
• health: add health response helper (99fb78e)
• health: add unauthenticated health endpoint (87125c5)
• helm: add core templates for deployment, service, secret, pvc, sa (46df999)
• helm: scaffold chart with values and helpers (bbbf8a3)
• s3: resolve credentials via AWS provider chain for IRSA support (0b869b2)
• server: add BIND_ADDRESS listen option with IPv6 support (4a54be5)
• server: add direct TLS via TLS_CERT_PATH and TLS_KEY_PATH (d8a72fb)
• server: drain in-flight requests on SIGTERM and SIGINT (23797cd)

Bug Fixes

• cache: reject dots and cap hash length at 128 (9764d3f)
• chart: drop hook-succeeded so helm test --logs can read the pod (8f3299c)
• chart: require ingress hosts, default pathType, guard sweepIntervalMs under s3 (e2907da)
• ci: set GH_REPO so the checkout-less binary publish job can resolve the repo (e28d14e)
• deps: override vulnerable docs form-data (2646865)
• docker: upgrade openssl to clear CVE-2026-45447 (3e65500)
• drain uploads on shutdown and harden S3 and chart config (821c113)
• helm: render MAX_UPLOAD_BYTES as an integer, not scientific notation (5136f13)
• s3: abort multipart upload on write error (621c0c0)
• s3: coalesce concurrent credential refreshes into one provider call (a74e202)
• s3: surface backend error bodies and explain missing conditional-write support (9a31f6d)
• server: log and exit non-zero if graceful shutdown fails (a924250)

v2.1.0

Adds an unauthenticated Prometheus /metrics endpoint (cache hit-rate, request counts by result, uploaded bytes). See PR #5.

v2.0.0

Warning

Breaking change. Token values are now hashed (SHA-256) at rest.

Existing SQLite databases migrate themselves on first start (gated by PRAGMA user_version), so you don't need to do anything by hand. One thing to know: a token's plaintext now appears exactly once, when you create it. The admin list and lookup endpoints return only id and permission, so a lost token can't be recovered and has to be replaced.

Pull: docker pull ghcr.io/thilak-rao/nx-cache-server-bun:2.0.0

v1.0.0

Security

• Enforce MAX_UPLOAD_BYTES on uploads (returns 413 over the limit). It was documented before this release but never actually checked.
• Compare the admin token in constant time.
• Reject path-traversal and malformed cache hashes, and require an integer Content-Length.

Build and CI

• Run the container as a non-root user; pin the Bun base image to 1.3.14-alpine by digest.
• Publish to GHCR from CI: a push to main gives :latest and :sha-<short>; version tags give :X.Y.Z and :X.Y.
• Dependabot now also watches GitHub Actions and Docker, not just Bun dependencies.

Maintenance

• Upgrade dev dependencies to latest. Add AGENTS.md as the shared agent guide.

Pull: docker pull ghcr.io/thilak-rao/nx-cache-server-bun:1.0.0