v3.0.0

3.0.0 (2026-07-06)

⚠ BREAKING CHANGES

• ADMIN_TOKEN must be at least 16 characters.
• DELETE /v1/admin/tokens/{id} deletes by token id instead of token value.
• the Helm chart rejects replicaCount > 1 because the token database and data/cache volumes are single-writer.

Features

• harden remote cache operations (6303566)
• health: add health response helper (99fb78e)
• health: add unauthenticated health endpoint (87125c5)
• helm: add core templates for deployment, service, secret, pvc, sa (46df999)
• helm: scaffold chart with values and helpers (bbbf8a3)
• s3: resolve credentials via AWS provider chain for IRSA support (0b869b2)
• server: add BIND_ADDRESS listen option with IPv6 support (4a54be5)
• server: add direct TLS via TLS_CERT_PATH and TLS_KEY_PATH (d8a72fb)
• server: drain in-flight requests on SIGTERM and SIGINT (23797cd)

Bug Fixes

• cache: reject dots and cap hash length at 128 (9764d3f)
• chart: drop hook-succeeded so helm test --logs can read the pod (8f3299c)
• chart: require ingress hosts, default pathType, guard sweepIntervalMs under s3 (e2907da)
• ci: set GH_REPO so the checkout-less binary publish job can resolve the repo (e28d14e)
• deps: override vulnerable docs form-data (2646865)
• docker: upgrade openssl to clear CVE-2026-45447 (3e65500)
• drain uploads on shutdown and harden S3 and chart config (821c113)
• helm: render MAX_UPLOAD_BYTES as an integer, not scientific notation (5136f13)
• s3: abort multipart upload on write error (621c0c0)
• s3: coalesce concurrent credential refreshes into one provider call (a74e202)
• s3: surface backend error bodies and explain missing conditional-write support (9a31f6d)
• server: log and exit non-zero if graceful shutdown fails (a924250)