v0.7.1

0.7.1 (2026-07-27)

Bug Fixes

• copy: authorize a versioned copy-source against its version (#129) (8261ebe)
• copy: resolve CopyObject sources on path-mapped and OIDC deployments (#128) (d2f56e6)

v0.7.0

0.7.0 (2026-07-22)

Features

• enforce conditional-write preconditions on PutObject (#122) (f5ff9a8)
• implement same-store CopyObject (x-amz-copy-source) (#121) (02a79b0)
• sts: accept AssumeRoleWithWebIdentity params from form-encoded POST bodies (#112) (c135b95)
• upgrade object_store to 0.14, reqwest to 0.13, unpin worker (#114) (c5254b4)

v0.6.4

0.6.4 (2026-07-10)

Bug Fixes

• ci: gate smoke tests on a secrets-dependent readiness probe (#107) (7f8823a)
• core: byte-faithful, consistently validated object keys across all backend paths (#108) (094f64c)
• core: percent-encode object keys in raw-signed backend URLs (#105) (c03d7a4)
• deps: upgrade quick-xml to 0.41 for RUSTSEC-2026-0194/0195 (#106) (5beb307)

v0.6.3

0.6.3 (2026-07-01)

Bug Fixes

• bound buffered-op body size and fail closed on classifier over-match (#102) (06ac75b)
• cf-workers: sign the encoded request path; harden the signing-path contract (#103) (43a1781)
• eliminate cross-request body I/O on multipart & batch-delete writes (#100) (60b4278)

v0.6.2

0.6.2 (2026-06-27)

Bug Fixes

• cf-workers: bypass Cloudflare cache for HEAD subrequests (#95) (973bff7)

v0.6.1

0.6.1 (2026-06-26)

Bug Fixes

• proxy: stream-resign aws-chunked uploads instead of decoding (#92) (55d17c0)

v0.6.0

0.6.0 (2026-06-25)

⚠ BREAKING CHANGES

• RoleConfig.required_audience renamed to required_audiences. Code constructing RoleConfig must update the field; serialized configs using required_audience continue to work.

Features

• accept multiple audiences for STS role validation (#90) (1fb09fa)
• data edit operations — batch delete, copy rejection, wider write headers (#88) (55e3a32)

Miscellaneous Chores

• release 0.6.0 (072544d)

v0.5.1

0.5.1 (2026-06-23)

Features

• oidc-provider: name STS session after the connection subject (#83) (9ce4560)

Bug Fixes

• ci: give production its own OIDC issuer so federation works (#85) (6a60c36)
• deps: bump quinn-proto to 0.11.15 (RUSTSEC-2026-0185) (#87) (2e9c54e)

Miscellaneous Chores

• release 0.5.1 (7e797b1)

v0.5.0

0.5.0 (2026-06-20)

Features

• backend-federation: outbound OIDC→backend STS exchange (oidc-provider delegates to it) (#57) (40fb24c)
• cache: shared single-flight credential cache, wired into OIDC backend auth (#61) (ddbc09c)
• oidc-provider: make OidcCredentialProvider cheaply cloneable (shareable warm cache) (#69) (d6f13f1)

Bug Fixes

• oidc-provider: surface federation failures as actionable errors, not opaque 500s (#66) (0422288)
• smoke: default FEDERATION_TEST_KEY when repo var is empty (#63) (2c00a04)

v0.4.0

0.4.0 (2026-05-21)

Features

• auth: rewritten path support (#34) (0d7799a)
• cf-workers: add RequestParts for ergonomic request extraction (da8aca6)
• cf-workers: simplify Cloudflare Workers runtime ergonomics (#47) (b537eec)
• core: add User-Agent header to outbound backend requests (#20) (2a9a5f2)
• oidc: support multiple signing keys (#26) (ead26d8)
• sts: enable custom STS endpoint URL (#32) (ff12fe3)

Performance Improvements

• support cloning JwksCache (#46) (c89dc8b)