Skip to content

CHANGELOG.md

Latest commit

 

History

History
209 lines (118 loc) · 16.5 KB

CHANGELOG.md

File metadata and controls

209 lines (118 loc) · 16.5 KB
Raw

Changelog

0.8.0 (2026-10-01)

⚠ BREAKING CHANGES

  • sts: a role must set required_audiences and subject_conditions (use ["*"] to accept any subject); RoleConfig gains allow_missing_exp_from, which struct-literal constructors must add.

Features

  • sts: fail closed on empty trust fields, check token type, require exp, log successes (#146) (8c86e73)
  • sts: GetCallerIdentity + real configure-aws-credentials integration test (#126) (05f9e60)

Bug Fixes

  • cf-workers: mark forwarded object responses no-transform (#150) (662314b)

0.7.2 (2026-07-28)

Bug Fixes

  • oidc-provider: never block a caller on another's credential renewal (#133) (11a5556)

0.7.1 (2026-07-27)

Bug Fixes

  • copy: authorize a versioned copy-source against its version (#129) (8261ebe)
  • copy: resolve CopyObject sources on path-mapped and OIDC deployments (#128) (d2f56e6)

0.7.0 (2026-07-22)

Features

  • enforce conditional-write preconditions on PutObject (#122) (f5ff9a8)
  • implement same-store CopyObject (x-amz-copy-source) (#121) (02a79b0)
  • sts: accept AssumeRoleWithWebIdentity params from form-encoded POST bodies (#112) (c135b95)
  • upgrade object_store to 0.14, reqwest to 0.13, unpin worker (#114) (c5254b4)

0.6.4 (2026-07-10)

Bug Fixes

  • ci: gate smoke tests on a secrets-dependent readiness probe (#107) (7f8823a)
  • core: byte-faithful, consistently validated object keys across all backend paths (#108) (094f64c)
  • core: percent-encode object keys in raw-signed backend URLs (#105) (c03d7a4)
  • deps: upgrade quick-xml to 0.41 for RUSTSEC-2026-0194/0195 (#106) (5beb307)

0.6.3 (2026-07-01)

Bug Fixes

  • bound buffered-op body size and fail closed on classifier over-match (#102) (06ac75b)
  • cf-workers: sign the encoded request path; harden the signing-path contract (#103) (43a1781)
  • eliminate cross-request body I/O on multipart & batch-delete writes (#100) (60b4278)

0.6.2 (2026-06-27)

Bug Fixes

  • cf-workers: bypass Cloudflare cache for HEAD subrequests (#95) (973bff7)

0.6.1 (2026-06-26)

Bug Fixes

  • proxy: stream-resign aws-chunked uploads instead of decoding (#92) (55d17c0)

0.6.0 (2026-06-25)

⚠ BREAKING CHANGES

  • RoleConfig.required_audience renamed to required_audiences. Code constructing RoleConfig must update the field; serialized configs using required_audience continue to work.

Features

  • accept multiple audiences for STS role validation (#90) (1fb09fa)
  • data edit operations — batch delete, copy rejection, wider write headers (#88) (55e3a32)

Miscellaneous Chores

0.5.1 (2026-06-23)

Features

  • oidc-provider: name STS session after the connection subject (#83) (9ce4560)

Bug Fixes

  • ci: give production its own OIDC issuer so federation works (#85) (6a60c36)
  • deps: bump quinn-proto to 0.11.15 (RUSTSEC-2026-0185) (#87) (2e9c54e)

Miscellaneous Chores

0.5.0 (2026-06-20)

Features

  • backend-federation: outbound OIDC→backend STS exchange (oidc-provider delegates to it) (#57) (40fb24c)
  • cache: shared single-flight credential cache, wired into OIDC backend auth (#61) (ddbc09c)
  • oidc-provider: make OidcCredentialProvider cheaply cloneable (shareable warm cache) (#69) (d6f13f1)

Bug Fixes

  • oidc-provider: surface federation failures as actionable errors, not opaque 500s (#66) (0422288)
  • smoke: default FEDERATION_TEST_KEY when repo var is empty (#63) (2c00a04)

0.4.0 (2026-05-21)

Features

  • auth: rewritten path support (#34) (0d7799a)
  • cf-workers: add RequestParts for ergonomic request extraction (da8aca6)
  • cf-workers: simplify Cloudflare Workers runtime ergonomics (#47) (b537eec)
  • core: add User-Agent header to outbound backend requests (#20) (2a9a5f2)
  • oidc: support multiple signing keys (#26) (ead26d8)
  • sts: enable custom STS endpoint URL (#32) (ff12fe3)

Performance Improvements

0.3.1 (2026-03-31)

Bug Fixes

0.3.0 (2026-03-24)

Features

  • cf-workers: streamline response handling and header conversion (80f8543)
  • core: support ListObjectsV1 (1d61dfc)
  • path-mapping: add more convenience tooling (9c4f5bb)

Bug Fixes

  • cf-workers: disable retry on buckets to avoid WASM panic (804b0bb)
  • core: support custom backend response headers (a5c5b9f)

0.2.0 (2026-03-19)

Features

  • add display_name field to ResolvedBucket (263d324)
  • add metering middleware (20395f7)
  • add metering middleware (73c2d2c)
  • add OidcDiscoveryRouteHandler for .well-known endpoints (d5f01a0)
  • add RouteHandler trait and RequestInfo for pluggable pre-dispatch routing (1db06a8)
  • add StsRouteHandler for AssumeRoleWithWebIdentity interception (c6d6d66)
  • cf-workers: add azure/gcp feature flags for StoreBuilder variants (61aa2f5)
  • core: support percent encoding (8c69f11)
  • create multistore-cf-workers crate with reusable Workers adapters (73c79b5)
  • create multistore-path-mapping crate for hierarchical path routing (19d6626)
  • get-object (#4) (9f3d8e8)
  • support pagination on bucket list (017f22d)
  • support range requests (4053c5f)
  • workers: add rate-limiting (47a5973)

Bug Fixes

  • add default allowed roles (35dd823)
  • apply ListRewrite.add_prefix to Prefix element and fix double-slash in rewrite_key (3ba9890)
  • ci: add --cwd to wrangler commands and fix step reference (a250cf2)
  • ci: let wrangler output stream directly (f98780e)
  • ci: pass CLOUDFLARE_ACCOUNT_ID as secret to reusable workflow (c2ff2a7)
  • correct endpoint (0d9fd27)
  • correct STS endpoint (3f6b2be)
  • ensure cloudflare streams data properly (19053b2)
  • handle Azure and GCS URLs in UnsignedUrlSigner (3af3845)
  • match S3 ListObjectsV2 delimiter behavior (ad0acfb)
  • pin worker version (2752efb)
  • rate-limit: ensure middleware runs before bucket resolution (b15cd64)
  • support range HEAD requests (758c44c)
  • workers: support multipart downloads (7e4c313)
  • workers: us sqlite durable object storage (65b7101)

Performance Improvements

  • use Cow<BucketConfig> in OidcBackendAuth to avoid per-request clones (4dff450)