2.14.1 (2026-09-17)

Bug Fixes

• remote-cache: abort the Azure block upload when the write stream is destroyed (9b7de13)
• remote-cache: abort the S3 multipart upload when the write stream is destroyed (094391a)
• remote-cache: close the connection when an upload fails before the body ends (5cccf24)
• remote-cache: do not abort a completed S3 upload on destroy (429926a)
• remote-cache: fail the write stream when the storage upload fails (411d6bc)
• remote-cache: ignore a negative content-length in the body-limit fast path (0a015d9)
• remote-cache: publish streamed artifacts atomically via a temporary key (784c65d)
• remote-cache: stream artifact uploads to storage instead of buffering full body in memory (c4a422f), closes #679

2.14.0 (2026-09-17)

Bug Fixes

• jwt-auth: ignore empty items in the required scopes and roles (6745c16)
• jwt-auth: read scopes, roles and teams with one claim parser (7fbea56)

Features

• jwt-auth: support check on roles claim and support alternative scope claim name (7af9743), closes #619

2.13.0 (2026-09-17)

Features

• auth/jwt: add JWT_TEAM_CLAIM to limit tokens to their teams (34b925a)

2.12.3 (2026-09-02)

Bug Fixes

• deps: bump fastify from 5.8.5 to 5.12.1 (082d8d1)

2.12.2 (2026-09-01)

Bug Fixes

• address review comment on #889 (71930c5)
• Running in Lambda has inherent 6mb request size limit (#677) (6cc0c1d)

2.12.1 (2026-09-01)

Bug Fixes

• env: use named Ajv export instead of default workaround (c81d403)

2.12.0 (2026-08-04)

Bug Fixes

• remote-cache: address path traversal and validate CDN URL scheme (0963658)
• return correct x-artifact-tag header in HEAD route and restore test assertions (5686f1a)

Features

• support separate read URL to use a CDN (#557) (e6b535f)

2.11.7 (2026-08-03)

Bug Fixes

• storage: propagate Azure download failures instead of hanging the request (57a5502)

2.11.6 (2026-08-03)

Bug Fixes

• routes: drop route-level error log before rethrow to avoid double logging (c06af34)
• storage: address review feedback (preserve tag message, document 403 trade-off) (2a72a91)
• storage: surface backend failures as 5xx instead of masking as cache miss (1b1581e), closes #815

2.11.5 (2026-07-21)

Bug Fixes

• override shell-quote (e03a32b)