Prepare 1.5.13 release notes

Author: eldryoth

CHANGELOG.md

@@ -24,6 +24,12 @@ behavior when the change improves security or project direction.
   has a Fluxheim-owned boundary for future crate extraction.
 - Move cache unit coverage that exercises storage behavior onto the Fluxheim
   cache interface while preserving the Pingora adapter for proxy integration.
+- Harden slice-cache multipart range responses by replacing deterministic
+  length-derived MIME boundaries with per-response random boundaries and by
+  stripping CR/LF from cached upstream `Content-Type` values before writing
+  MIME part headers.
+- Fix cache-only test imports so cache feature CI builds do not depend on
+  proxy-gated Flux cache trait names unless the proxy feature is enabled.
 - Keep `privacy-cache` as an explicit future design only. Normal cache remains
   incompatible with `privacy-mode`; a future public-asset cache must enforce no
   client-IP keys, no `Cookie`/`Authorization` admission, no per-user variants,

packaging/rpm/fluxheim.spec

@@ -159,6 +159,8 @@ fi
 - Move cache implementation internals behind FluxCacheStorage and
   FluxHandleHit/FluxHandleMiss while preserving the Pingora HTTP proxy adapter
   and existing cache behavior.
+- Harden slice-cache multipart range responses with random MIME boundaries and
+  CR/LF stripping for cached upstream Content-Type values.
 - Keep privacy-cache as a planned explicit public-asset design only.
 
 * Mon Jun 08 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.5.12-1

release-notes/RELEASE_NOTES_1.5.13.md

@@ -15,6 +15,11 @@ stable while moving cache implementations behind Fluxheim-owned traits.
   use Pingora's session cache machinery without making cache implementations
   depend directly on Pingora's `Storage`, `HandleHit`, or `HandleMiss` traits.
 - Moved storage-focused unit coverage onto the Fluxheim cache interface.
+- Hardened slice-cache multipart range responses by generating a random
+  boundary per response and stripping CR/LF from cached upstream
+  `Content-Type` values before embedding them in MIME part headers.
+- Fixed cache-only test imports so cache feature CI paths do not require the
+  proxy feature just to compile test scaffolding.
 
 ## Compatibility