Fluxheim 1.5.23

Fluxheim 1.5.23 Release Notes

Fluxheim 1.5.23 starts the cache-aware origin-protection line with a narrow,
operator-controlled origin-fill budget for Fluxheim-owned cache fill paths.

Added

• Added [cache.origin_protection], [vhosts.cache.origin_protection], and
  route-scoped origin_protection.
• Added max_concurrent_fills to bound concurrent protected origin fills per
  vhost or route cache policy. The first protected path is range slice fill.
• When a protected range slice is missing and the origin-fill budget is
  saturated, Fluxheim returns a bounded 503 instead of falling through to the
  normal origin path.
• Added cache status fields and metrics for origin-protection rollout:
  fluxheim_cache_origin_protection_enabled_policies,
  fluxheim_cache_origin_protection_max_concurrent_fills, and the bounded
  cache policy activity event origin_protected.
• Extended fluxheim cache-key and fluxheim cache-lookup previews with
  origin-protection policy state plus
  --expect-origin-protection-enabled and
  --expect-origin-protection-max-concurrent-fills release-gate checks.

Changed

• Consolidated slice-fill, peer-fill, and origin-fill cache concurrency permits
  into one shared limiter implementation so future hardening of the cache-fill
  DoS budget primitive applies uniformly.

Notes

• Origin protection is disabled by default.
• Existing cache locks still coalesce same-key fills. Origin protection is a
  separate vhost/route budget across distinct protected fills.
• This release intentionally does not rewire Pingora's generic proxy cache miss
  lifecycle. Broader miss/revalidation integration belongs to the follow-up
  cache/runtime boundary work.

Checksums And Signatures

• Commit: d67aba9eec119829f4e0cd8f7b4e32cd0796109a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • f63897c91c7e358fab5b366618ab4f12b31bca2746a224ba05bdfcd2c326cd3d fluxheim-1.5.23.tar.gz
  • 0ae48723311f58bbf34337d6c96cfb32b10acb2f75353754759eda8b145431bd fluxheim-1.5.23.zip
• Binary checksums:
  • x86_64:
    • 46667ae5ca978e417424e8993826caf9f6012e8e786b3e66f45f04eaa763d35e fluxheim-1.5.23-full-x86_64-linux.tar.gz
    • 47d6e7f1a6a9d4621c412b283f9570cc41b6d4449852443de40fbb5a8eabf0d6 fluxheim-1.5.23-cache-x86_64-linux.tar.gz
    • 0d1e2426491629346bb47e8b184c941dd7b01a5e4b225cce3b66774373a618b4 fluxheim-1.5.23-proxy-x86_64-linux.tar.gz
    • bd6ab74e902d3d258ca5b6ed9dea8d45d071a4390969c1d01d8b7d893649a052 fluxheim-1.5.23-php-x86_64-linux.tar.gz
    • 0c36707dfacc6ffcf4cee479e83d38c83c430c9fe4acf6d34e7554581415be48 fluxheim-1.5.23-load-balancer-x86_64-linux.tar.gz
    • e596775fca01564d94beeae31511f5903b3e268dc2a50540c6858107ba125ea7 fluxheim-1.5.23-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 4b84bcea1d350ab790d7644965284dba8707130c5164fc99281fefb22d23650d fluxheim-1.5.23-full-aarch64-linux.tar.gz
    • 659038e46d2abcc1ed1d00d0afd0b8088b4c4f51e8957bbf2cf7c19f1d55ae23 fluxheim-1.5.23-cache-aarch64-linux.tar.gz
    • db3b464d9ff00871cd9b4151af943bf97d3f8c435dc983cfa1fc8cd9abc05a1b fluxheim-1.5.23-proxy-aarch64-linux.tar.gz
    • 4bea06ce48647a74083fe339f5580f18fc1d15cc851e45ea234034c248849c16 fluxheim-1.5.23-php-aarch64-linux.tar.gz
    • eff4ef4410533d6a6fc9a2afabe08e25215a5e8cae082fc9398c6ec54384fcf4 fluxheim-1.5.23-load-balancer-aarch64-linux.tar.gz
    • 85aae2076417b9fe926d120e8ac4fb43bcbf07e319f59fa6971b93cf7ec29a9d fluxheim-1.5.23-config-tester-aarch64-linux.tar.gz
  • macos:
    • 606a397cf25fcd931d86afc49ff5e9197424216070182428172e259d4ef62ef4 fluxheim-1.5.23-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 2467cd8122f76a438197fa1fa3593c522e99203cb0f8e533f2ab6dc485e72aed fluxheim.spdx.json
  • 75095881f3a27ce2283d3ab6e72ad9286cdc09976ebb23b7abe248fcff399cae fluxheim.cyclonedx.json
• Reproducible build:
  • e21f5d0bf494f020444788e6277f8ec2937e826ea914bf0b095eff1640b20263 x86_64
  • c81bdb8a238475077eaa60ea858a425c9e394d2c1fc7caaaa39f8f125732f917 aarch64
  • eeb64a9ab57f98b7f2dabc42d814529ac8ca42cd274a690242b22c6f3e520b25 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1a738837e17e33d172408bf07acaabcc1411e884a6232e9901ed27d46dc3b708
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8d84fb0560a365d8978abd065fc053242025ed7dda04a56414d6171d135c2421
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:36ce151bad497a70f0bc244110f502765202c1d6f9908e21605ef3f4778ac7cd
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:9733ba05497a73cf6bb6e6bd34943fc6558125c0633e176c0bcd733194c8615c
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8094d859339953f6e62945f0d5d894b8101fde9398f265dc1d1c7c1f692955ce
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0c46337322fb0776951310a61a0f79dad6274bdbc33586d2326b30f4cc5ab16e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2debd1b750c5b5cf8443a8bfc61cc062caccd8292ba462778622eb18c17fa49c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:d91de7eafc242380af568839473b3e298f8424674a6f4279575f925725c066bc
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8d9dc4b3ba2744388189669087db0b22ca49fd2c0d1f03f6cea19f984f8bba90
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3a2d490f171e6429efa5e19d3cf42aa6af51a7ca16d9ca0797598f0bc4edd300
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:49e9b08ec497d8c5b9da8da569b51460bbb820bb844f537a9b1cfb1aa765c5bb
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:220b656437d0ff7db1fadc35eb0ba734b84b663330c9c0b7c153942f52a64592
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:39ddcf5bfea9ea2b2a5153335f9e32cde826b898a82aedf61fe6745244e8dbc4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1388aabf2da3650d4cb033138723c7240bb662ac528a5910fb8a5a58e2a979da
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8a74abc322d3b6a1574880c69feadd3dfb93b62220b4d6ac657c292a92bcbfb2
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:51cdfba9c74974a80ee0efd5f84b03ba7d3b733f0c5cbaf331a3e7a30974eceb
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0787d6ec282760c633e1e2307b8bf8da7dfb3eae15bd7ea7cf2d64195d278b61
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c30a8a1deb2c77f231a31d4842b43d57fe4be157d7706b091ab224d4091fdb05
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:447b4e3d4ffb369eacf8e97743b341e387be739bac3a28bda100b63ac0d0e18e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:00ad8c7dea87af9dce0565da51e6d36ee4fca5d596f848053df01db784ef10ab
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4