• [FEATURE] Add the -query-param-only flag to extract the tenant label from the URL query string only and reject non-empty POST form values for that parameter. Use with authorization proxies that SAR URL query values only (e.g. kube-rbac-proxy byQueryParameter). Effective only when -query-param is used; otherwise ignored.
• [ENHANCEMENT] Enforce match[] parameters in URL query and POST body independently. #438
• [ENHANCEMENT] Wrap errors for Alertmanager API endpoints as JSON strings (similar to the upstream Alertmanager API format). #436