Bugfixes:
- Coalesce concurrent introspection cache misses for the same token and cache segment, including sharing failed and non-cacheable results with waiting requests (#575).
- Preserve explicit cache bypass and fall back to direct introspection when coordination times out or fails. Coalescing is best-effort; duplicate upstream requests remain possible after lease expiry or coordination-state eviction.
Tests:
- Add multi-worker coverage for lease expiry and coordination-state eviction.
- Update JWT fixtures for strict Base64URL validation and algorithm-confusion protections in lua-resty-jwt 0.4.0 without weakening production validation.
- Full suite passes with lua-resty-jwt 0.3.2 and 0.4.0: 597 successes, 0 failures, 0 errors, and 1 existing pending test.
Full changelog: v1.9.1...v1.9.2