GeezerVison

With cooldown on, the proxy filters repodata.json and current_repodata.json, but other forms of the same index went out unfiltered:

• repodata.json.bz2 was served through the metadata cache as is;
• repodata.json.zst, repodata.jlap and the compressed current_repodata and repodata_from_packages files fell through to the download handler, which passes non-package files upstream unchanged;
• repodata_from_packages.json too.

conda tries repodata.json.zst first (repodata_use_zst is on by default), and conda-forge serves it, so a conda client saw versions still in cooldown.

With cooldown on, the compressed and patch forms now answer 404, and conda and mamba fall back to repodata.json, which is filtered. repodata_from_packages.json is plain JSON and is filtered like repodata.json. Without cooldown nothing changes.

TestCondaRepodataVariantsUnderCooldown checks each form with cooldown on (404, no upstream request) and off (passed through), and that repodata_from_packages.json is filtered; it fails on main. I also ran conda search from conda 24.11.3 (condaforge/miniforge3) against conda-forge through the proxy with a 3d cooldown: it asked for repodata.json.zst, got 404, fetched repodata.json and found the package.