GET /vscode/gallery/rust-lang/rust-analyzer/latest takes > 10s since it contains 1137 active versions. While I belive there are likely some efficiencies to be made in that logic, the response set contains:

< cache-control: no-cache, no-store, max-age=0, must-revalidate
< pragma: no-cache

with no cookies present in the response.

This is a vector for DoS. If it were cacheable we could at least save cycles have some DoS protection through a reverse proxy. A diff of 2 sequential requests shows no difference.

Please consider setting sane cache headers for expensive, unauthenticated content - especially the more expensive calls.