chore(engine): pin guard-core-jvm to 6cde4af

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ concurrency:
 env:
   # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from
   # source). Bump this and the settings comment together with a facade upgrade.
-  GUARD_CORE_JVM_REF: db716ec0a038fa3dd0a145211bf6a1f18c178d03
+  GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
 
 jobs:
   build:

.github/workflows/code-ql.yml

@@ -11,7 +11,7 @@ permissions: {}
 env:
   # The engine ref ktor-guard pins (mirrors ci.yml; settings.gradle.kts builds the engine
   # from source, so the composite build needs the sibling checkout during analysis).
-  GUARD_CORE_JVM_REF: db716ec0a038fa3dd0a145211bf6a1f18c178d03
+  GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
 
 jobs:
   code-ql:

.github/workflows/release.yml

@@ -26,7 +26,7 @@ permissions: {}
 env:
   # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from
   # source). Bump this and the settings comment together with a facade upgrade.
-  GUARD_CORE_JVM_REF: db716ec0a038fa3dd0a145211bf6a1f18c178d03
+  GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
 
 jobs:
   pre-flight:

CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes to this project are documented in this file. The format foll
 
 ### Changed
 
+- The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central.
 - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55).
 - The pinned guard-core-jvm engine ref moves to 9067b7b, which fixes the agent telemetry wiring (Guard-Core/guard-core-jvm#48): an injected guard-agent-jvm handler was never added to the engine composite, so it was never started and received no events, and metrics travelled as events. A new `InjectedAgentWiringTest` covers the injected handler end to end (start, events, metrics, stop).
 - Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. All twelve netty osv-scanner suppressions are removed.

CONTRIBUTING.md

@@ -23,7 +23,7 @@ pinned ref:
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm
-git -C ../guard-core-jvm checkout db716ec
+git -C ../guard-core-jvm checkout 6cde4af
 ./gradlew build          # detekt + ktfmt check + tests
 ```
 

docs/examples.md

@@ -8,7 +8,7 @@ for blocked requests.
 git clone https://github.com/Guard-Core/ktor-guard.git
 cd ktor-guard
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout db716ec
+git -C guard-core-jvm checkout 6cde4af
 docker run -d -p 6379:6379 redis:7-alpine
 ./gradlew :examples:demo-ktor:run
 ```

docs/installation.md

@@ -24,15 +24,15 @@ packages stay `com.guardcore.*`.
 ## Engine dependency (includeBuild + dependency substitution)
 
 Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and
-local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `db716ec`
+local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af`
 as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
 substitutes the declared coordinates with the included build's projects. The
 declared dependency coordinates stay `com.guard-core:guard-core:4.3.3`
 (lockstep version per the family versioning law).
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout db716ec
+git -C guard-core-jvm checkout 6cde4af
 ./gradlew build
 ```
 

settings.gradle.kts

@@ -25,7 +25,7 @@ pluginManagement {
 // included build until the artifacts publish to Maven Central.
 //
 // Layout: the engine checkout sits as a sibling of this repo. CI checks it out
-// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: db716ec,
+// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: 6cde4af,
 // path: guard-core-jvm); locally clone it with
 //   git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm
 // ---------------------------------------------------------------------------