From 12dc845ccd53ddf77837c4d34b60085417bbb54a Mon Sep 17 00:00:00 2001 From: Renn F Date: Fri, 16 Oct 2026 03:08:52 +0200 Subject: [PATCH] release(1.1.0): build against guard-core 4.4.0 Version 1.1.0, guardCore 4.4.0 (now on Maven Central), and the pinned engine ref moves from 6cde4af to 7711606, the v4.4.0 release commit, in CI, CodeQL, release, settings and docs. The Unreleased changelog section becomes 1.1.0. --- .github/workflows/ci.yml | 2 +- .github/workflows/code-ql.yml | 2 +- .github/workflows/release.yml | 4 ++-- CHANGELOG.md | 3 ++- CONTRIBUTING.md | 2 +- README.md | 4 ++-- build.gradle.kts | 2 +- docs/examples.md | 2 +- docs/installation.md | 6 +++--- gradle/libs.versions.toml | 2 +- settings.gradle.kts | 2 +- 11 files changed, 16 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a5fc558..4f342ab 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ concurrency: env: # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from # source). Bump this and the settings comment together with a facade upgrade. - GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e + GUARD_CORE_JVM_REF: 77116062fc7d88dcb610b1f588e2bc78e63848ad jobs: build: diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 8aa81e1..b94d455 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -11,7 +11,7 @@ permissions: {} env: # The engine ref ktor-guard pins (mirrors ci.yml; settings.gradle.kts builds the engine # from source, so the composite build needs the sibling checkout during analysis). - GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e + GUARD_CORE_JVM_REF: 77116062fc7d88dcb610b1f588e2bc78e63848ad jobs: code-ql: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 60cc1d1..7a2ea7b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,9 +24,9 @@ on: permissions: {} env: - # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from + # The engine ref ktor-guard pins (lockstep 4.4.0; settings.gradle.kts builds it from # source). Bump this and the settings comment together with a facade upgrade. - GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e + GUARD_CORE_JVM_REF: 77116062fc7d88dcb610b1f588e2bc78e63848ad jobs: pre-flight: diff --git a/CHANGELOG.md b/CHANGELOG.md index 3fb9f9b..c327589 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,10 +3,11 @@ All notable changes to this project are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). -## Unreleased +## [1.1.0] - 2026-10-16 ### Changed +- Builds against guard-core-jvm 4.4.0 (`guardCore = "4.4.0"`, now on Maven Central), and the pinned guard-core-jvm engine ref moves to 7711606, the v4.4.0 release commit. - The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central. - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55). - The pinned guard-core-jvm engine ref moves to 9067b7b, which fixes the agent telemetry wiring (Guard-Core/guard-core-jvm#48): an injected guard-agent-jvm handler was never added to the engine composite, so it was never started and received no events, and metrics travelled as events. A new `InjectedAgentWiringTest` covers the injected handler end to end (start, events, metrics, stop). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 14cf50c..3e2f052 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -23,7 +23,7 @@ pinned ref: ```bash git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm -git -C ../guard-core-jvm checkout 6cde4af +git -C ../guard-core-jvm checkout 7711606 ./gradlew build # detekt + ktfmt check + tests ``` diff --git a/README.md b/README.md index bd862ad..ed29312 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ ___ ## Status -`1.0.0`, released on Maven Central as `com.guard-core:ktor-guard:1.0.0`. ktor-guard is a true port of +`1.1.0`, released on Maven Central as `com.guard-core:ktor-guard:1.1.0`. ktor-guard is a true port of the guard adapter pattern (fastapi-guard's `SecurityMiddleware`, JVM-idiomized for Ktor 3.x): it wraps Ktor `ApplicationCall` into the guard-core-jvm facade protocols and drives the engine's security pipeline per request through suspend-native Ktor server plugin hooks. It contains no @@ -46,7 +46,7 @@ Published on Maven Central: ```kotlin dependencies { - implementation("com.guard-core:ktor-guard:1.0.0") + implementation("com.guard-core:ktor-guard:1.1.0") } ``` diff --git a/build.gradle.kts b/build.gradle.kts index 6556cef..37d13fe 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -15,7 +15,7 @@ plugins { // standard practice for hyphenated domains. group = "com.guard-core" -version = "1.0.0" +version = "1.1.0" // Section 14.3 lockfile analog: every configuration resolves against the // committed gradle.lockfile. A dependency change without diff --git a/docs/examples.md b/docs/examples.md index 0ce13a2..f4db06f 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -8,7 +8,7 @@ for blocked requests. git clone https://github.com/Guard-Core/ktor-guard.git cd ktor-guard git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 6cde4af +git -C guard-core-jvm checkout 7711606 docker run -d -p 6379:6379 redis:7-alpine ./gradlew :examples:demo-ktor:run ``` diff --git a/docs/installation.md b/docs/installation.md index 60daae2..0ff2e98 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -14,7 +14,7 @@ Published on Maven Central: ```kotlin dependencies { - implementation("com.guard-core:ktor-guard:1.0.0") + implementation("com.guard-core:ktor-guard:1.1.0") } ``` @@ -24,7 +24,7 @@ packages stay `com.guardcore.*`. ## Engine dependency (includeBuild + dependency substitution) Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and -local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af` +local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `7711606` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates with the included build's projects. The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` @@ -32,7 +32,7 @@ declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 6cde4af +git -C guard-core-jvm checkout 7711606 ./gradlew build ``` diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index e039120..ff4c0ff 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -2,7 +2,7 @@ kotlin = "2.4.21" coroutines = "1.11.0" ktor = "3.6.0" -guardCore = "4.3.3" +guardCore = "4.4.0" netty = "4.1.139.Final" spotless = "8.10.4" detekt = "1.23.8" diff --git a/settings.gradle.kts b/settings.gradle.kts index 44840cd..a1d7daf 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -25,7 +25,7 @@ pluginManagement { // included build until the artifacts publish to Maven Central. // // Layout: the engine checkout sits as a sibling of this repo. CI checks it out -// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: 6cde4af, +// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: 7711606, // path: guard-core-jvm); locally clone it with // git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm // ---------------------------------------------------------------------------