rennf93 · Oct 16, 2026 · Oct 16, 2026
@@ -15,7 +15,7 @@ concurrency:
 env:
   # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from
   # source). Bump this and the settings comment together with a facade upgrade.
-  GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
+  GUARD_CORE_JVM_REF: 77116062fc7d88dcb610b1f588e2bc78e63848ad
 
 jobs:
   build:

@@ -11,7 +11,7 @@ permissions: {}
 env:
   # The engine ref ktor-guard pins (mirrors ci.yml; settings.gradle.kts builds the engine
   # from source, so the composite build needs the sibling checkout during analysis).
-  GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
+  GUARD_CORE_JVM_REF: 77116062fc7d88dcb610b1f588e2bc78e63848ad
 
 jobs:
   code-ql:

@@ -24,9 +24,9 @@ on:
 permissions: {}
 
 env:
-  # The engine ref ktor-guard pins (lockstep 4.3.3; settings.gradle.kts builds it from
+  # The engine ref ktor-guard pins (lockstep 4.4.0; settings.gradle.kts builds it from
   # source). Bump this and the settings comment together with a facade upgrade.
-  GUARD_CORE_JVM_REF: 6cde4afd08a0172c5f6a41eb8e29ec754288782e
+  GUARD_CORE_JVM_REF: 77116062fc7d88dcb610b1f588e2bc78e63848ad
 
 jobs:
   pre-flight:

@@ -3,10 +3,11 @@
 All notable changes to this project are documented in this file. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## Unreleased
+## [1.1.0] - 2026-10-16
 
 ### Changed
 
+- Builds against guard-core-jvm 4.4.0 (`guardCore = "4.4.0"`, now on Maven Central), and the pinned guard-core-jvm engine ref moves to 7711606, the v4.4.0 release commit.
 - The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central.
 - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55).
 - The pinned guard-core-jvm engine ref moves to 9067b7b, which fixes the agent telemetry wiring (Guard-Core/guard-core-jvm#48): an injected guard-agent-jvm handler was never added to the engine composite, so it was never started and received no events, and metrics travelled as events. A new `InjectedAgentWiringTest` covers the injected handler end to end (start, events, metrics, stop).

@@ -23,7 +23,7 @@ pinned ref:
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm
-git -C ../guard-core-jvm checkout 6cde4af
+git -C ../guard-core-jvm checkout 7711606
 ./gradlew build          # detekt + ktfmt check + tests
 ```
 

@@ -26,7 +26,7 @@ ___
 
 ## Status
 
-`1.0.0`, released on Maven Central as `com.guard-core:ktor-guard:1.0.0`. ktor-guard is a true port of
+`1.1.0`, released on Maven Central as `com.guard-core:ktor-guard:1.1.0`. ktor-guard is a true port of
 the guard adapter pattern (fastapi-guard's `SecurityMiddleware`, JVM-idiomized for Ktor 3.x):
 it wraps Ktor `ApplicationCall` into the guard-core-jvm facade protocols and drives the engine's
 security pipeline per request through suspend-native Ktor server plugin hooks. It contains no
@@ -46,7 +46,7 @@ Published on Maven Central:
 
 ```kotlin
 dependencies {
-    implementation("com.guard-core:ktor-guard:1.0.0")
+    implementation("com.guard-core:ktor-guard:1.1.0")
 }
 ```
 

@@ -15,7 +15,7 @@ plugins {
 // standard practice for hyphenated domains.
 group = "com.guard-core"
 
-version = "1.0.0"
+version = "1.1.0"
 
 // Section 14.3 lockfile analog: every configuration resolves against the
 // committed gradle.lockfile. A dependency change without

@@ -8,7 +8,7 @@ for blocked requests.
 git clone https://github.com/Guard-Core/ktor-guard.git
 cd ktor-guard
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 6cde4af
+git -C guard-core-jvm checkout 7711606
 docker run -d -p 6379:6379 redis:7-alpine
 ./gradlew :examples:demo-ktor:run
 ```

@@ -14,7 +14,7 @@ Published on Maven Central:
 
 ```kotlin
 dependencies {
-    implementation("com.guard-core:ktor-guard:1.0.0")
+    implementation("com.guard-core:ktor-guard:1.1.0")
 }
 ```
 
@@ -24,15 +24,15 @@ packages stay `com.guardcore.*`.
 ## Engine dependency (includeBuild + dependency substitution)
 
 Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and
-local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af`
+local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `7711606`
 as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
 substitutes the declared coordinates with the included build's projects. The
 declared dependency coordinates stay `com.guard-core:guard-core:4.3.3`
 (lockstep version per the family versioning law).
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 6cde4af
+git -C guard-core-jvm checkout 7711606
 ./gradlew build
 ```
 

@@ -2,7 +2,7 @@
 kotlin = "2.4.21"
 coroutines = "1.11.0"
 ktor = "3.6.0"
-guardCore = "4.3.3"
+guardCore = "4.4.0"
 netty = "4.1.139.Final"
 spotless = "8.10.4"
 detekt = "1.23.8"

@@ -25,7 +25,7 @@ pluginManagement {
 // included build until the artifacts publish to Maven Central.
 //
 // Layout: the engine checkout sits as a sibling of this repo. CI checks it out
-// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: 6cde4af,
+// with actions/checkout (repository: Guard-Core/guard-core-jvm, ref: 7711606,
 // path: guard-core-jvm); locally clone it with
 //   git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm
 // ---------------------------------------------------------------------------