diff --git a/CHANGELOG.md b/CHANGELOG.md index acb2625..0b71153 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,25 @@ Release Notes ___ +v1.5.0 (2026-10-16) +------------------- + +The custom response modifier and the guard-core-go v4.4.0 floor (the reference-alignment engine) +------------------------------------------------------------------------------------------------ + +### Fixed + +- **The `CustomResponseModifier` is applied** (#41): `Engine.ModifyResponse` is applied in the reference order (security headers, CORS, modifier, then CORS again). With a modifier configured the adapter holds the whole handler response in memory until the handler returns, so streamed responses are delivered at the end; without one nothing changes. +- **The response wrapper exposes `Flusher`, `Hijacker` and `Unwrap`** (#43): `Unwrap` lets `http.NewResponseController` reach the deadline and full-duplex controls, `Flush` delegates to the real writer so SSE and other streaming handlers reach the client as they write (a no-op while a modifier holds the response), and `Hijack` delegates to the underlying writer and leaves a hijacked connection alone (no response pass, no held release). + +### Changed + +- **Raised the engine floor to `github.com/rennf93/guard-core-go/v4 v4.4.0`, the reference-alignment release.** The v4.4.0 engine adds the per-request scan time budget (`Detection.MaxScanSeconds`, `pattern_timeout`), honors `Detection.ThreatScoreThreshold`, canonicalizes client identity (IPv4-mapped addresses, brackets, zones), follows the reference IP list precedence, answers an unresolved client address with 403 under `FailSecure`, applies dynamic rule versions over the base config, fixes the filtered-value scan bypass (GHSA-w9j2-2m3v-5hcc) and scans the Cookie header one pair at a time. No adapter code change was needed: the full gate (gofmt, vet, staticcheck, unit and integration tests with Redis, the 100% coverage gate, govulncheck) is green on the new floor. +- **Behavior to know before upgrading.** The v4.4.0 engine changes what some requests get, and this adapter passes it straight through. A request that reaches the engine with an empty remote address is now answered 403 `Client address could not be determined` under `FailSecure` (the adapter always hands over the connection's remote address, so only a server that leaves it empty is affected). IPv4 blacklist, whitelist, exempt and emergency entries now also match clients that connect as `::ffff:a.b.c.d`, and an IPv4 CIDR no longer trusts a mapped peer as a proxy. A configured whitelist now decides alone (a route whitelist overrides the route blacklist and skips the global lists, a global whitelist overrides the global blacklist), so an entry that relied on the blacklist beating the whitelist must move. A dynamic rule version no longer stacks on the previous one, so a field a version does not set returns to the base value. A request that spends `Detection.MaxScanSeconds` (default 10.0) of regex CPU time is blocked with a `pattern_timeout` threat, and a set `Detection.ThreatScoreThreshold` now changes verdicts. A passive-mode log match on the old penetration wording needs updating. +- **Docs and CI**: the examples and docs no longer claim the default address headers need a manual `ExcludedDetectionHeaders` entry or that `EnableAgent` fails validation (both verified against the engine), the weekly lint runs on Go 1.26.x, `codeql-action` moves to 4.38.3, the docs links and mkdocs `site_url` point at the live site root, and the README gets the content-parity pass. + +___ + v1.4.0 (2026-10-09) ------------------- diff --git a/README.md b/README.md index dc0ee45..d8c6ec1 100644 --- a/README.md +++ b/README.md @@ -153,7 +153,7 @@ ___ ## Install ``` -go get github.com/rennf93/nethttp-guard@v1.4.0 github.com/rennf93/guard-core-go/v4@v4.3.2 +go get github.com/rennf93/nethttp-guard@v1.5.0 github.com/rennf93/guard-core-go/v4@v4.4.0 ``` ## Usage diff --git a/go.mod b/go.mod index 85ec145..9cbe443 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/rennf93/nethttp-guard go 1.26.0 -require github.com/rennf93/guard-core-go/v4 v4.3.2 +require github.com/rennf93/guard-core-go/v4 v4.4.0 require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect diff --git a/go.sum b/go.sum index 57fba40..dbf35db 100644 --- a/go.sum +++ b/go.sum @@ -12,8 +12,8 @@ github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8= github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s= github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0= -github.com/rennf93/guard-core-go/v4 v4.3.2 h1:UpEUaSw1MNIoPcMbikG2hPZr+rhqp8vtCDasNh0m5DQ= -github.com/rennf93/guard-core-go/v4 v4.3.2/go.mod h1:zbSvFuYHn8Oo6bMwJ7jJ3iR8CEHBIYUvf1ALd1qMAvU= +github.com/rennf93/guard-core-go/v4 v4.4.0 h1:+la36FG7WWr65gCc0Rq6RyIGC4Aiy+w91tQzH1SCndg= +github.com/rennf93/guard-core-go/v4 v4.4.0/go.mod h1:6KcajSAwPjYhYxY48nqdrgihH+sXf0NIt6lGMNpKyaU= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=