release(1.5.0): the custom response modifier and the engine floor guard-core-go v4.4.0

CHANGELOG.md

@@ -3,6 +3,25 @@ Release Notes
 
 ___
 
+v1.5.0 (2026-10-16)
+-------------------
+
+The custom response modifier and the guard-core-go v4.4.0 floor (the reference-alignment engine)
+------------------------------------------------------------------------------------------------
+
+### Fixed
+
+- **The `CustomResponseModifier` is applied** (#41): `Engine.ModifyResponse` is applied in the reference order (security headers, CORS, modifier, then CORS again). With a modifier configured the adapter holds the whole handler response in memory until the handler returns, so streamed responses are delivered at the end; without one nothing changes.
+- **The response wrapper exposes `Flusher`, `Hijacker` and `Unwrap`** (#43): `Unwrap` lets `http.NewResponseController` reach the deadline and full-duplex controls, `Flush` delegates to the real writer so SSE and other streaming handlers reach the client as they write (a no-op while a modifier holds the response), and `Hijack` delegates to the underlying writer and leaves a hijacked connection alone (no response pass, no held release).
+
+### Changed
+
+- **Raised the engine floor to `github.com/rennf93/guard-core-go/v4 v4.4.0`, the reference-alignment release.** The v4.4.0 engine adds the per-request scan time budget (`Detection.MaxScanSeconds`, `pattern_timeout`), honors `Detection.ThreatScoreThreshold`, canonicalizes client identity (IPv4-mapped addresses, brackets, zones), follows the reference IP list precedence, answers an unresolved client address with 403 under `FailSecure`, applies dynamic rule versions over the base config, fixes the filtered-value scan bypass (GHSA-w9j2-2m3v-5hcc) and scans the Cookie header one pair at a time. No adapter code change was needed: the full gate (gofmt, vet, staticcheck, unit and integration tests with Redis, the 100% coverage gate, govulncheck) is green on the new floor.
+- **Behavior to know before upgrading.** The v4.4.0 engine changes what some requests get, and this adapter passes it straight through. A request that reaches the engine with an empty remote address is now answered 403 `Client address could not be determined` under `FailSecure` (the adapter always hands over the connection's remote address, so only a server that leaves it empty is affected). IPv4 blacklist, whitelist, exempt and emergency entries now also match clients that connect as `::ffff:a.b.c.d`, and an IPv4 CIDR no longer trusts a mapped peer as a proxy. A configured whitelist now decides alone (a route whitelist overrides the route blacklist and skips the global lists, a global whitelist overrides the global blacklist), so an entry that relied on the blacklist beating the whitelist must move. A dynamic rule version no longer stacks on the previous one, so a field a version does not set returns to the base value. A request that spends `Detection.MaxScanSeconds` (default 10.0) of regex CPU time is blocked with a `pattern_timeout` threat, and a set `Detection.ThreatScoreThreshold` now changes verdicts. A passive-mode log match on the old penetration wording needs updating.
+- **Docs and CI**: the examples and docs no longer claim the default address headers need a manual `ExcludedDetectionHeaders` entry or that `EnableAgent` fails validation (both verified against the engine), the weekly lint runs on Go 1.26.x, `codeql-action` moves to 4.38.3, the docs links and mkdocs `site_url` point at the live site root, and the README gets the content-parity pass.
+
+___
+
 v1.4.0 (2026-10-09)
 -------------------
 

README.md

@@ -153,7 +153,7 @@ ___
 ## Install
 
 ```
-go get github.com/rennf93/nethttp-guard@v1.4.0 github.com/rennf93/guard-core-go/v4@v4.3.2
+go get github.com/rennf93/nethttp-guard@v1.5.0 github.com/rennf93/guard-core-go/v4@v4.4.0
 ```
 
 ## Usage

go.mod

@@ -2,7 +2,7 @@ module github.com/rennf93/nethttp-guard
 
 go 1.26.0
 
-require github.com/rennf93/guard-core-go/v4 v4.3.2
+require github.com/rennf93/guard-core-go/v4 v4.4.0
 
 require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect

go.sum

@@ -12,8 +12,8 @@ github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5
 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
 github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s=
 github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0=
-github.com/rennf93/guard-core-go/v4 v4.3.2 h1:UpEUaSw1MNIoPcMbikG2hPZr+rhqp8vtCDasNh0m5DQ=
-github.com/rennf93/guard-core-go/v4 v4.3.2/go.mod h1:zbSvFuYHn8Oo6bMwJ7jJ3iR8CEHBIYUvf1ALd1qMAvU=
+github.com/rennf93/guard-core-go/v4 v4.4.0 h1:+la36FG7WWr65gCc0Rq6RyIGC4Aiy+w91tQzH1SCndg=
+github.com/rennf93/guard-core-go/v4 v4.4.0/go.mod h1:6KcajSAwPjYhYxY48nqdrgihH+sXf0NIt6lGMNpKyaU=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=