chore(engine): pin guard-core-jvm to db716ec

.github/workflows/ci.yml

@@ -25,15 +25,15 @@ jobs:
         with:
           persist-credentials: false
 
-      # The engine dependency: guard-core-jvm pinned at 09dfddf (full SHA for the
+      # The engine dependency: guard-core-jvm pinned at db716ec (full SHA for the
       # actions/checkout fetch), checked
       # out as the sibling directory ./guard-core-jvm and substituted for the
       # declared com.guardcore:guard-core coordinates by settings.gradle.kts.
-      - name: Checkout engine (guard-core-jvm @ 09dfddf)
+      - name: Checkout engine (guard-core-jvm @ db716ec)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 09dfddf77d1b25e7d79a03f8a37fe781ed30f236
+          ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03
           path: guard-core-jvm
           persist-credentials: false
 

.github/workflows/code-ql.yml

@@ -23,11 +23,11 @@ jobs:
 
       # The engine dependency: the composite includeBuild needs the pinned
       # guard-core-jvm checkout next to the repository (same as ci.yml).
-      - name: Checkout engine (guard-core-jvm @ 09dfddf)
+      - name: Checkout engine (guard-core-jvm @ db716ec)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 09dfddf77d1b25e7d79a03f8a37fe781ed30f236
+          ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03
           path: guard-core-jvm
           persist-credentials: false
 

.github/workflows/release.yml

@@ -72,11 +72,11 @@ jobs:
           persist-credentials: false
 
       # Same engine checkout as ci.yml (the composite default for tests).
-      - name: Checkout engine (guard-core-jvm @ 09dfddf)
+      - name: Checkout engine (guard-core-jvm @ db716ec)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Guard-Core/guard-core-jvm
-          ref: 09dfddf77d1b25e7d79a03f8a37fe781ed30f236
+          ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03
           path: guard-core-jvm
           persist-credentials: false
 

CHANGELOG.md

@@ -8,6 +8,7 @@
 
 ### Changed
 
+- The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55).
 - Telemetry agent support: an `AgentHandlerProtocol` bean (for example guard-agent-jvm's `GuardAgentTelemetry`) is now injected into `GuardMiddleware` by the auto-configuration, adopted into the engine composite on initialization, and stopped through the new `GuardMiddleware.shutdown()` when the context closes. Before this, `guard.enable-agent=true` always degraded with a "W7 artifact" message, because the middleware had no way to receive a handler. The degrade path now only applies when no handler bean is registered. The pinned guard-core-jvm engine ref moves to 9067b7b, whose agent telemetry wiring fix (Guard-Core/guard-core-jvm#48) the handler needs to receive anything.
 - `GuardMiddleware.shutdown()` now also closes the middleware's own redis handler, and stops the injected agent handler directly when initialization never ran (a lazily initialized app that saw no traffic), so an agent created with `cfg.redis` no longer leaks its persistence connection and daemon thread. It runs under the initialization mutex and is safe to call twice. The README documents that exactly one `AgentHandlerProtocol` bean is supported and adds the guard-agent-jvm dependency line.
 - Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. The four netty osv-scanner suppressions are removed; the Spring Boot test-scope suppressions stay.

CONTRIBUTING.md

@@ -22,7 +22,7 @@ side in the same directory) at the pinned ref:
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm
-git -C ../guard-core-jvm checkout 09dfddf
+git -C ../guard-core-jvm checkout db716ec
 ./gradlew build          # detekt + ktfmt check + tests (redis-backed tests skip when redis is down)
 ```
 

README.md

@@ -132,7 +132,7 @@ logs the same "eager init not honored" warning as fastapi-guard.
 
 The engine artifact `com.guard-core:guard-core` (groupId is the Central Portal namespace; Kotlin
 packages stay `com.guardcore.*`) is on Maven Central for consumers. This repository's own build pins the engine from source instead: CI and local builds check out `Guard-Core/guard-core-jvm` at the
-pinned ref `09dfddf` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
+pinned ref `db716ec` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
 substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` /
 `com.guard-core:guard-core-engine:4.3.3` with the included build's projects (the Gradle analog of
 the Rust path+version pattern). The declared dependency coordinates stay
@@ -152,7 +152,7 @@ Local checkout:
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 09dfddf
+git -C guard-core-jvm checkout db716ec
 ./gradlew build
 ```
 

docs/examples.md

@@ -7,7 +7,7 @@ routes, live Redis-backed rate limiting, and per-route decorator configs.
 git clone https://github.com/Guard-Core/spring-boot-guard.git
 cd spring-boot-guard
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 09dfddf
+git -C guard-core-jvm checkout db716ec
 docker run -d -p 6379:6379 redis:7-alpine
 ./gradlew :examples:demo-boot:bootRun
 ```

docs/installation.md

@@ -23,7 +23,7 @@ packages stay `com.guardcore.*`.
 ## Engine dependency (includeBuild + dependency substitution)
 
 Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and
-local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `09dfddf`
+local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `db716ec`
 as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts`
 substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` /
 `com.guard-core:guard-core-engine:4.3.3` with the included build's projects.
@@ -32,7 +32,7 @@ The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3`
 
 ```bash
 git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-git -C guard-core-jvm checkout 09dfddf
+git -C guard-core-jvm checkout db716ec
 ./gradlew build
 ```
 

examples/demo-boot/README.md

@@ -21,12 +21,12 @@ engine's `SecurityConfig` field names).
 
 Prerequisites:
 
-1. Clone Guard-Core/guard-core-jvm at the pinned ref `09dfddf` next to this repository
+1. Clone Guard-Core/guard-core-jvm at the pinned ref `db716ec` next to this repository
    (the engine builds from source via includeBuild until the artifacts publish):
 
    ```bash
    git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm
-   git -C guard-core-jvm checkout 09dfddf
+   git -C guard-core-jvm checkout db716ec
    ```
 
 2. A Redis on `localhost:6379` (rate limiting), or set `guard.enable-redis: false` in

examples/demo-boot/settings.gradle.kts

@@ -15,7 +15,7 @@ rootProject.name = "demo-boot"
 
 // The adapter and the engine are consumed from source until both publish:
 // the adapter repo sits two levels up and the engine at the pinned ref
-// 09dfddf sits next to it (the same includeBuild convention as the adapter).
+// db716ec sits next to it (the same includeBuild convention as the adapter).
 includeBuild("../../") {
   dependencySubstitution {
     substitute(module("com.guardcore:spring-boot-guard")).using(project(":"))
@@ -35,7 +35,7 @@ val engineDir: File = run {
       )
   roots.firstOrNull { it.resolve("settings.gradle.kts").isFile }
       ?: throw GradleException(
-          "Clone Guard-Core/guard-core-jvm at the pinned ref 09dfddf next to the " +
+          "Clone Guard-Core/guard-core-jvm at the pinned ref db716ec next to the " +
               "spring-boot-guard repository first (or point -PguardCoreJvmDir / " +
               "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " +
               roots.joinToString(", ") { it.path },

settings.gradle.kts

@@ -13,7 +13,7 @@ pluginManagement {
 // GUARD_CORE_USE_COMPOSITE (environment variable):
 //   unset / "1" / "true"  -> composite ON (default). The engine is built from
 //     source via includeBuild + dependency substitution: CI (and local builds)
-//     check out Guard-Core/guard-core-jvm at the PINNED REF 09dfddf as the
+//     check out Guard-Core/guard-core-jvm at the PINNED REF db716ec as the
 //     sibling directory ./guard-core-jvm, and the block below substitutes the
 //     declared coordinates com.guard-core:guard-core /
 //     com.guard-core:guard-core-engine with the included build's projects.
@@ -63,7 +63,7 @@ if (useComposite) {
     roots.firstOrNull { it.resolve("settings.gradle.kts").isFile }
         ?: throw GradleException(
             "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " +
-                "at the pinned ref 09dfddf next to this repository (or point -PguardCoreJvmDir / " +
+                "at the pinned ref db716ec next to this repository (or point -PguardCoreJvmDir / " +
                 "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " +
                 roots.joinToString(", ") { it.path },
         )