From 53c829270c9f58095e1ba95dc848ecdd45669b87 Mon Sep 17 00:00:00 2001 From: Renn F Date: Fri, 16 Oct 2026 03:08:59 +0200 Subject: [PATCH] release(1.1.0): build against guard-core 4.4.0 Version 1.1.0, guardCore 4.4.0 (now on Maven Central), and the pinned engine ref moves from 6cde4af to 7711606, the v4.4.0 release commit, in CI, CodeQL, release, settings and docs. The Unreleased changelog section becomes 1.1.0. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/code-ql.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- CHANGELOG.md | 3 ++- CONTRIBUTING.md | 2 +- README.md | 6 +++--- build.gradle.kts | 2 +- docs/examples.md | 2 +- docs/installation.md | 6 +++--- examples/demo-boot/README.md | 4 ++-- examples/demo-boot/settings.gradle.kts | 4 ++-- gradle/libs.versions.toml | 2 +- settings.gradle.kts | 4 ++-- 13 files changed, 25 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a1481e0..f05a10a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,15 +25,15 @@ jobs: with: persist-credentials: false - # The engine dependency: guard-core-jvm pinned at 6cde4af (full SHA for the + # The engine dependency: guard-core-jvm pinned at 7711606 (full SHA for the # actions/checkout fetch), checked # out as the sibling directory ./guard-core-jvm and substituted for the # declared com.guardcore:guard-core coordinates by settings.gradle.kts. - - name: Checkout engine (guard-core-jvm @ 6cde4af) + - name: Checkout engine (guard-core-jvm @ 7711606) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e + ref: 77116062fc7d88dcb610b1f588e2bc78e63848ad path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index c4b1bf4..fed491b 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -23,11 +23,11 @@ jobs: # The engine dependency: the composite includeBuild needs the pinned # guard-core-jvm checkout next to the repository (same as ci.yml). - - name: Checkout engine (guard-core-jvm @ 6cde4af) + - name: Checkout engine (guard-core-jvm @ 7711606) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e + ref: 77116062fc7d88dcb610b1f588e2bc78e63848ad path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e1b0c03..de5af22 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -72,11 +72,11 @@ jobs: persist-credentials: false # Same engine checkout as ci.yml (the composite default for tests). - - name: Checkout engine (guard-core-jvm @ 6cde4af) + - name: Checkout engine (guard-core-jvm @ 7711606) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e + ref: 77116062fc7d88dcb610b1f588e2bc78e63848ad path: guard-core-jvm persist-credentials: false diff --git a/CHANGELOG.md b/CHANGELOG.md index e73cfa4..35e7283 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## Unreleased +## [1.1.0] - 2026-10-16 ### Added @@ -8,6 +8,7 @@ ### Changed +- Builds against guard-core-jvm 4.4.0 (`guardCore = "4.4.0"`, now on Maven Central), and the pinned guard-core-jvm engine ref moves to 7711606, the v4.4.0 release commit. - The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central. - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55). - Telemetry agent support: an `AgentHandlerProtocol` bean (for example guard-agent-jvm's `GuardAgentTelemetry`) is now injected into `GuardMiddleware` by the auto-configuration, adopted into the engine composite on initialization, and stopped through the new `GuardMiddleware.shutdown()` when the context closes. Before this, `guard.enable-agent=true` always degraded with a "W7 artifact" message, because the middleware had no way to receive a handler. The degrade path now only applies when no handler bean is registered. The pinned guard-core-jvm engine ref moves to 9067b7b, whose agent telemetry wiring fix (Guard-Core/guard-core-jvm#48) the handler needs to receive anything. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 53f18d2..8fc8420 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -22,7 +22,7 @@ side in the same directory) at the pinned ref: ```bash git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm -git -C ../guard-core-jvm checkout 6cde4af +git -C ../guard-core-jvm checkout 7711606 ./gradlew build # detekt + ktfmt check + tests (redis-backed tests skip when redis is down) ``` diff --git a/README.md b/README.md index 26c1f07..b4f8c0e 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ Published on Maven Central: ```kotlin dependencies { - implementation("com.guard-core:spring-boot-guard:1.0.0") + implementation("com.guard-core:spring-boot-guard:1.1.0") } ``` @@ -132,7 +132,7 @@ logs the same "eager init not honored" warning as fastapi-guard. The engine artifact `com.guard-core:guard-core` (groupId is the Central Portal namespace; Kotlin packages stay `com.guardcore.*`) is on Maven Central for consumers. This repository's own build pins the engine from source instead: CI and local builds check out `Guard-Core/guard-core-jvm` at the -pinned ref `6cde4af` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` +pinned ref `7711606` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` / `com.guard-core:guard-core-engine:4.3.3` with the included build's projects (the Gradle analog of the Rust path+version pattern). The declared dependency coordinates stay @@ -152,7 +152,7 @@ Local checkout: ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 6cde4af +git -C guard-core-jvm checkout 7711606 ./gradlew build ``` diff --git a/build.gradle.kts b/build.gradle.kts index 6739ac8..50a3bcf 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -15,7 +15,7 @@ plugins { // standard practice for hyphenated domains. group = "com.guard-core" -version = "1.0.0" +version = "1.1.0" // Section 14.3 lockfile analog: every configuration resolves against the // committed gradle.lockfile. A dependency change without diff --git a/docs/examples.md b/docs/examples.md index fd22279..bd2c36c 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -7,7 +7,7 @@ routes, live Redis-backed rate limiting, and per-route decorator configs. git clone https://github.com/Guard-Core/spring-boot-guard.git cd spring-boot-guard git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 6cde4af +git -C guard-core-jvm checkout 7711606 docker run -d -p 6379:6379 redis:7-alpine ./gradlew :examples:demo-boot:bootRun ``` diff --git a/docs/installation.md b/docs/installation.md index 479cfcb..e2967e1 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -13,7 +13,7 @@ Published on Maven Central: ```kotlin dependencies { - implementation("com.guard-core:spring-boot-guard:1.0.0") + implementation("com.guard-core:spring-boot-guard:1.1.0") } ``` @@ -23,7 +23,7 @@ packages stay `com.guardcore.*`. ## Engine dependency (includeBuild + dependency substitution) Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and -local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af` +local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `7711606` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` / `com.guard-core:guard-core-engine:4.3.3` with the included build's projects. @@ -32,7 +32,7 @@ The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 6cde4af +git -C guard-core-jvm checkout 7711606 ./gradlew build ``` diff --git a/examples/demo-boot/README.md b/examples/demo-boot/README.md index 2b5107a..a0335bd 100644 --- a/examples/demo-boot/README.md +++ b/examples/demo-boot/README.md @@ -21,12 +21,12 @@ engine's `SecurityConfig` field names). Prerequisites: -1. Clone Guard-Core/guard-core-jvm at the pinned ref `6cde4af` next to this repository +1. Clone Guard-Core/guard-core-jvm at the pinned ref `7711606` next to this repository (the engine builds from source via includeBuild until the artifacts publish): ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm - git -C guard-core-jvm checkout 6cde4af + git -C guard-core-jvm checkout 7711606 ``` 2. A Redis on `localhost:6379` (rate limiting), or set `guard.enable-redis: false` in diff --git a/examples/demo-boot/settings.gradle.kts b/examples/demo-boot/settings.gradle.kts index 22d73d3..7c53a80 100644 --- a/examples/demo-boot/settings.gradle.kts +++ b/examples/demo-boot/settings.gradle.kts @@ -15,7 +15,7 @@ rootProject.name = "demo-boot" // The adapter and the engine are consumed from source until both publish: // the adapter repo sits two levels up and the engine at the pinned ref -// 6cde4af sits next to it (the same includeBuild convention as the adapter). +// 7711606 sits next to it (the same includeBuild convention as the adapter). includeBuild("../../") { dependencySubstitution { substitute(module("com.guardcore:spring-boot-guard")).using(project(":")) @@ -35,7 +35,7 @@ val engineDir: File = run { ) roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( - "Clone Guard-Core/guard-core-jvm at the pinned ref 6cde4af next to the " + + "Clone Guard-Core/guard-core-jvm at the pinned ref 7711606 next to the " + "spring-boot-guard repository first (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 39a30a6..d0a717e 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -6,7 +6,7 @@ spotless = "8.10.4" detekt = "1.23.8" # Engine facade coordinates (groupId com.guard-core, the Central Portal namespace): substituted with the pinned includeBuild checkout # (see settings.gradle.kts) until the artifact publishes to Maven Central. -guardCore = "4.3.3" +guardCore = "4.4.0" netty = "4.1.139.Final" [libraries] diff --git a/settings.gradle.kts b/settings.gradle.kts index 42b979e..618107e 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -13,7 +13,7 @@ pluginManagement { // GUARD_CORE_USE_COMPOSITE (environment variable): // unset / "1" / "true" -> composite ON (default). The engine is built from // source via includeBuild + dependency substitution: CI (and local builds) -// check out Guard-Core/guard-core-jvm at the PINNED REF 6cde4af as the +// check out Guard-Core/guard-core-jvm at the PINNED REF 7711606 as the // sibling directory ./guard-core-jvm, and the block below substitutes the // declared coordinates com.guard-core:guard-core / // com.guard-core:guard-core-engine with the included build's projects. @@ -63,7 +63,7 @@ if (useComposite) { roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " + - "at the pinned ref 6cde4af next to this repository (or point -PguardCoreJvmDir / " + + "at the pinned ref 7711606 next to this repository (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, )