diff --git a/CHANGELOG.md b/CHANGELOG.md index e45be5a..22a6cc1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,24 @@ Release Notes ___ +v1.5.0 (2026-10-16) +------------------- + +The custom response modifier and the guard-core-go v4.4.0 floor (the reference-alignment engine) +------------------------------------------------------------------------------------------------ + +### Fixed + +- **The `CustomResponseModifier` is applied, and the status handed to the response pass is the real one** (#43): `Engine.ModifyResponse` is applied in the reference order (security headers, CORS, modifier, then CORS again), and a handler error is turned into a response with `c.Error(err)` before the status is read, so `echo.NewHTTPError(500)` and plain errors are recorded as 500 instead of the unwritten default 200. With a modifier configured the adapter holds the whole handler response in memory until the handler returns, so streamed responses are delivered at the end; without one nothing changes, and hijacked connections are left alone. + +### Changed + +- **Raised the engine floor to `github.com/rennf93/guard-core-go/v4 v4.4.0`, the reference-alignment release.** The v4.4.0 engine adds the per-request scan time budget (`Detection.MaxScanSeconds`, `pattern_timeout`), honors `Detection.ThreatScoreThreshold`, canonicalizes client identity (IPv4-mapped addresses, brackets, zones), follows the reference IP list precedence, answers an unresolved client address with 403 under `FailSecure`, applies dynamic rule versions over the base config, fixes the filtered-value scan bypass (GHSA-w9j2-2m3v-5hcc) and scans the Cookie header one pair at a time. No adapter code change was needed: the full gate (gofmt, vet, staticcheck, unit and integration tests with Redis, the 100% coverage gate, govulncheck) is green on the new floor. +- **Behavior to know before upgrading.** The v4.4.0 engine changes what some requests get, and this adapter passes it straight through. A request that reaches the engine with an empty remote address is now answered 403 `Client address could not be determined` under `FailSecure` (the adapter always hands over the connection's remote address, so only a server that leaves it empty is affected). IPv4 blacklist, whitelist, exempt and emergency entries now also match clients that connect as `::ffff:a.b.c.d`, and an IPv4 CIDR no longer trusts a mapped peer as a proxy. A configured whitelist now decides alone (a route whitelist overrides the route blacklist and skips the global lists, a global whitelist overrides the global blacklist), so an entry that relied on the blacklist beating the whitelist must move. A dynamic rule version no longer stacks on the previous one, so a field a version does not set returns to the base value. A request that spends `Detection.MaxScanSeconds` (default 10.0) of regex CPU time is blocked with a `pattern_timeout` threat, and a set `Detection.ThreatScoreThreshold` now changes verdicts. A passive-mode log match on the old penetration wording needs updating. +- **Docs and CI**: the examples and docs no longer claim the default address headers need a manual `ExcludedDetectionHeaders` entry or that `EnableAgent` fails validation (both verified against the engine), the weekly lint runs on Go 1.26.x, `codeql-action` moves to 4.38.3, the docs links and mkdocs `site_url` point at the live site root, and the README gets the content-parity pass. + +___ + v1.4.0 (2026-10-09) ------------------- diff --git a/README.md b/README.md index 2ca5a4f..9d8e7e2 100644 --- a/README.md +++ b/README.md @@ -152,10 +152,10 @@ ___ ## Install -Released: `v1.4.0` on the Go module proxy, flooring the guard-core-go v4.3.2 parity engine: +Released: `v1.5.0` on the Go module proxy, flooring the guard-core-go v4.4.0 reference-alignment engine: ``` -go get github.com/rennf93/echo-guard@v1.4.0 github.com/rennf93/guard-core-go/v4@v4.3.2 +go get github.com/rennf93/echo-guard@v1.5.0 github.com/rennf93/guard-core-go/v4@v4.4.0 ``` The package name is `echo`, which collides with `github.com/labstack/echo/v4` (also package `echo`), so import the adapter with an explicit alias such as `guardecho`. diff --git a/go.mod b/go.mod index 693fbae..f5d6b51 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26.0 require ( github.com/labstack/echo/v4 v4.16.0 - github.com/rennf93/guard-core-go/v4 v4.3.2 + github.com/rennf93/guard-core-go/v4 v4.4.0 ) require ( diff --git a/go.sum b/go.sum index a6b54c7..1cfbf65 100644 --- a/go.sum +++ b/go.sum @@ -20,8 +20,8 @@ github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8= github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s= github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0= -github.com/rennf93/guard-core-go/v4 v4.3.2 h1:UpEUaSw1MNIoPcMbikG2hPZr+rhqp8vtCDasNh0m5DQ= -github.com/rennf93/guard-core-go/v4 v4.3.2/go.mod h1:zbSvFuYHn8Oo6bMwJ7jJ3iR8CEHBIYUvf1ALd1qMAvU= +github.com/rennf93/guard-core-go/v4 v4.4.0 h1:+la36FG7WWr65gCc0Rq6RyIGC4Aiy+w91tQzH1SCndg= +github.com/rennf93/guard-core-go/v4 v4.4.0/go.mod h1:6KcajSAwPjYhYxY48nqdrgihH+sXf0NIt6lGMNpKyaU= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=