release(1.5.0): the custom response modifier and the engine floor guard-core-go v4.4.0

CHANGELOG.md

@@ -3,6 +3,24 @@ Release Notes
 
 ___
 
+v1.5.0 (2026-10-16)
+-------------------
+
+The custom response modifier and the guard-core-go v4.4.0 floor (the reference-alignment engine)
+------------------------------------------------------------------------------------------------
+
+### Fixed
+
+- **The `CustomResponseModifier` is applied, and the status handed to the response pass is the real one** (#43): `Engine.ModifyResponse` is applied in the reference order (security headers, CORS, modifier, then CORS again), and a handler error is turned into a response with `c.Error(err)` before the status is read, so `echo.NewHTTPError(500)` and plain errors are recorded as 500 instead of the unwritten default 200. With a modifier configured the adapter holds the whole handler response in memory until the handler returns, so streamed responses are delivered at the end; without one nothing changes, and hijacked connections are left alone.
+
+### Changed
+
+- **Raised the engine floor to `github.com/rennf93/guard-core-go/v4 v4.4.0`, the reference-alignment release.** The v4.4.0 engine adds the per-request scan time budget (`Detection.MaxScanSeconds`, `pattern_timeout`), honors `Detection.ThreatScoreThreshold`, canonicalizes client identity (IPv4-mapped addresses, brackets, zones), follows the reference IP list precedence, answers an unresolved client address with 403 under `FailSecure`, applies dynamic rule versions over the base config, fixes the filtered-value scan bypass (GHSA-w9j2-2m3v-5hcc) and scans the Cookie header one pair at a time. No adapter code change was needed: the full gate (gofmt, vet, staticcheck, unit and integration tests with Redis, the 100% coverage gate, govulncheck) is green on the new floor.
+- **Behavior to know before upgrading.** The v4.4.0 engine changes what some requests get, and this adapter passes it straight through. A request that reaches the engine with an empty remote address is now answered 403 `Client address could not be determined` under `FailSecure` (the adapter always hands over the connection's remote address, so only a server that leaves it empty is affected). IPv4 blacklist, whitelist, exempt and emergency entries now also match clients that connect as `::ffff:a.b.c.d`, and an IPv4 CIDR no longer trusts a mapped peer as a proxy. A configured whitelist now decides alone (a route whitelist overrides the route blacklist and skips the global lists, a global whitelist overrides the global blacklist), so an entry that relied on the blacklist beating the whitelist must move. A dynamic rule version no longer stacks on the previous one, so a field a version does not set returns to the base value. A request that spends `Detection.MaxScanSeconds` (default 10.0) of regex CPU time is blocked with a `pattern_timeout` threat, and a set `Detection.ThreatScoreThreshold` now changes verdicts. A passive-mode log match on the old penetration wording needs updating.
+- **Docs and CI**: the examples and docs no longer claim the default address headers need a manual `ExcludedDetectionHeaders` entry or that `EnableAgent` fails validation (both verified against the engine), the weekly lint runs on Go 1.26.x, `codeql-action` moves to 4.38.3, the docs links and mkdocs `site_url` point at the live site root, and the README gets the content-parity pass.
+
+___
+
 v1.4.0 (2026-10-09)
 -------------------
 

README.md

@@ -152,10 +152,10 @@ ___
 
 ## Install
 
-Released: `v1.4.0` on the Go module proxy, flooring the guard-core-go v4.3.2 parity engine:
+Released: `v1.5.0` on the Go module proxy, flooring the guard-core-go v4.4.0 reference-alignment engine:
 
 ```
-go get github.com/rennf93/echo-guard@v1.4.0 github.com/rennf93/guard-core-go/v4@v4.3.2
+go get github.com/rennf93/echo-guard@v1.5.0 github.com/rennf93/guard-core-go/v4@v4.4.0
 ```
 
 The package name is `echo`, which collides with `github.com/labstack/echo/v4` (also package `echo`), so import the adapter with an explicit alias such as `guardecho`.

go.mod

@@ -4,7 +4,7 @@ go 1.26.0
 
 require (
 	github.com/labstack/echo/v4 v4.16.0
-	github.com/rennf93/guard-core-go/v4 v4.3.2
+	github.com/rennf93/guard-core-go/v4 v4.4.0
 )
 
 require (

go.sum

@@ -20,8 +20,8 @@ github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5
 github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8=
 github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s=
 github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0=
-github.com/rennf93/guard-core-go/v4 v4.3.2 h1:UpEUaSw1MNIoPcMbikG2hPZr+rhqp8vtCDasNh0m5DQ=
-github.com/rennf93/guard-core-go/v4 v4.3.2/go.mod h1:zbSvFuYHn8Oo6bMwJ7jJ3iR8CEHBIYUvf1ALd1qMAvU=
+github.com/rennf93/guard-core-go/v4 v4.4.0 h1:+la36FG7WWr65gCc0Rq6RyIGC4Aiy+w91tQzH1SCndg=
+github.com/rennf93/guard-core-go/v4 v4.4.0/go.mod h1:6KcajSAwPjYhYxY48nqdrgihH+sXf0NIt6lGMNpKyaU=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=