v0.3.1

[0.3.1] - 2026-09-24

Security & Hardening

• Dependency Updates: Bumped github.com/gin-gonic/gin to v1.12.0, github.com/jackc/pgx/v5 to v5.11.0, golang.org/x/crypto to v0.57.0, and golang.org/x/sync to v0.23.0 to resolve downstream security advisories including transitive quic-go vulnerabilities.
• OpenSSF Scorecard & CI Pinning: Corrected repository paths and OpenSSF Scorecard configuration for Abeta-dev/go-libs, and pinned GitHub Actions across all workflows to immutable commit SHAs.

Added

• CI & Quality Gate: Introduced unified CI Quality Gate workflow with intelligent path filtering (dorny/paths-filter) to optimize build times and conserve CI minutes.
• Documentation Portal: Added GitHub Pages deployment workflow deploying the interactive web portal for enterprise library documentation.

Changed

• Repository Attribution: Standardized canonical documentation links, code of conduct, and security disclosure policies to Abeta-dev.

v0.3.0

[0.3.0] - 2026-09-17

Highlights

• Pre-1.0 Minor Reconciliation & Release Baseline: Reconciled branch history following PR #18 integration and cut monotonic minor version v0.3.0 to establish clean-slate architecture and prevent version drift across downstream consumers.
• Cryptographic Release Verification & Manifest Provenance: Integrated scripts/verify_release.sh into release workflows, generating cryptographically verified release-manifest.json with bounded exponential proxy retry backoff (5 attempts, isolated GOMODCACHE), SHA-256 module digests, and read-only cache permission safety.
• Downstream Baseline Audit: Added scripts/verify_release_baseline.sh and docs/RELEASE_BASELINE.md for historical release verification against Go module proxy and checksum database.
• Automated Shell & Release Verification Guards: Introduced scripts/test_shell_compatibility.sh, scripts/test_release_scripts.sh, and scripts/test_release_workflow.sh ensuring strict Bash 3.2 portability, 90-day manifest artifact retention, and release immutability.
• Dynamic Truth-Gate & Coverage Enforcement: Fully synchronized 95.8% measured statement coverage across all documentation, meta tags, and web portal, enforced by AST-based docs_truth_test.go and Go 1.26.0+ toolchain baseline assertions.

Added

• logger: Decoupled Sampler interface and WithSampler functional option for custom log sampling algorithms.
• httpclient: DefaultMaxRetryBodySize constant defining 10MB memory threshold for retry body buffering.
• db: CopyDBTX interface extending DBTX with CopyFrom bulk ingestion.
• CI & Release Pipelines: Added scripts/verify_release.sh generating release-manifest.json with multi-attempt proxy backoff.
• Baseline Verifier: Added scripts/verify_release_baseline.sh and docs/RELEASE_BASELINE.md for downstream module integrity checks.
• Test Guards: Added scripts/test_shell_compatibility.sh, scripts/test_release_scripts.sh, and scripts/test_release_workflow.sh.

Changed

• logger: Decoupled SamplingHandler from ratelimit; instantiates an internal token-bucket sampler when no custom sampler is supplied.
• httpclient: Bounded retry buffering using io.LimitReader; streams exceeding DefaultMaxRetryBodySize are executed as a single attempt without replay buffering.
• db: Streamlined DBTX interface to Exec, Query, and QueryRow; batch CopyFrom moved to segregated CopyDBTX interface.
• Release Workflow: Configured .github/workflows/release.yml to automatically verify immutable release artifacts, attach release-manifest.json to GitHub releases, and retain artifacts for 90 days.
• Documentation: Updated baseline toolchain to Go 1.26.0+ and synchronized overall statement coverage to 95.8%.

Fixed

• Cache Cleanup Permissions: Prepended chmod -R u+w before rm -rf on temporary module caches and test fixtures, preventing permission errors on read-only Go cache trees.
• Prerequisite Validation: Added checks for python3 in verify_release.sh and bc in check_coverage.sh.
• Version Check Regex: Hardened stale version regex in check_version.sh to be backtick-tolerant.
• httputil: Preserved raw error transparency in ErrorFromDomain returning err.Error() verbatim.

v0.2.1

[0.2.1] - 2026-09-17

Highlights

• Decoupled Logger Sampler (logger/sampler.go): Eliminated architectural layering breach by removing dependency on ratelimit. Defined standalone Sampler interface and an internal lock-synchronized token-bucket sampler with zero third-party dependencies.
• Bounded HTTP Client Retry Buffering (httpclient/roundtripper.go): Bounded memory ingestion on retries with DefaultMaxRetryBodySize (10MB) via io.LimitReader. Oversized streaming request bodies bypass buffering and execute as a single attempt without rewind to prevent process OOM.
• Interface Segregation on db.DBTX (db/context.go): Segregated core querier interface DBTX (Exec, Query, QueryRow) from bulk copy operations, introducing CopyDBTX for CopyFrom.
• Raw Error Transparency (httputil/response.go): Preserved transparent err.Error() propagation in ErrorFromDomain without unrequested sanitization.

Added

• logger: Decoupled Sampler interface and WithSampler functional option for custom log sampling algorithms.
• httpclient: DefaultMaxRetryBodySize constant defining 10MB memory threshold for retry body buffering.
• db: CopyDBTX interface extending DBTX with CopyFrom bulk ingestion.

Changed

• logger: Decoupled SamplingHandler from ratelimit; instantiates an internal token-bucket sampler when no custom sampler is supplied.
• httpclient: Bounded retry buffering using io.LimitReader; streams exceeding DefaultMaxRetryBodySize are executed as a single attempt without replay buffering.
• db: Streamlined DBTX interface to Exec, Query, and QueryRow; batch CopyFrom moved to segregated CopyDBTX interface.

Fixed

• Source Formatting: Applied canonical gofmt to circuitbreaker/consecutive_test.go and httpclient/roundtripper_test.go.
• httputil: Verified raw error transparency in ErrorFromDomain returning err.Error() verbatim.

v0.2.0

[0.2.0] - 2026-09-17

Highlights

• PostgreSQL Distributed Idempotency Store (idempotency/postgres.go with db.DBTX): High-performance, production-ready distributed idempotency store using two-phase atomic locking (Lock and Save) over any db.DBTX connection pool or transaction. Features automatic lock expiration recovery, status conflict detection, SHA-256 payload fingerprint validation, and configurable lock/response TTLs.
• PostgreSQL Atomic Distributed Rate Limiter (db/ratelimit.go): Clustered, atomic sliding-window rate limiter powered by PostgreSQL CTE queries over db.DBTX. Synchronizes request counters across multi-pod deployments without Redis or external infrastructure.
• Decoupled Universal net/http Standard Middleware: Universal middleware implementations adhering strictly to standard Go func(http.Handler) http.Handler signatures:
  • httputil.CORS: Flexible CORS handling with credential support, exposed headers, configurable max age, and wildcard/origin validation.
  • telemetry.Middleware: W3C distributed tracing extraction and automatic OpenTelemetry span instrumentation.
  • logger.Middleware: Structured access logging using standard library log/slog with latency tracking, status capture, and request ID correlation.
  • idempotency.Middleware: End-to-end HTTP idempotency filter with in-memory or PostgreSQL stores, automatic payload caching, concurrent in-progress 409 Conflict handling, and replay headers.
• Pruning Standard Library Duplication from sliceutil & maputil: Pruned redundant wrapper functions (sliceutil.Map, sliceutil.Filter, maputil.Keys, maputil.Values) in favor of idiomatic Go loops and standard library packages (slices, maps). Stabilized and expanded high-value algorithmic extensions: sliceutil.Chunk, sliceutil.GroupBy, sliceutil.Unique, sliceutil.Flatten, sliceutil.Reduce, and maputil.Merge.
• Reference Microservice (examples/microservice) Updates: Enhanced reference implementation demonstrating production best practices, item batching via sliceutil.Chunk, clean loops, and composition of operational primitives.

Compatibility Notice

Clean-slate architecture: No backward compatibility preserved. Legacy deprecated interfaces and backwards-compatibility shims have been dropped, as no external developers or downstream production systems are actively consuming pre-release revisions.

Added

• idempotency: PostgreSQL Distributed Idempotency Store (PGStore, NewPGStore, WithPGLockTTL, WithPGResponseTTL, WithPGTableName) backed by db.DBTX for distributed two-phase atomic locking, conflict mitigation, and crash recovery.
• idempotency: Universal net/http standard idempotency middleware (Middleware, MiddlewareOptions, MiddlewareOption, WithHeaderName, WithEnforceHeader, WithIgnoredMethods, WithStatusCodeMatcher).
• db: PostgreSQL Atomic Distributed Rate Limiter (PGRateLimiter, NewPGRateLimiter, WithPGRateLimiterTableName, WithPGRateLimiterTimeout) implementing sliding window rate limiting via DBTX.
• httputil: Decoupled universal net/http standard CORS middleware (CORS, CORSConfig, DefaultCORSConfig).
• telemetry: Decoupled universal net/http standard OpenTelemetry tracing middleware (Middleware, MiddlewareOption, WithPropagator).
• logger: Decoupled universal net/http standard structured logging middleware (Middleware, MiddlewareOption, WithLogger, WithRequestIDHeader, WithExtraAttributes).

Changed

• sliceutil: Pruned redundant standard library duplication (Map, Filter) in favor of idiomatic Go loops and standard slices; expanded and stabilized algorithmic utilities: Chunk, GroupBy, Unique, Flatten, Reduce, First.
• maputil: Pruned redundant standard library duplication (Keys, Values) in favor of standard maps; retained zero-dependency extensions: Merge, Filter.
• examples/microservice: Updated reference microservice showcasing sliceutil.Chunk for item batch processing, clean standard filtering loops, and universal middleware composition.
• securityheaders: Transitioned securityheaders.New(cfg Config) to functional options securityheaders.New(opts ...Option) with WithServerName, WithHSTSMaxAge, WithCSP, WithPermissionsPolicy.
• telemetry: Transitioned telemetry.NewTracerProvider(cfg Config) to functional options telemetry.NewTracerProvider(opts ...Option) with WithServiceName, WithServiceVersion, WithEnvironment, WithSampleRate.
• cryptoutil: ComparePassword wraps malformed password hashes with sentinel ErrInvalidHash.
• ginmw: Idempotency logs store errors during Lock, Unlock, and Save operations.

Removed (BREAKING)

• sliceutil: Removed redundant wrappers Map and Filter.
• maputil: Removed redundant wrappers Keys and Values.
• circuitbreaker: Removed redundant type alias CircuitBreaker and deprecated New(...) constructor; use ConsecutiveBreaker and NewConsecutiveBreaker(...) instead.
• cache: Removed redundant NewTTL[T] constructor; use NewTypedCache[T] instead.
• httpclient: Removed redundant WithTimeout alias; use WithTotalTimeout instead.
• ratelimit: Removed unexported pass-through wrappers realIP, isTrusted, extractIP, parseTrustedProxies.

Fixed

• cache, circuitbreaker, ratelimit: Added lazy initialization guards to TypedCache, ConsecutiveBreaker, RatioBreaker, TokenBucketLimiter, and SlidingWindowLimiter so var x T{} zero-values execute safely without panicking.
• Dependencies: Bumped golang.org/x/crypto from v0.55.0 to v0.56.0 to eliminate CVEs GO-2026-6354 and GO-2026-6355.

Security

• Workflows: Pinned all GitHub Actions to immutable 40-character commit SHAs.
• Containers: Pinned base container images in examples/microservice/Dockerfile to immutable @sha256: digests.
• Least Privilege: Set top-level permissions: read-all across all GitHub Actions workflows.
• SAST: Added automated GitHub CodeQL analysis workflow for continuous static application security testing.

v0.1.0

[Unreleased]

Changed

• securityheaders: Transitioned securityheaders.New(cfg Config) to functional options securityheaders.New(opts ...Option) with WithServerName, WithHSTSMaxAge, WithCSP, WithPermissionsPolicy.
• telemetry: Transitioned telemetry.NewTracerProvider(cfg Config) to functional options telemetry.NewTracerProvider(opts ...Option) with WithServiceName, WithServiceVersion, WithEnvironment, WithSampleRate.
• cryptoutil: ComparePassword wraps malformed password hashes with sentinel ErrInvalidHash.
• ginmw: Idempotency logs store errors during Lock, Unlock, and Save operations.

Removed (BREAKING)

• circuitbreaker: Removed redundant type alias CircuitBreaker and deprecated New(...) constructor; use ConsecutiveBreaker and NewConsecutiveBreaker(...) instead.
• cache: Removed redundant NewTTL[T] constructor; use NewTypedCache[T] instead.
• httpclient: Removed redundant WithTimeout alias; use WithTotalTimeout instead.
• ratelimit: Removed unexported pass-through wrappers realIP, isTrusted, extractIP, parseTrustedProxies.

Fixed

• cache, circuitbreaker, ratelimit: Added lazy initialization guards to TypedCache, ConsecutiveBreaker, RatioBreaker, TokenBucketLimiter, and SlidingWindowLimiter so var x T{} zero-values execute safely without panicking.
• Dependencies: Bumped golang.org/x/crypto from v0.55.0 to v0.56.0 to eliminate CVEs GO-2026-6354 and GO-2026-6355.

Security

• Workflows: Pinned all GitHub Actions to immutable 40-character commit SHAs.
• Containers: Pinned base container images in examples/microservice/Dockerfile to immutable @sha256: digests.
• Least Privilege: Set top-level permissions: read-all across all GitHub Actions workflows.
• SAST: Added automated GitHub CodeQL analysis workflow for continuous static application security testing.