v0.1.0

[Unreleased]

Changed

• securityheaders: Transitioned securityheaders.New(cfg Config) to functional options securityheaders.New(opts ...Option) with WithServerName, WithHSTSMaxAge, WithCSP, WithPermissionsPolicy.
• telemetry: Transitioned telemetry.NewTracerProvider(cfg Config) to functional options telemetry.NewTracerProvider(opts ...Option) with WithServiceName, WithServiceVersion, WithEnvironment, WithSampleRate.
• cryptoutil: ComparePassword wraps malformed password hashes with sentinel ErrInvalidHash.
• ginmw: Idempotency logs store errors during Lock, Unlock, and Save operations.

Removed (BREAKING)

• circuitbreaker: Removed redundant type alias CircuitBreaker and deprecated New(...) constructor; use ConsecutiveBreaker and NewConsecutiveBreaker(...) instead.
• cache: Removed redundant NewTTL[T] constructor; use NewTypedCache[T] instead.
• httpclient: Removed redundant WithTimeout alias; use WithTotalTimeout instead.
• ratelimit: Removed unexported pass-through wrappers realIP, isTrusted, extractIP, parseTrustedProxies.

Fixed

• cache, circuitbreaker, ratelimit: Added lazy initialization guards to TypedCache, ConsecutiveBreaker, RatioBreaker, TokenBucketLimiter, and SlidingWindowLimiter so var x T{} zero-values execute safely without panicking.
• Dependencies: Bumped golang.org/x/crypto from v0.55.0 to v0.56.0 to eliminate CVEs GO-2026-6354 and GO-2026-6355.

Security

• Workflows: Pinned all GitHub Actions to immutable 40-character commit SHAs.
• Containers: Pinned base container images in examples/microservice/Dockerfile to immutable @sha256: digests.
• Least Privilege: Set top-level permissions: read-all across all GitHub Actions workflows.
• SAST: Added automated GitHub CodeQL analysis workflow for continuous static application security testing.