v1.1.0

v1.1.0 - 31 August 2026

🎉 New Features

• Security: Config-driven TLS support — wss/https when tls.cert+tls.key configured, validated synchronously at startup (SRV-S3) 54ac5ee by @MarchSnow-1

🐛 Bug Fixes

• IPv6 bind, Windows rename compat, config save rollback, authGuard shutdown, recursive key detection 5ca9337 by @MarchSnow-1
• Security: WS auth failure counting with per-IP temporary bans against brute force (WS-7) 6682e67 by @MarchSnow-1
• Ws: Per-client bounded ordered write queues with drop counters; make two-level MIDI drops observable (WS-4/M-3) 5d9d116 by @MarchSnow-1
• Security: Add bind config option, startup exposure warnings, config validation and unknown-key warnings (SRV-S1b/S1c/I2) d5f1ad4 by @MarchSnow-1
• Robustness: Idempotent MidiReader.Stop with safe channel close order; wire autoReconnect config (SRV-M2'/M-5/M-1/SRV-M3') 753fe37 by @MarchSnow-1
• Security: Replace hardcoded default password with cryptographically random first-run password (SRV-S1) 94f1256 by @MarchSnow-1
• Robustness: Guard against go-logger permanent silence — writability probe, console fallback, dedup option builder (SRV-LOG1) a594424 by @MarchSnow-1
• Security: Validate WebSocket Origin — allow native clients and same-host only, block CSWSH (WS-6) 2e17c65 by @MarchSnow-1
• Ws: Add SetReadLimit, server-side ping/read-timeout reaping and close-on-write-failure (WS-1/WS-2/WS-3) b2708fd by @MarchSnow-1
• Security: Remove CORS wildcard and enforce allowlist/rate-limit before OPTIONS preflight (SRV-S2) 2fa0227 by @MarchSnow-1
• Security: Lock-protected Auth access — read snapshot accessor and fully-locked changePassword (SRV-L3) cffb495 by @MarchSnow-1
• Misc: Sanitize MIDI device names in logs, report authenticated client count in /admin/status, correct midiVerbose doc comment bf272f6 by @MarchSnow-1
• Robustness: Create listeners synchronously in Start() and exit on listen failure to prevent phantom-alive (SRV-M1') 11f0098 by @MarchSnow-1
• Robustness: Startup validation of IP allowlists with explicit warnings for invalid entries (SRV-IP1/IP2/L6/L7) 3e97351 by @MarchSnow-1
• Robustness: Replace hand-rolled itoa with strconv.Itoa — fixes negative-value rendering and malformed ports (M-4) c1db6cc by @MarchSnow-1
• Robustness: Cap rate limiter entry table with expiry cleanup and oldest-eviction (SRV-L5) 8a9745f by @MarchSnow-1
• Ws: Close auth-timeout race window with kicked flag decided under the client lock (WS-9) c25a1f9 by @MarchSnow-1
• Robustness: Bounded shutdown with 10s timeout and second-signal force-exit escape hatch (SRV-M4') 2fb6180 by @MarchSnow-1
• Ws: Send standard close frames before server-initiated disconnects (WS-8) 1920937 by @MarchSnow-1
• Security: Password policy — rune-count length check, minimum 8 characters, explicit 72-byte bcrypt cap (SRV-M3) 6157216 by @MarchSnow-1
• Don't close MIDI channels on timeout, use atomic rename without Remove 8069db8 by @MarchSnow-1
• Security: HTTP server timeouts and enforce GET on /admin/status (SRV-L4) 643acf4 by @MarchSnow-1
• Ws: ReadHeaderTimeout for handshake phase and nil-guarded Stop on both servers (WS-10/WS-11) 237bd6a by @MarchSnow-1
• Security: Restrictive config file permissions (0600/0700) and atomic write via temp file + rename (SRV-M2/SRV-I1) ec1476d by @MarchSnow-1
• Security: Unify change-password error responses — no internal error leakage, remove old-password probing oracle (SRV-L1/L2) 938bb05 by @MarchSnow-1
• Ws: Replace whole-map reset with per-client delete in KickAllClients to prevent orphaned connections (WS-5) c94543f by @MarchSnow-1
• Robustness: Use time.NewTicker instead of time.After inside readLoop select (M-2) 6344fad by @MarchSnow-1

📝 Documentation Changes

• Comprehensive documentation update — security chapter, TLS/network/tls config, WebSocket protocol reference, random initial password flow, Go version alignment, autoReconnect/midiVerbose documentation (DOC-SRV-S1/H1/H2/H3/M) 79881ef by @MarchSnow-1
• Add Unreleased changelog entries for security and reliability fixes 0d284d4 by @MarchSnow-1
• Add badges to README 5ae8659 by @MarchSnow-1

🎨 Tidying of Code eg Whitespace

• Gofmt whole source tree (fix import indentation and CC-block alignment) 1fcc897 by @MarchSnow-1

Full Changelog: v1.0.1...v1.1.0