v0.20.0

0.20.0 (2026-07-27)

release

• prepare 0.20.0 (e3abdac)

Bug Fixes

• accumulate last_buf across the whole output chain (ad8d7bc)
• accumulate last_buf across the whole output chain (9eb8a2a)
• align non-delayed body intervention teardown with finalize path (1b0a60f)
• always set intervention_triggered when an intervention fires (2b8d1f4)
• always set intervention_triggered when an intervention fires (0d66632)
• bound delayed-header buffering on uninspected file-backed streams (145ce04)
• bound delayed-header buffering on uninspected file-backed streams (39c0f6d)
• cap delayed response-body buffering to bound worker memory (03691ca)
• cap delayed response-body buffering to bound worker memory (da34c4c)
• clear entity headers on synthesized redirects (c8ed380)
• clear entity headers on synthesized redirects (0c2163b)
• config: compile-probe libcoraza result enum via auto/feature (fabb8bb)
• coraza_transaction_id takes exactly one argument (81358c7)
• coraza_transaction_id takes exactly one argument (bce33c8)
• dedup body chunk length calc via shared helper (955fa99)
• detect libcoraza result enum via config, not #ifdef on an enum member (309ea3e)
• do not synthesize Connection/Keep-Alive for the WAF on HTTP/2 (5dbcdb7)
• do not synthesize Connection/Keep-Alive for the WAF on HTTP/2 (74ac2aa)
• don't delay HEAD response headers (062fd57)
• don't delay HEAD response headers (f7f65a3)
• don't delay response headers for SSE streams (#81) (dc49612)
• don't delay response headers for SSE streams (#81) (099f587)
• drop unused Coraza dl symbols (c1c0481)
• drop unused Coraza dl symbols (07eae2d)
• fail closed on NGX_ERROR from the intervention handler (34aeb08)
• fail closed on NGX_ERROR from the intervention handler (f4e5194)
• fail closed when body-phase processing fails in Coraza (770fb29)
• fail closed when body-phase processing fails in Coraza (6cbfd48)
• fail closed when request-body submission to Coraza fails (6b46045)
• fail closed when request-body submission to Coraza fails (28a3e73)
• fail closed when response-body submission to Coraza fails (2fd2605)
• fail closed when response-body submission to Coraza fails (426a51b)
• fall back to per-header path when bulk submission fails (a4d6323)
• free transaction when cleanup registration fails (2c5d782)
• fuzz: empty input yields a valid pointer, not NULL (8d4dda8)
• gate phase-4 finalize on per-buffer last_buf, not the sticky flag (5bbe7ae)
• guard h2/h3 forbidden headers by http_version, not r->stream (cc38a6b)
• guard size_t to int narrowing at the Coraza cgo boundary (ff47fd4)
• guard size_t to int narrowing at the Coraza cgo boundary (34987d4)
• harden bulk-header dl contract and drop stale docs/decl (a192f8a)
• keep libcoraza loaded for worker lifetime (056e7b3)
• keep libcoraza loaded for worker lifetime (f5bd4c7)
• keep the per-buffer last_buf test separate from the chain-wide one (f71f0b2)
• omit NUL from synthetic server header (c27575d)
• omit NUL from synthetic server header (6edbace)
• propagate delayed header filter status (acf18c0)
• propagate delayed header filter status (5c4be30)
• propagate response header insert failures (3a14a41)
• propagate response header insert failures (11916db)
• reject oversized response-body chunks before read, set intervention flag (d151590)
• remove linker path from include flags (f864842)
• remove linker path from include flags (89a7a5f)
• remove stale sanity check build traps (d29279f)
• remove stale sanity check build traps (589785b)
• report HTTP/3 protocol version to the WAF (0e052b1)
• report HTTP/3 protocol version to the WAF (3f5747f)
• report HTTP/3 response protocol to the WAF, not just the request (2170fce)
• report REQUEST_PROTOCOL in slash-delimited form (9123a61)
• require libcoraza 1.4 ABI (2492a2a)
• require libcoraza 1.4 ABI (ff2181b)
• require valid file pointer before replaying file buffer (9fc0a19)
• return empty C string for empty ngx_str (f8a76b0)
  ...

v0.11.4

0.11.4 (2026-06-28)

Bug Fixes

• skip deleted (hash == 0) headers when collecting them for coraza (bca1f6d)

v0.11.3

0.11.3 (2026-06-26)

Bug Fixes

• don't delay 101 Switching Protocols, breaks websocket upgrades (3c5ce85)
• pass through 101 Switching Protocols (WebSocket upgrades) (2c61d19)

v0.11.2

0.11.2 (2026-06-15)

Bug Fixes

• header_filter: pass Content-Length: 0 to the WAF for inspection (50e6030)
• header_filter: pass Content-Length: 0 to the WAF for inspection (bcda3f9)
• module: do not allocate an unused cleanup data buffer per request (3fb3f53)

v0.11.1

0.11.1 (2026-06-02)

Bug Fixes

• forward empty/multi-buffer responses (return 301/404) (16cdc41)
• forward empty/multi-buffer responses correctly (6e424f1)

v0.11.0

0.11.0 (2026-04-16)

Features

• add Debian packaging (fd75748)
• add Debian packaging (e014c2c)
• add go-ftw e2e tests (f343fcd)
• add go-ftw e2e tests (6381b71), closes #33
• handle unix domain sockets in connection info (8b101be)
• handle unix domain sockets in connection info (a6b9175)

Bug Fixes

• address review feedback on go-ftw CI step (9a7525e)
• always run phase 4 rules even when body inspection is disabled (d3fe533)
• debug mode compilation errors (CORAZA_DDEBUG=1) (20a0924)
• match pidfile path with nginx-test.conf (/tmp/nginx.pid) (3643cfe)
• require coraza_is_response_body_processable (libcoraza >= 1.4.0) (d8c121f)
• skip response body inspection when SecResponseBodyAccess is Off (c118201)
• stop routing response bodies through Go FFI when body inspection is disabled (9d5c083)
• use command injection payload for GET RCE test, add 405 fallback to all locations (c2dab85)

v0.10.1

0.10.1 (2026-03-16)

Bug Fixes

• upgrade Go version and modify test download method (ce3a1f7)

v0.10.0

0.10.0 (2026-03-01)

Features

• add redirect support and bump libcoraza to v1.1.0 (1642c13)

v0.9.0

0.9.0 (2026-02-28)

Features

• ci: change names and add automated build (5bd81f3)
• ci: change names and add automated build (d02394c)
• coraza-nginx with working tests (774b496)
• full coraza-nginx rework — config inheritance, dlopen wrapper, bug fixes (c0f3b6c)
• transaction ID tracking and access denied logging (fcc5551)

Bug Fixes

• adapt tests for Coraza compatibility (d24a47c)
• address review feedback (eec1d9c)
• check body limit intervention before processing rules (95479e4)
• config inheritance for locations without rules (0c4806c)
• config syntax (7e5b812)
• delay response headers until phase 4 body inspection completes (6f60f15)
• delay response headers until phase 4 body inspection completes (95b9c5b)
• dlopen libcoraza after fork to avoid Go runtime deadlock (e3cd8c6)
• Dockerfile prove runs only coraza tests (2f53dc4)
• Dockerfile test runner (b77a9da)
• enable passing tests and fix audit log assertions (a609d97)
• intervention memory leaks (8ae8f72)
• ngx_str_to_char pass pointer by reference (093eec4)
• second pass changing names and main module (a746b53)
• second pass changing names and main module (d381f1a)
• set intervention_triggered flag consistently (e38a4a7)
• tests (4fd9b30)
• update dockerfile (b0c6a27)
• update header comment (4e8621e)
• use ppomes/libcoraza fork with working rules_merge (86063cc)

Miscellaneous Chores

• release 0.9.0 (bc82be7)