v1.6.0

Added

• Reshape introspection and refusal envelopes; retract v1.5.0

v1.5.0

Added

• Add server-sent-events broadcast hub subpackage

v1.4.0

Added

• Add WithRecoverResponder for non-JSON panic responses

Changed

• Take burst int and interval time.Duration

Fixed

• Isolate panics in the Recoverer hook and custom responder

v1.3.0

Added

• Add token-bucket RateLimiter middleware

Fixed

• Order rateLimitConfig fields for fieldalignment

v1.2.1

Dependencies

• Update github/codeql-action action to v4.37.0 (#11)
• Update Go toolchain to 1.26.5

v1.2.0

Added

• Add WithClientIP access-log option
• Add ParseCIDRs trusted-proxy list parser
• Add WithClientIPFunc for dynamic client-IP resolution in access logs
• Add DecodeJSONInto so custom-taxonomy apps can share the JSON decode prelude

v1.1.1

Fixed

• Commit response only after a successful Flush, Hijack, or ReadFrom

v1.1.0

Added

• Add DefaultStack correct-order middleware constructor

v1.0.0

Added

• Add server-side HTTP plumbing toolkit
• Add recoverer, security-headers, client-IP, timeout, and Chain middleware

Fixed

• Harden recorder transparency, shutdown grace, and JSON/method guards

Security

• Fix ClientIP XFF spoofing and Recoverer double-write