Release github.com/faustbrian/go-http-middleware v1.0.0 · faustbrian/go-http-middleware

1.0.0 - 2026-08-25

Exclude intentional nested modules from root local-proxy archives so local,
bootstrap, CI, and public module checksums describe the same source
boundary.
Track the pinned documentation-tool lockfile so clean CI checkouts install
the exact validated cspell dependency.
Reconcile standalone dependency checksums against deterministic current
module archives so CI, local verification, and release consumers resolve
identical content.
Harden standalone documentation validation with deterministic spelling and
link checks, package-specific documentation gates, and repository-local
contributor guidance.

Replace obsolete standalone-repository links and workflow claims with
monorepo-canonical targets and current release guidance.
Link the package README to the repository-wide Golib documentation portal.

Explicit immutable middleware chains and named order descriptors.
Bounded request ID, recovery, body limit, deadline, trusted proxy, CORS,
security header, compression, observation, content, admission, and response
policy packages.
HTTP/1.1 and HTTP/2 integration fixtures, fuzzing, mutation checks,
benchmarks, ownership adapters, and release automation.
A bounded request-scoped route recorder for routers that clone requests.
A pinned specification decision register and focused conformance gate for
HTTP, Fetch, URL, forwarding, HSTS, and Go runtime behavior.

Publish the module from its standalone github.com/faustbrian/go-http-middleware identity while preserving its documented API and behavior.
Link the conformance source matrix directly to the canonical specification
decision register.
Regenerated the exported API baseline with the pinned Go documentation
formatter without changing the public contract.
Bound trusted-prefix and configured media-policy collections, handler
deadlines, admission waits, and observation method/protocol cardinality.
Bound context-ignoring buffered-timeout executions with an explicit
per-middleware concurrency limit.
Compare CORS preflight methods with HTTP's case-sensitive method semantics.

Prove that requests admitted from free capacity bypass the bounded waiter
queue instead of inheriting its configured delay.
Give the real-listener informational-timeout assertion enough scheduling
budget to remain deterministic under parallel CI load.
Make admission waiter-bound verification deterministic under heavily
parallel coverage execution.
Preserve acceptable gzip coding after buffer spill and close streaming
encoders during panic unwind.
Reject control characters in identifiers, malformed media wildcards and
parameters, and canceled requests before admission.
Reject nil conditional results and ordering constraints placed between
duplicated target layers.
Preserve informational responses through buffered timeout, commit protocol
switches through compression, and reject invalid status codes.
Reject malformed wildcard CORS methods, invalid origin ports, duplicate
Forwarded parameters, and non-ASCII identifiers.
Extract route and client-class metadata after downstream completion and
contain metadata-extractor panics.
Reject duplicate content types and malformed or oversized Accept tails even
when an earlier media range matches.
Preserve response trailers through compression while removing stale digest,
length, and entity-tag metadata for the identity representation.
Preserve implicit identity encoding preference and accept bounded Unicode
origins whose IDNA serialization is valid.

Source commit: a8daad87686af21729917917abea2417b10556c5
Exact-head CI: https://github.com/faustbrian/go-http-middleware/actions/runs/32923633457
Release dry-run: urn:sha256:c41c3a4c59a3fcccffaa1df195d0c3a7efe70bc4741cff504b5d924bf913916e
Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS