github.com/faustbrian/go-jsonrpc v1.0.0

1.0.0 - 2026-08-25

Fixed

• Strengthen single-request boundary verification at the exact byte limit and
  for invalid UTF-8 payloads.

• Align the executable documentation contract with the stable v1 repository
  state and current standalone contributor and conduct policies.

Changed

• Validate action pinning from the standalone repository root and leave
  repository-foundation policy to the authoritative repository contract.

• Exclude intentional nested modules from root local-proxy archives so local,
  bootstrap, CI, and public module checksums describe the same source
  boundary.

• Track the pinned documentation-tool lockfile so clean CI checkouts install
  the exact validated cspell dependency.

• Reconcile standalone dependency checksums against deterministic current
  module archives so CI, local verification, and release consumers resolve
  identical content.

• Harden standalone documentation validation with deterministic spelling and
  link checks, package-specific documentation gates, and repository-local
  contributor guidance.

Documentation

• Replace obsolete standalone-repository links and workflow claims with
  monorepo-canonical targets and current release guidance.

• Document the package's initial stable v1.0.0 scope and compatibility
  boundary.

• Link the package README to the repository-wide Golib documentation portal.

Compatibility

• Added a pinned module export baseline so incompatible public API changes
  fail the canonical repository gate.

Changed

• Publish the module from its standalone github.com/faustbrian/go-jsonrpc identity while preserving its documented API and behavior.
• Pin the official JSON-RPC 2.0 example corpus and make security, resource,
  compatibility, and wire consequences explicit for every protocol decision.
• Reject duplicate members at every nested object depth during strict
  parameter decoding instead of accepting last-member-wins ambiguity.
• Expose JSON-RPC specification verification as an explicit conformance gate.
• Added the GO-SAFETY-1 ownership, concurrency, race, fuzz, resource, and
  benchmark standard with an executable make safety gate.
• Moved AI planning and hardening briefs into .ai/ and clarified the
  separate purposes of project and third-party notice files.

Added

• Dispatcher.DispatchSingle for adapters that need a validated typed response
  before applying their own wire-compatible response encoding.
• Add an auditable specification-decision register for JSON-RPC ambiguities,
  defensive JSON policy, and the package's HTTP binding choices.
• A configurable dispatcher JSON nesting-depth limit that rejects excessive
  arrays and objects before protocol decoding or handler execution.
• Registry.RegisterSystem for trusted protocol integrations such as
  OpenRPC's reserved rpc.discover method.
• A standardized OSS repository skeleton covering policy, documentation,
  legal notices, Go tooling, pinned CI, security, and release automation.

Fixed

• Keep module-archive tests scoped to files shipped with the JSON-RPC module;
  repository-root workflow policy remains owned by the root verification gate.
• Strengthen protocol, transport, dispatcher-hook, and named-parameter boundary
  verification so every viable JSON-RPC mutation is detected without timeout
  or equivalent boundary predicates.

v1.0.0 scope

The following initial scope is included in v1.0.0.

Added

• Evidence-driven audit and hardening goal covering JSON-RPC conformance,
  hostile inputs, transports, concurrency, compatibility, and release readiness.
• Living hardening report, threat model, and normative JSON-RPC conformance
  matrix with explicit evidence and open-risk tracking.
• Dispatcher payload and batch-member options with safe defaults of four MiB
  and 1,024 members, plus an inspectable request-limit protocol error.
• A transport-neutral four-MiB client reply parsing limit with an additive
  option and inspectable oversized-response sentinel.
• Transport-neutral JSON-RPC 2.0 request, notification, response, and batch
  processing.
• Canonical public module path at github.com/faustbrian/go-jsonrpc.
• Concurrency-safe server registry, middleware, request context, safe error
  mapping, and panic containment.
• Plain net/http handler with media-type and body-size enforcement.
• Typed client calls, notifications, mixed batches, strict response validation,
  custom ID generation, and custom transport support.
• Bounded HTTP client transport with headers and caller-provided HTTP clients.
• Official-spec conformance fixtures, meaningful full coverage, race tests,
  fuzz targets, and single/batch benchmarks.
• CI, static analysis, security scanning, dependency updates, benchmark/fuzz
  automation, and semantic-version tag releases.
• Guarded patch, minor, and major Makefile release commands that create local
  annotated tags without pushing them.
• Quickstart, architecture, API, cookbook, adoption, middleware,
  troubleshooting, FAQ, compatibility, release, and community documentation.
• Shared repository instructions for Claude Code through the canonical
  AGENTS.md rules.
• Generated llms.txt index and llms-full.txt bundle sourced from the
  canonical Markdown documentation.
• Canonical JSON-RPC 2.0 section links on protocol types, dispatch behavior,
  error objects, and conformance fixtures.

Fixed

• Bound fuzz-smoke concurrency to avoid deadline flakes on high-core hosts.
• Reject duplicate members in request, response, and error envelopes instead
  of inheriting encoding/json's last-member-wins behavior. This defensive
  interoperability policy prevents ambiguous peers from interpreting the same
  protocol object differently.
• Reject duplicate generated IDs within a client batch before transport I/O so
  every non-notification response remains unambiguously correlatable.
• Reject case variants of reserved request, response, and error-object members
  instead of inheriting encoding/json's case-insensitive struct matching.
• Reject invalid UTF-8 throughout protocol envelopes and classify invalid
  server input as a parse error instead of silently replacing malformed bytes.
• Reject duplicate top-level names in DecodeParams named-parameter objects
  before Go's JSON decoder can collapse them.
• Reject oversized transport-neutral payloads and batches before parsing or
  handler execution can amplify their CPU, allocation, or downstream cost.
• Normalize arbitrarily long numeric-ID exponents with linear decimal-string
  arithmetic instead of allocation-heavy arbitrary-precision integers.
• Reject oversized replies from every client transport before JSON parsing,
  not only when the built-in HTTP transport enforces its body limit.
• Make the exported Registry zero value safe for concurrent registration and
  lookup instead of panicking on its first registration.
• Ignore nil functional options consistently and return HTTP request
  construction errors, including nil-context misuse, without network I/O.
• Expand continuous fuzzing across response and error decoding, ID round
  trips, and single and batch client correlation.
• Store the complete official JSON-RPC example corpus as stable conformance
  fixtures consumed by automated tests.
• Add hostile-boundary benchmarks for maximum dispatcher payloads and
  oversized generic client replies.
• Document every exported Go declaration and clarify safe custom error-code
  selection outside the JSON-RPC reserved range.
• Stop the default HTTP transport from following redirects and potentially
  forwarding caller-configured credentials to another origin.
• Reject trailing JSON values passed directly to ID.UnmarshalJSON.
• Keep StringID correlation equal to its actual JSON encoding when a Go
  string contains invalid UTF-8.
• Seed fuzzing with the checked-in specification corpus, deep JSON, and large
  batches in addition to malformed and boundary values.
• Add race, cancellation, chunked-reader, and response-body cleanup regression
  coverage for runtime ownership contracts.
• Preserve the nil-context transport regression test under both direct
  Staticcheck and golangci-lint without weakening either analyzer.

Release integrity

• Source commit: 9812dee1bae988287b8aa2a7c6244598781a50b3
• Exact-head CI: https://github.com/faustbrian/go-jsonrpc/actions/runs/32912889295
• Release dry-run: urn:sha256:07090102f9da587463aaafa5efad26377f1bef76f214b0a5e768d611ec69d45b
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS