Skip to content

Releases: faustbrian/go-webhook

Release list

github.com/faustbrian/go-webhook v1.0.0

github.com/faustbrian/go-webhook v1.0.0 Latest
Latest

Choose a tag to compare

View all tags
@faustbrian faustbrian released this 26 Aug 06:53
v1.0.0
7d0aee7

1.0.0 - 2026-08-25

Compatibility

  • Regenerate the exported API baseline with the repository's Go 1.26
    toolchain so the stable Envelope.Data contract is represented accurately.

Changed

  • Exclude intentional nested modules from root local-proxy archives so local,
    bootstrap, CI, and public module checksums describe the same source
    boundary.

  • Track the pinned documentation-tool lockfile so clean CI checkouts install
    the exact validated cspell dependency.

  • Reconcile standalone dependency checksums against deterministic current
    module archives so CI, local verification, and release consumers resolve
    identical content.

  • Harden standalone documentation validation with deterministic spelling and
    link checks, package-specific documentation gates, and repository-local
    contributor guidance.

Documentation

  • Replace obsolete standalone-repository links and workflow claims with
    monorepo-canonical targets and current release guidance.

  • Keep the initial v1.0.0 scope under Unreleased until a tag is published.

  • Link the package README to the repository-wide Golib documentation portal.

Compatibility

  • Added a pinned module export baseline so incompatible public API changes
    fail the canonical repository gate.

Changed

  • Publish the module from its standalone github.com/faustbrian/go-webhook identity while preserving its documented API and behavior.

  • Refresh local v0.0.0 owned-module checksums after dependency manifests and
    release notes were normalized; runtime behavior and public APIs are
    unchanged.

  • Align the transitive golang.org/x/text dependency with v0.41.0 after the
    owned module graph removed GO-2026-5970.

  • Rename the unpublished adapter packages to target-oriented idempotency,
    slog, outbox, queue, and otel paths with unambiguous webhook*
    package identifiers.

  • Declare the unresolved-decision inventory explicitly so repository
    specification governance fails closed on any future open interpretation.

  • Link the specification source matrix directly to the canonical decision
    register.

  • Require owned sibling modules at local v0.0.0; clean external consumers
    pin each module to an exact main pseudo-version.

  • Upgrade gRPC to 1.82.1 to remove the GO-2026-6061 vulnerabilities and
    align the isolated module graph.

  • Refresh owned-module checksums against the final consolidated archives.

  • Normalized standalone module metadata against the canonical owned dependency
    graph, including complete checksums for clean consumer resolution.

  • Refreshed the canonical logging checksum after its API compatibility tooling
    was standardized.

Added

  • Added an auditable specification decision register, integrity-pinned
    normative source manifest, and executable conformance gate for signature,
    HTTP, replay, envelope, delivery, retry, and SSRF policies.
  • Versioned HMAC-SHA-256 and HMAC-SHA-512 signing and verification.
  • Signed, bounded nonces with injectable generation and a crypto/rand default.
  • Exact-byte HTTP verification, bounded bodies and headers, rotation windows,
    safe typed failures, middleware, atomic replay protection, and a
    idempotency adapter.
  • Deterministic envelopes, bounded delivery and retries, Retry-After,
    dead-letter and replay hooks, fan-out, SSRF and DNS-rebinding protection,
    and queue and outbox adapters.
  • Secret-safe observations, independent Python vectors, fuzzers, allocation
    benchmarks, complete production coverage, and release gates.
  • Compiled log diagnostics, telemetry HTTP propagation, deterministic
    consumer fixtures, and an executable queued-delivery example.
  • Pinned GitHub Actions workflow linting in local and CI release gates.
  • Enforced a pure-Go dependency graph in the standalone safety gate.

Fixed

  • Reject malformed and nonnumeric endpoint ports before DNS resolution or
    dialing.
  • Isolate each verification candidate's timestamp and nonce so an invalid
    rotation signature cannot alter a later valid candidate.
  • Reject duplicate signing key IDs and independently validate delivery,
    wire, replay, queue, outbox, logging, and telemetry boundaries.
  • Check response-body and telemetry-runtime cleanup failures in adapter and
    SSRF tests instead of silently discarding them.
  • Express the accepted HTTPS or explicitly enabled HTTP schemes directly,
    preserving the default-deny SSRF policy without negation ambiguity.
  • Saturate numeric Retry-After values at the exact configured maximum,
    including subsecond limits, and reject body limits whose sentinel byte would
    overflow an int64 bound.
  • Compare caller timestamps at the signature protocol's Unix-second precision.
  • Select rotation keys at the signed timestamp, reject negative timestamps,
    and reject inverted key validity windows.
  • Keep replay identity stable across overlapping secret rotation keys.
  • Cover bounded Content-Type and Idempotency-Key values in v1 signatures.
  • Preserve and authenticate duplicate query-value order while sorting keys.
  • Preserve and authenticate the exact case-sensitive HTTP method.
  • Clamp delivery latency observations when an injected clock moves backward.

Planned v1.0.0 scope

The first release will freeze the v1 canonicalization and wire contracts.

Release integrity

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

Assets 9
Loading