purple-wolf v0.4.5

Purple Wolf v0.4.5 is a compatibility-preserving performance, reliability, and release-quality update for the Traefik WASM WAF and webhook relay.

Highlights

• Bounds each static literal signature to one verdict per request. The focused 16 KiB repeated-literal Criterion case moved from a 461.99 µs median to 114.63 µs (-77.15%) while capping verdict allocation by the static signature table.
• Uses linear deny-list lookup below 64 entries and hashed membership at 64 or more. The focused 4,096-entry miss moved from a 1.4463 µs median to 32.141 ns (-97.75%); the cutoff was selected from measured crossover behavior rather than guessed.
• Supervises relay source, parser, subscriber, pipeline, and admin tasks. Unrecoverable failures now clear readiness, stop the task graph, and propagate to the process; finite stdin sources drain subscriber delivery before exiting.
• Accepts documented IPv4:port and bracketed IPv6:port deny-list forms and warns when invalid entries are ignored.
• Consolidates the relay on rand 0.9, isolates benchmark baseline build artifacts between worktrees, and removes timing races from the relay integration test.

Compatibility

Request inspection, policy decisions, block/pass behavior, audit schema, Middleware configuration, webhook envelope, and HMAC protocol remain compatible. Repeated occurrences of the same static signature are intentionally collapsed to one finding; distinct signatures are still reported independently.

Verification

The exact tag commit passed stable, beta, and Rust 1.88 test matrices, strict Clippy/rustfmt/rustdoc, supply-chain checks, 88.18% line coverage, six 30-second fuzz targets, real Traefik and relay Docker suites, and an isolated homelab request matrix. The release workflow verified checksums, keyless Cosign blob/image signatures, SPDX JSON, multi-architecture images, the OCI Helm chart, and the signed release manifest.

Artifacts

This release contains the WASM plugin, Linux and macOS relay binaries, SPDX SBOMs, SHA-256 files, keyless Cosign signatures/certificates, signed GHCR images, the OCI Helm chart, and a signed release-manifest.json.

Full Changelog: v0.4.4...v0.4.5

purple-wolf v0.4.4

Purple Wolf v0.4.4 is a compatibility-preserving performance, security, and
release-engineering update for the Traefik WASM WAF and webhook relay.

Highlights

• Removes the TOML parser stack from the JSON-only Traefik guest while keeping
  TOML support enabled by default for purple-wolf-core users.
• Removes an allocation from browser User-Agent SQLi suffix inspection and
  trims unused Tokio, Hyper, core, and TOML dependencies from the relay.
• Updates quinn-proto to 0.11.15 to resolve RUSTSEC-2026-0185.
• Uses locked dependency graphs for release/container builds and modernizes
  CI, Pages, artifact, and Docker actions to their current Node 24 majors.
• Expands no-default-feature, package, workflow, deployment, fuzz, Docker, and
  homelab validation while preserving existing WAF defaults and behavior.

Compatibility

WAF configuration and request-handling behavior are unchanged. Default
purple-wolf-core users retain Config::parse; consumers that disable default
features must enable toml-config when they need TOML parsing.

Artifacts

The release includes the Traefik WASM module, Linux and macOS relay binaries,
the Helm chart, container-image SBOMs, checksums, keyless signatures and
certificates, and a signed release manifest.

Full changelog: v0.4.3...v0.4.4

purple-wolf v0.4.3

Highlights

purple-wolf v0.4.3 improves request-path performance, removes avoidable
http-wasm and relay-parser allocations, and strengthens release and integration
reliability without changing WAF detection or policy semantics.

Security

• Pin active demo, integration, and homelab deployments to Traefik v3.7.7,
  outside the affected range of the 2025 WASM plugin archive path-traversal
  advisory.

Performance

• Compile the request-path core and Aho-Corasick matcher at opt-level = 3
  while preserving the workspace's size-focused release profile elsewhere.
  Controlled Criterion runs improved representative inspections by 17-23%
  for a measured 3.1% WASM size increase.
• Keep common http-wasm ABI scratch buffers on the stack, reuse valid UTF-8
  host buffers, and join duplicate headers without intermediate strings.
• Avoid ANSI-normalized copies for plain relay log lines and reject
  brace-free non-audit lines before normalization; focused relay parser
  benchmarks cover the fast paths.

Reliability

• Clamp body.maxInspectBytes to the host's existing 16 MiB guest allocation
  ceiling with an operator-visible warning.
• Make the full relay integration harness portable across Linux and macOS,
  exercise the production distroless image, support prebuilt WASM, and allow
  collision-free host-port overrides.

Published artifacts

• Traefik WASM, relay binaries for Linux and macOS, SPDX SBOMs, SHA-256 files,
  and Sigstore signatures are attached below.
• Images: ghcr.io/guaracloud/purple-wolf-relay:0.4.3 and
  ghcr.io/guaracloud/purple-wolf-wasm:0.4.3; equivalent v0.4.3
  aliases are also published.
• Helm: helm pull oci://ghcr.io/guaracloud/charts/purple-wolf --version 0.4.3.
• release-manifest.json records immutable image and chart digests.

See the release verification guide
for checksum and signature commands.

Full changelog: v0.4.2...v0.4.3

purple-wolf v0.4.2

Highlights

purple-wolf v0.4.2 hardens Traefik request-body handling, reduces hot-path
allocations, and adds byte-faithful real-Traefik and homelab coverage.

Security

• Negotiate http-wasm request buffering and inspect both fixed-length and
  chunked bodies while preserving backend bytes exactly.
• Bound host-controlled header aggregate lengths and value counts before guest
  allocations, with safe failure behavior for interrupted body streams.
• Update anyhow to 1.0.103, resolving RUSTSEC-2026-0190.

Performance

• Normalize owned header names in place, skip unnecessary percent decoding,
  and resolve X-Forwarded-For without a temporary vector.
• Construct only enabled detector groups and avoid the previous eager
  50,000-entry reputation allocation in every pooled WASM guest.

Reliability

• Reject relay.subscriber_queue: 0 during configuration validation.
• Add prebuilt-WASM integration support, real Traefik body regressions, and an
  isolated homelab validation manifest.
• Make the Docker WASI builder usable on arm64 hosts and keep build artifacts
  out of Docker contexts.
• Align lifecycle, body-cap, reputation, relay-durability, and retry docs with
  implemented behavior.

Published artifacts

• Traefik WASM, relay binaries for Linux and macOS, SPDX SBOMs, SHA-256 files,
  and Sigstore signatures are attached below.
• Images: ghcr.io/guaracloud/purple-wolf-relay:0.4.2 and
  ghcr.io/guaracloud/purple-wolf-wasm:0.4.2; equivalent v0.4.2
  aliases are also published.
• Helm: helm pull oci://ghcr.io/guaracloud/charts/purple-wolf --version 0.4.2.
• release-manifest.json records immutable image and chart digests.

See the release verification guide
for checksum and signature commands.

Full changelog: v0.4.1...v0.4.2

v0.4.1

purple-wolf 0.4.1

Patch release fixing relay readiness under admin auth, release formatting, and versioned docs/package metadata.

v0.4.0

purple-wolf 0.4.0

Security & robustness hardening on top of v0.3:
- O(1) reputation-limiter eviction (was O(n), a CPU-DoS lever under IP rotation)
- Bounded percent-decode-to-fixpoint (defeats multi-encoding evasion)
- Expanded signature pack (;wget, ${jndi:, php://, /etc/shadow, xp_cmdshell, ...)
- User-Agent SQLi suffix probe (closes the Mozilla-prefix gap)
- NUL-byte / CRLF structural checks
- Over-cap body prefix inspection (closes the padding bypass)
- Panic discipline (panic=abort reality documented + structurally enforced)
- config_fallback audit signal + purple-wolf-validate binary
- Relay SSRF hardening + optional admin bearer auth
- Fuzz targets for XFF parsing and the relay log parser

See CHANGELOG.md for the full list.

v0.3.0

Release v0.3.0