purple-wolf v0.4.2

Highlights

purple-wolf v0.4.2 hardens Traefik request-body handling, reduces hot-path
allocations, and adds byte-faithful real-Traefik and homelab coverage.

Security

• Negotiate http-wasm request buffering and inspect both fixed-length and
  chunked bodies while preserving backend bytes exactly.
• Bound host-controlled header aggregate lengths and value counts before guest
  allocations, with safe failure behavior for interrupted body streams.
• Update anyhow to 1.0.103, resolving RUSTSEC-2026-0190.

Performance

• Normalize owned header names in place, skip unnecessary percent decoding,
  and resolve X-Forwarded-For without a temporary vector.
• Construct only enabled detector groups and avoid the previous eager
  50,000-entry reputation allocation in every pooled WASM guest.

Reliability

• Reject relay.subscriber_queue: 0 during configuration validation.
• Add prebuilt-WASM integration support, real Traefik body regressions, and an
  isolated homelab validation manifest.
• Make the Docker WASI builder usable on arm64 hosts and keep build artifacts
  out of Docker contexts.
• Align lifecycle, body-cap, reputation, relay-durability, and retry docs with
  implemented behavior.

Published artifacts

• Traefik WASM, relay binaries for Linux and macOS, SPDX SBOMs, SHA-256 files,
  and Sigstore signatures are attached below.
• Images: ghcr.io/guaracloud/purple-wolf-relay:0.4.2 and
  ghcr.io/guaracloud/purple-wolf-wasm:0.4.2; equivalent v0.4.2
  aliases are also published.
• Helm: helm pull oci://ghcr.io/guaracloud/charts/purple-wolf --version 0.4.2.
• release-manifest.json records immutable image and chart digests.

See the release verification guide
for checksum and signature commands.

Full changelog: v0.4.1...v0.4.2