purple-wolf v0.4.3

Highlights

purple-wolf v0.4.3 improves request-path performance, removes avoidable
http-wasm and relay-parser allocations, and strengthens release and integration
reliability without changing WAF detection or policy semantics.

Security

• Pin active demo, integration, and homelab deployments to Traefik v3.7.7,
  outside the affected range of the 2025 WASM plugin archive path-traversal
  advisory.

Performance

• Compile the request-path core and Aho-Corasick matcher at opt-level = 3
  while preserving the workspace's size-focused release profile elsewhere.
  Controlled Criterion runs improved representative inspections by 17-23%
  for a measured 3.1% WASM size increase.
• Keep common http-wasm ABI scratch buffers on the stack, reuse valid UTF-8
  host buffers, and join duplicate headers without intermediate strings.
• Avoid ANSI-normalized copies for plain relay log lines and reject
  brace-free non-audit lines before normalization; focused relay parser
  benchmarks cover the fast paths.

Reliability

• Clamp body.maxInspectBytes to the host's existing 16 MiB guest allocation
  ceiling with an operator-visible warning.
• Make the full relay integration harness portable across Linux and macOS,
  exercise the production distroless image, support prebuilt WASM, and allow
  collision-free host-port overrides.

Published artifacts

• Traefik WASM, relay binaries for Linux and macOS, SPDX SBOMs, SHA-256 files,
  and Sigstore signatures are attached below.
• Images: ghcr.io/guaracloud/purple-wolf-relay:0.4.3 and
  ghcr.io/guaracloud/purple-wolf-wasm:0.4.3; equivalent v0.4.3
  aliases are also published.
• Helm: helm pull oci://ghcr.io/guaracloud/charts/purple-wolf --version 0.4.3.
• release-manifest.json records immutable image and chart digests.

See the release verification guide
for checksum and signature commands.

Full changelog: v0.4.2...v0.4.3