Purple Wolf v0.4.5 is a compatibility-preserving performance, reliability, and release-quality update for the Traefik WASM WAF and webhook relay.
Highlights
- Bounds each static literal signature to one verdict per request. The focused 16 KiB repeated-literal Criterion case moved from a 461.99 µs median to 114.63 µs (-77.15%) while capping verdict allocation by the static signature table.
- Uses linear deny-list lookup below 64 entries and hashed membership at 64 or more. The focused 4,096-entry miss moved from a 1.4463 µs median to 32.141 ns (-97.75%); the cutoff was selected from measured crossover behavior rather than guessed.
- Supervises relay source, parser, subscriber, pipeline, and admin tasks. Unrecoverable failures now clear readiness, stop the task graph, and propagate to the process; finite stdin sources drain subscriber delivery before exiting.
- Accepts documented IPv4:port and bracketed IPv6:port deny-list forms and warns when invalid entries are ignored.
- Consolidates the relay on rand 0.9, isolates benchmark baseline build artifacts between worktrees, and removes timing races from the relay integration test.
Compatibility
Request inspection, policy decisions, block/pass behavior, audit schema, Middleware configuration, webhook envelope, and HMAC protocol remain compatible. Repeated occurrences of the same static signature are intentionally collapsed to one finding; distinct signatures are still reported independently.
Verification
The exact tag commit passed stable, beta, and Rust 1.88 test matrices, strict Clippy/rustfmt/rustdoc, supply-chain checks, 88.18% line coverage, six 30-second fuzz targets, real Traefik and relay Docker suites, and an isolated homelab request matrix. The release workflow verified checksums, keyless Cosign blob/image signatures, SPDX JSON, multi-architecture images, the OCI Helm chart, and the signed release manifest.
Artifacts
This release contains the WASM plugin, Linux and macOS relay binaries, SPDX SBOMs, SHA-256 files, keyless Cosign signatures/certificates, signed GHCR images, the OCI Helm chart, and a signed release-manifest.json.
Full Changelog: v0.4.4...v0.4.5