Purple Wolf v0.4.6 is a compatibility-preserving performance, reliability, security, and release-engineering update for the Traefik WASM WAF and webhook relay.
Highlights
- Removes the configured guest's redundant enabled-group lookup, reuses the detector verdict allocation during policy resolution, and avoids audit-object/JSON construction when the http-wasm host has INFO logging disabled.
- Defines zero-capacity dead-letter queues as retention-disabled so the public invariant remains memory-bounded, and gives concurrent HTTP-subscriber tests explicit task deadlines.
- Centralizes a checksum-verified wasi-sdk 33 installer across CI, release, image, and demo builds, with native x86_64 and arm64 host support.
- Advances active demo, integration, and homelab coverage to Traefik v3.7.9 while preserving the historical comparison benchmark manifests.
- Makes unsafe-boundary review mechanically enforceable in the core and WASM adapter, aligns the documented security scope with the shipped Log4Shell and CRLF detectors, and records the primary-source performance/safety research and rejected speculative candidates.
Compatibility
Request inspection, policy decisions, block/pass behavior, audit schema, Middleware configuration, webhook envelope, and HMAC protocol remain compatible. Lazy audit construction only skips work when the host reports that INFO logging is disabled; when enabled, the existing audit output is preserved.
Verification
The exact tag commit passed all 15 GitHub check-runs: stable, beta, Rust 1.88, and macOS tests; strict Clippy/rustfmt/rustdoc; no-default core checks; supply-chain policy; 75% coverage floor; bounded nightly fuzz smoke; real Traefik and relay Docker integrations; WASM build; image publication; and Pages deployment. The release workflow additionally verified checksums, keyless Cosign blob/image signatures, SPDX JSON, multi-architecture images, the OCI Helm chart, and the signed release manifest.
Artifacts
This release contains the WASM plugin, Linux and macOS relay binaries, SPDX SBOMs, SHA-256 files, keyless Cosign signatures/certificates, signed GHCR images, the OCI Helm chart, and a signed release-manifest.json.
Full Changelog: v0.4.5...v0.4.6