v0.2.3

Maintenance and security hardening release.

Security and runtime

• Build with Go 1.26.5 and advance the pinned upstream Caddy security snapshot.
• Explicitly upgrade Alpine c-ares in the runtime image alongside curl and OpenSSL; the verified image contains c-ares 1.34.8-r0.
• Dismiss two duplicate Snyk code-scanning findings after validating the reported source ancestry as false positives.

Dependencies and CI

• Update golang.org/x/net to 0.57.0, google.golang.org/grpc to 1.82.1, and github.com/google/cel-go to 0.29.2.
• Update actions/setup-go from v6 to v7.

Verification

• go mod verify
• go vet ./...
• go test -race ./...
• Clean container build with the expected Caddy version and markdown_for_agents module.

Full diff: v0.2.2...v0.2.3

v0.2.2

Security patch release.

Fixes

• Caddy HTTP request smuggling — pinned github.com/caddyserver/caddy/v2 v2.11.4 → v2.11.5-0.20260612042621-fcba554d658b (upstream fix commit fcba554), clearing:
  • CVE-2026-52845 (high) — HTTP request smuggling via copy_headers / underscore-header normalization (GHSA-f59h-q822-g45g)
  • Resolved all four open Snyk alerts (SCA #90/#91 + Container #92/#93).
• Container build — CI and the Dockerfile now pass the go.mod-resolved Caddy version to xcaddy (go list -m … → xcaddy build "$VERSION"), so the published binary's buildinfo matches the pin instead of silently shipping the latest release.

Docs

• Documented the pseudo-version-pin playbook + the xcaddy version gotcha in CLAUDE.md and README.md.

Note

This pins an unreleased Caddy master commit to pull the fix ahead of a tagged release. Revert to the release once Caddy publishes v2.11.5.

Full diff: v0.2.1...v0.2.2

🤖 Generated with Claude Code

v0.2.1

Security patch release.

Fixes

• Go stdlib CVEs — bumped go.mod toolchain go1.26.3 → go1.26.4, clearing:
  • crypto/x509 — CVE-2026-27145 (high)
  • mime — CVE-2026-42504 (high)
  • net/textproto — CVE-2026-42507 (medium)
• Alpine base image — runtime-stage apk upgrade extended to openssl/libssl3/libcrypto3, clearing 15 low-severity openssl CVEs ahead of the upstream caddy rebuild.

Docs

• New "Clearing CVEs" remediation playbook in CLAUDE.md + matching note in README.md.

Full diff: v0.2.0...v0.2.1

🤖 Generated with Claude Code

v0.2.0

Plugin is live in production at https://hupfauer.one. End-to-end validated against the deployment: all three negotiation paths (URL suffix, ?format=md, Accept: text/markdown) return identical markdown with correct Content-Type, Vary, ETag; If-None-Match → 304 round-trip works; q-value negotiation honors client preference; query param is stripped from the upstream URL.

Since v0.1.0

Docs

• Add CLAUDE.md covering repo layout, dev commands, and conventions
• Warn against the path-matcher gotcha in the single-arg form (markdown_for_agents /path is parsed as a path matcher, not a positional)
• gofmt-normalize the module godoc

CI / release pipeline

• Daily base-image refresh that only rebuilds on upstream Caddy SHA change
• Docker image build moved to tag pushes + manual dispatch (no more per-commit builds)
• Image tagged on every plugin tag push (caddy-<version>, sha-<short>, latest)
• Self-hosted coverage report on the repo wiki (replaces Codecov)
• Manual workflow dispatch enabled on CI for ad-hoc reruns
• go-coverage-report pinned to SHA; write perms scoped to the test job only

Container

ghcr.io/mhupfauer/caddy-md4agents:v0.2.0

Build from source

xcaddy build --with github.com/mhupfauer/caddy-md4agents@v0.2.0