Release v1.1.1

Security

• Upgraded golang.org/x/text v0.37.0 → v0.39.0 (root module and examples/wasm-client) to clear GO-2026-5970, a fresh advisory reachable via the HTTP/2 serving path. The v1.1.0 release gate correctly blocked publication on this advisory; v1.1.1 ships the same code with the patched dependency.

Added

• docs/core/ROLLOUT_TODOS.md — actionable environment-validation checklist for high-criticality rollouts (reverse-proxy lifetimes, horizontal scaling, auth alignment, browser soaks, CDN/WAF/corporate networks, deployment drain rehearsal), complementing the suite-verified behaviors in CONNECTION_LIFECYCLE.md.

Release v1.0.0

Highlights

• First stable release. The exported API of pkg/grpctunnel is now covered by semantic-versioning compatibility guarantees: no breaking changes without a major version bump, enforced in CI by the API-compatibility guard. Functionally identical to v0.2.0 plus the robustness suite below.

Stability statement

• Supported public API: pkg/grpctunnel (server bridge, client dialing, hardening options, lifecycle controls, tooling helpers) and pkg/wasm/dialer (browser dial primitives).
• pkg/bridge remains deprecated; it is frozen but not removed.
• Every release gate is green: lint, race + coverage (≥90%), fuzz seed corpus, goroutine-leak regression, 32 MiB streaming soak, Playwright browser e2e, gosec, govulncheck, CodeQL, API governance, and benchmark trend gates.

Added

• Leak and robustness regression suite: goroutine-leak tests over repeated connect/RPC/disconnect cycles (handler mode, native mode, and rejected-upgrade paths), abuse-guard slot-accounting verification, read-limit breach enforcement, 32 MiB streaming soak tests through both transports, and sustained-throughput benchmarks (~615 MB/s handler / ~835 MB/s native on 64 KB chunks, loopback).
• Connection-lifecycle documentation for long-lived, high-volume streams (video/file transfer): chunking guidance, end-to-end backpressure, keepalive interaction with active streams, and resumption semantics.

Changed

• CI: fuzz seed corpus now runs deterministically via -run '^Fuzz' instead of timed -fuzztime fuzzing, which intermittently failed at the fuzztime boundary with the Go fuzz engine's "context deadline exceeded" worker-shutdown race on loaded runners.
• CI: the Playwright driver is installed from npm (playwright-core@1.60.0 + PLAYWRIGHT_DRIVER_PATH) — the playwright.azureedge.net driver CDN was retired and 404s for every driver version, and playwright-go v0.6100.0 is unusable (its tag declares the old mxschmitt module path).
• Cleaned residual machine-generated parse* naming from documentation code samples (docs/core/README.md, GETTING_STARTED_ADVANCED.md).

Release v0.2.0

Highlights

• Runtime-cost and connection-lifecycle release: native gRPC transport mode (−47% memory per RPC), server keepalive on by default (dead peers reclaimed automatically), and a complete client keepalive + reconnection story.

Added

• WithNativeGRPCTransport / BridgeConfig.ShouldUseNativeGRPCTransport — serves tunneled sessions through grpc.Server.Serve and gRPC's native HTTP/2 transport instead of the net/http handler path: 9.2 KB / 163 allocs per unary RPC vs 17.3 KB / 228 (−47% bytes, −28% allocs), ~20% faster server-stream drains, native flow control, and gRPC server keepalive support. Tradeoffs (no upgrade-header forwarding; no transport credentials on the grpc.Server) are documented. Verified for unary, server-streaming, and bidirectional RPCs plus concurrent clients.
• WithTunnelKeepalive / TunnelConfig.KeepaliveConfig / ApplyTunnelKeepalivePolicy — client-side gRPC keepalive over the tunnel (native and WASM builds): detects silently dead connections (NAT resets, dropped networks) and triggers automatic reconnection even with no active streams.
• WithKeepaliveDisabled / BridgeConfig.ShouldDisableKeepalive — explicit opt-out of server keepalive probing.
• docs/core/CONNECTION_LIFECYCLE.md — authoritative connect/disconnect/timeout/reconnect guide: keepalive matrix, disconnect-detection paths, reconnection tuning, browser caveats, recommended production configuration, and transport-mode comparison.
• Lifecycle test suite: dead-peer reclamation, server-restart reconnection (WaitForReady), keepalive defaulting rules, native-transport end-to-end and concurrency tests, and transport-mode benchmarks.

Changed

• Server keepalive defaults on (30s ping / 120s idle) when not explicitly configured — silently dead clients previously pinned connection slots and goroutines until the OS TCP timeout. Disable with WithKeepaliveDisabled() when an upstream boundary owns liveness.
• Handler-mode serving drops the redundant h2c upgrade shim (requests inside ServeConn are already HTTP/2), removing a per-request indirection.
• CI: bumped playwright-go to v0.6000.0 — the 1.52 driver's playwright.azureedge.net CDN was retired and returned 404s, breaking every e2e lane.

Release v0.1.1

Highlights

• Performance, documentation, and repository-professionalism release. No API changes.

Performance

• Per-RPC forward-metadata injection no longer clones request headers twice. Requests already carrying trace/request metadata now pass through with zero allocations (1072 ns → 65 ns, 8 allocs → 0), sessions with no forwardable headers skip the wrapper entirely (295 ns → 2.6 ns), and the injection path drops ~31% of bytes allocated. Micro-benchmarks added in server_bench_test.go.

Documentation

• Rewrote the root README.md as a professional landing page: feature matrix, quick starts (server, browser WASM, native client), hardening guide, API overview table, and deployment caveats.
• Added runnable pkg.go.dev examples (example_test.go): Wrap, NewServer with graceful shutdown, WithAuthorize, WithAllowedOrigins, Dial, and BuildTunnelConn.
• Expanded pkg/wasm/dialer package documentation with bounded-queue, event-loop, and deadline semantics.
• Hardened SECURITY.md with a concrete private-disclosure channel (GitHub Security Advisories) and the automated gate list.

Repository

• Added .gitattributes (LF normalization — fixes false gofmt diffs on Windows checkouts), .editorconfig, CODE_OF_CONDUCT.md, issue templates, a pull-request template, and Dependabot configuration (gomod + GitHub Actions, weekly).
• Added a CodeQL analysis workflow and a CI job that executes the pkg/grpctunnel WASM test suite under Node (previously WASM code was compile-checked only).
• Pruned stale internal process documents (Codex TODO scratch files, self-grading rubrics, host-repo submodule-era docs) from docs/core/ and updated the docs index, catalog, and portal accordingly.

Release v0.1.0

Highlights

• Minor version bump: first release with new server-hardening surface area on pkg/grpctunnel.

Added

• BridgeConfig.Authorize and WithAuthorize — pre-upgrade authorization hook; failing requests are rejected with 403 Forbidden before any websocket or gRPC resources are allocated.
• WithAllowedOrigins and BuildOriginAllowlistCheck — declarative origin allowlisting with case-insensitive exact matching, "*", and "scheme://*.domain" subdomain wildcards; requests without an Origin header (non-browser clients) pass, matching browser-only origin-policy convention.
• NewServer — returns a configured *http.Server so callers own graceful shutdown (Shutdown), TLS wiring, and timeout tuning. Serve/ListenAndServe now build on it.
• ListenAndServeTLS — one-liner wss:// server startup.
• Client targets now accept http:// and https:// URLs on both native and WASM builds, mapped to ws:// and wss:// respectively.

Fixed

• Server-side net.Conn adapter: a non-binary websocket frame now surfaces an explicit protocol error instead of being silently reported as clean io.EOF (which masked protocol violations as normal stream end).
• WASM target inference: http(s):// targets previously produced malformed URLs like ws://http://example.com; unsupported schemes (e.g. ftp://) are now rejected with an error instead of being mangled.
• Abuse controls: the per-client upgrade-rate window map is now swept once per window, fixing unbounded memory growth under client-address churn (slow memory-exhaustion vector).
• WASM dialer test harness: environment overrides now use Object.defineProperty, fixing the navigator.onLine test under modern Node where globalThis.navigator is accessor-defined.

Changed

• pkg/bridge is formally deprecated in favor of pkg/grpctunnel; it remains supported for existing integrations but new features land in pkg/grpctunnel only.
• Internal naming cleanup across pkg/grpctunnel and pkg/wasm/dialer: removed the machine-generated parse* prefix from locals, parameters, and unexported identifiers. No exported API was renamed or removed.
• Documentation examples no longer demonstrate InsecureSkipVerify.

CI and repository (previously unreleased)

• Hardened test.yml quality gates with one retry, bin/quality/quality.log artifact upload, and explicit CI race-skip fallback (RUNNER_QUALITY_SKIP_RACE=1) to unblock flaky race-toolchain lanes.
• Hardened release.yml by capturing quality gate logs, using the same CI race-skip fallback in quality retries, forcing Node 24 action runtime, and adding post-publish release visibility/asset verification.
• Stabilized runner benchmark gating with a built-in retry pass to reduce transient benchmark-noise failures in CI.
• Reorganized repository docs into docs/core, docs/examples, docs/benchmarks, and docs/observability, and updated docs/catalog.json + docs portal path resolution accordingly.
• Added root GitHub-facing wrapper files (README.md, CONTRIBUTING.md, SECURITY.md, LICENSE) that point to canonical docs under docs/.
• Removed stale Makefile references from docs and removed Makefile from the repository in favor of the Go runner workflow (go run ./tools/runner.go ...).
• Expanded ignore coverage for local benchmark and coverage artifacts (coverage.txt, perf_*.out, benchmarks.test.exe) and cleaned generated local artifacts.
• Reworked root README.md into a technical product landing page with executable server/WASM integration snippets, architecture flow, production-hardening controls, and benchmark evidence drawn from benchmarks/quality_baseline.json.
• Added host-repo operational docs (GOGRPCBRIDGE_*) into canonical docs/core/ and indexed them in docs navigation/catalog.
• Added explicit module/repository identity policy docs (docs/core/MODULE_IDENTITY.md) and linked the policy from README and docs index.
• Hardened canonical-publish-check to accept canonical and legacy repository URLs, support fork-safe CI mode (RUNNER_CANONICAL_SKIP_ORIGIN=1), and validate clean-consumer server and WASM compile smoke builds.
• Updated release and CI workflows to align with Go 1.25.x, moved release changelog extraction to docs/core/CHANGELOG.md, added pkg.go.dev discoverability checks in release validation, and replaced blind push-based auto patch tagging with intentional workflow-dispatch semver tagging.

Release v0.0.18

Highlights

• Fixed release artifact build path for WASM client by building from nested module directory (examples/wasm-client) instead of root module package path.