v1.14.0

1.14.0 (2026-10-08)

Features

• implement performance improvements (e0c8688)
• server: populate CrossOriginProtection from CORS origins and add context timeout handler (7a5a8a2)

Bug Fixes

• config: ensure thread-safe lazy loading using sync.Once (65244be)
• handlers: marshal in memory before writing and allow empty payloads in validating handler (9829182)
• middlewares: allow Content-Length 0 for write requests per RFC 9110 (8ddcdc7)
• security: set X-XSS-Protection to 0 and add Content-Security-Policy header (179b6b6)
• validation: limit struct recursion depth and return defensive copies from cache (0327225)

Performance Improvements

• config: return configuration pointer to avoid pass-by-value struct copies (5da4cfb)
• handlers: optimize validation allocations and pre-render static error payloads (c15b0a8)
• middlewares: precompute header slices and optimize content-type checking (74c7ecc)
• server: standardize address bindings and remove access log from default stack (df64c7b)
• utils: implement lock-free reads in LimitedCache using atomic.Pointer (8f763d6)