serve v0.8.0
A big modernization pass: structured logging, safer defaults, graceful shutdown, and a cleaner library API. This release contains breaking changes (see below).
✨ Added
- Environment-variable config for every flag via
SERVE_*(withPORTstill honored for Heroku-style deploys). - Structured logging with
log/slog—--log-format(text/json) and--log-level(debug/info/warn/error). - Health-check endpoint at
/healthz(--health-path, empty to disable) that bypasses auth and logging for probes. --dirlistingto opt into automatic directory listings — disabled by default.- Dotfiles hidden by default (
.env,.git, …) from both access and listings; opt in with--all. - bcrypt support in the BasicAuth users file (alongside plaintext); secrets may now contain colons.
- Configurable CORS origin via
--cors-origin. - Graceful shutdown — drains in-flight connections on
SIGINT/SIGTERM. - Functional options for the library API:
WithDirectory,WithPrefix,WithHiddenFiles,WithDirectoryListing. --versionflag, richer version output (Go toolchain + VCS revision), and a DockerHEALTHCHECK.
🔧 Changed
- Requires Go 1.26.
- Request logging now captures every response, including
401s and500s. - Panics return a generic
500; details are logged server-side only. - BasicAuth passwords are compared in constant time.
- Static files are served through
io/fs(os.DirFS) for safer path handling.
🗑️ Removed
- The internal
mockHTTP server package andHTTPServerinterface indirection (replaced by real integration tests). - The
serve.Optionsstruct (replaced by functional options).
⚠️ Breaking changes
- Go 1.26 is now required.
- Library API:
serve.NewFileServer(serve.Options{...})→ functional options, e.g.serve.NewFileServer(serve.WithDirectory("./public")). - Directory listing is now off by default; pass
--dirlisting(CLI) orWithDirectoryListing(true)(library) to restore the old behavior.
Full Changelog: v0.7.1...v0.8.0