release: v0.6.0 — RFC 9457 default errors, security fixes - #19
Merged
Conversation
Security: - CORS preflight: write filtered allowedHeaders, not raw reqHeaders (echo bypass) - Example JWT: validate signing method is HMAC before returning key (alg confusion) Code fixes: - Form binding type errors (age=abc) return DecodeError → 400, not 500 - Plugins updated: fursy v0.5.3→v0.5.4, stream v0.1.4→v0.1.5 Documentation (verified against actual code): - SECURITY.md: remove non-existent CSRF/Timeout/BodyLimit/HTTPSRedirect, fix RateLimit sig, update versions 0.5.x - llms.md: encoding/json/v2 → encoding/json, fix stale API examples - Plugin READMEs: router.Run() → http.ListenAndServe() - README.md: performance 256ns→53ns 0-alloc
- NewRateLimiter() returns *RateLimiter with Handler() and Stop() methods - Stop() releases cleanup goroutine — prevents leak on limiter recreation - NoHeaders: true disables X-RateLimit-* headers (was impossible before) - Backward compatible: RateLimit() and RateLimitWithConfig() unchanged
…RS, Shutdown godoc - PanicHandler: re-panic http.ErrAbortHandler (matches Recovery behavior) - Problem.WithExtension/WithExtensions: deep-copy map to prevent aliasing - CODEOWNERS: remove non-existent /internal/pool/, /handler.go, /Makefile; add actual files - Shutdown godoc: fix order description (drain first, then callbacks)
All auto-generated error responses now return application/problem+json: - Router: 404, 405, 413, 415, 400 (binding), 500 - JWT: 401 Unauthorized - BasicAuth: 401 Unauthorized - RateLimit: 429 Too Many Requests - CircuitBreaker: 503 Service Unavailable - Recovery/PanicHandler: 500 Internal Server Error Breaking change: error responses are JSON instead of text/plain. Custom error handlers (SetErrorHandler, JWT ErrorHandler, etc.) are unaffected — only default handlers changed.
deps: OTel v1.38→v1.46, validator v10.24→v10.30, sqlite v1.40→v1.58
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stop()andNoHeadersoptionsBreaking Changes
text/plaintoapplication/problem+jsonTest plan