From 01f35a737c4765c7afe349682d5f45d51b9d94ba Mon Sep 17 00:00:00 2001 From: Renn F Date: Sun, 27 Sep 2026 18:09:59 +0200 Subject: [PATCH] release(3.1.0): parity release for the agent family - AES-256-GCM encrypted ingest, sensitive-header redaction, dynamic rules, local rate limiters, helpers --- .mike.yml | 3 ++- CHANGELOG.md | 18 ++++++++++++++++++ docs/release-notes.md | 18 ++++++++++++++++++ docs/versions/versions.json | 3 ++- guard_agent/_version.py | 2 +- pyproject.toml | 2 +- 6 files changed, 42 insertions(+), 4 deletions(-) diff --git a/.mike.yml b/.mike.yml index 40f4d91..dc95d28 100644 --- a/.mike.yml +++ b/.mike.yml @@ -2,6 +2,7 @@ version_selector: true title_switch: true versions_file: docs/versions/versions.json versions: + - 3.1.0 - 3.0.2 - 3.0.0 - 2.10.0 @@ -28,4 +29,4 @@ versions: - 0.0.1 - latest aliases: - latest: 3.0.2 + latest: 3.1.0 diff --git a/CHANGELOG.md b/CHANGELOG.md index 13bb978..7581044 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,24 @@ Release Notes ___ +The parity release: agent feature surface locked across all four language ports (v3.1.0) +------------------------------------------------------------------------------------------ + +### About this release + +- **This is the parity release for the Guard agent family.** The 3.1.0 wave (Python, TypeScript, Go, PHP, Rust) ships the same feature surface in every port. Note: the earlier 4.1.0 family tags were a version-accuracy error and were yanked/unpublished; 3.1.0 is the correct version for this train. +- The conformance corpus (219 cases, spec 4.1.0) validates the shared surface across the ports. + +### Added (3.0.2 -> 3.1.0 feature list) + +- **AES-256-GCM encrypted ingest.** Event batches can be encrypted end to end with an AES-256-GCM key; the server decrypts after transport-level TLS, so batch contents are opaque to intermediaries even on the wire. +- **Sensitive-header redaction.** Authorization, Cookie, Set-Cookie, and other configured sensitive headers are redacted at ingest and again at egress, so secrets never leave the process in plaintext form. +- **Dynamic rules.** The agent polls the guard-core server for dynamic rate-limit and ban rules on a configurable interval and enforces them locally, emitting `dynamic_rule_applied`, `dynamic_rule_updated`, and `dynamic_rule_violation` events. +- **Local rate limiters.** Rule-driven local rate limiting with auto-ban support, usable without a Redis round trip on every event. +- **Helpers.** Shared helpers for event construction, batching, and redaction are exported for adapter authors building custom ingest paths. + +___ + v3.0.2 (2026-09-23) ------------------- diff --git a/docs/release-notes.md b/docs/release-notes.md index a6507c9..a76c3bf 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -3,6 +3,24 @@ Release Notes ___ +The parity release: agent feature surface locked across all four language ports (v3.1.0) +------------------------------------------------------------------------------------------ + +### About this release + +- **This is the parity release for the Guard agent family.** The 3.1.0 wave (Python, TypeScript, Go, PHP, Rust) ships the same feature surface in every port. Note: the earlier 4.1.0 family tags were a version-accuracy error and were yanked/unpublished; 3.1.0 is the correct version for this train. +- The conformance corpus (219 cases, spec 4.1.0) validates the shared surface across the ports. + +### Added (3.0.2 -> 3.1.0 feature list) + +- **AES-256-GCM encrypted ingest.** Event batches can be encrypted end to end with an AES-256-GCM key; the server decrypts after transport-level TLS, so batch contents are opaque to intermediaries even on the wire. +- **Sensitive-header redaction.** Authorization, Cookie, Set-Cookie, and other configured sensitive headers are redacted at ingest and again at egress, so secrets never leave the process in plaintext form. +- **Dynamic rules.** The agent polls the guard-core server for dynamic rate-limit and ban rules on a configurable interval and enforces them locally, emitting `dynamic_rule_applied`, `dynamic_rule_updated`, and `dynamic_rule_violation` events. +- **Local rate limiters.** Rule-driven local rate limiting with auto-ban support, usable without a Redis round trip on every event. +- **Helpers.** Shared helpers for event construction, batching, and redaction are exported for adapter authors building custom ingest paths. + +___ + v3.0.2 (2026-09-23) ------------------- diff --git a/docs/versions/versions.json b/docs/versions/versions.json index 0727322..8eed291 100644 --- a/docs/versions/versions.json +++ b/docs/versions/versions.json @@ -1,4 +1,5 @@ { + "3.1.0": "3.1.0", "3.0.2": "3.0.2", "3.0.0": "3.0.0", "2.10.0": "2.10.0", @@ -23,5 +24,5 @@ "0.1.1": "0.1.1", "0.1.0": "0.1.0", "0.0.1": "0.0.1", - "latest": "3.0.2" + "latest": "3.1.0" } diff --git a/guard_agent/_version.py b/guard_agent/_version.py index df14905..d121b81 100644 --- a/guard_agent/_version.py +++ b/guard_agent/_version.py @@ -1,3 +1,3 @@ """Single source of truth for the package version, importable without side-effects.""" -__version__ = "3.0.2" +__version__ = "3.1.0" diff --git a/pyproject.toml b/pyproject.toml index 788cd42..16ad306 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "guard-agent" -version = "3.0.2" +version = "3.1.0" description = "Framework-agnostic telemetry and monitoring agent for the Guard security ecosystem (fastapi-guard, flaskapi-guard, djangoapi-guard, tornadoapi-guard)" authors = [ {name = "Renzo Franceschini", email = "rennf93@users.noreply.github.com"}