From 97669a376750c73ac24095772e7e1218431d7625 Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 15 Oct 2026 12:54:22 +0200 Subject: [PATCH 1/2] release(4.4.0): Engine routing parity with fastapi-guard --- .mike.yml | 3 ++- CHANGELOG.md | 16 ++++++++++++++++ docs/index.md | 2 +- docs/release-notes.md | 16 ++++++++++++++++ docs/versions/versions.json | 3 ++- pyproject.toml | 2 +- 6 files changed, 38 insertions(+), 4 deletions(-) diff --git a/.mike.yml b/.mike.yml index ef92280..858cbda 100644 --- a/.mike.yml +++ b/.mike.yml @@ -2,6 +2,7 @@ version_selector: true title_switch: true versions_file: docs/versions/versions.json versions: + - 4.4.0 - 4.3.3 - 4.3.2 - 4.3.1 @@ -20,4 +21,4 @@ versions: - 0.1.0 - latest aliases: - latest: 4.3.3 + latest: 4.4.0 diff --git a/CHANGELOG.md b/CHANGELOG.md index bde571e..ca991f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,22 @@ Changelog ___ +v4.4.0 (2026-10-15) +------------------- + +Engine routing parity with fastapi-guard (v4.4.0) +------------------------------------------------- + +- **Changed** - Passthrough, the route all-checks bypass and the response pass now go through the guard-core engine like fastapi-guard (#40, closes #39). Passthrough uses the engine `BypassHandler.handle_passthrough`, and `@security.bypass_all()` routes use `handle_security_bypass`, which calls the real view and applies the response modifier. Excluded paths stay scoped: the checks that apply to them still run instead of being skipped. +- **Changed (behavior)** - A request with no client address is now answered with `403` under the default `fail_secure=True`. It used to skip the security pipeline and reach the view. If you depend on the old pass-through, set `fail_secure=False` in `SecurityConfig`. +- **Fixed** - Blocked, preflight and bypass responses no longer emit request metrics and no longer get the pass-through response pass. `_after_request` runs the engine response pass only for responses that came out of the view. +- **Fixed** - Global behavioral return rules (`global_behavior_rules`) are now passed to the engine response pass, so they run. +- **Added (tests)** - `tests/test_engine_parity.py` drives the extension with the Flask test client against the real engine handlers. The test that asserted the old no-client-address pass-through now asserts the `403`. +- **Compatibility** - The `guard-core` floor stays at `>=4.1.0`. The detection and dynamic rule fixes in guard-core 4.4.0 reach this adapter by upgrading guard-core (for example `pip install -U guard-core`), with no change to this package. No public API of this adapter changed. +- **Chore** - The sponsor button points at the maintainer's Sponsors page, the mkdocs `site_url` drops `/latest/` so canonical URLs resolve, the README markdown lint errors that blocked the docs deploy are fixed and the README was brought to content parity (#32, #35, #37, #38), a CODEOWNERS file was added and the family Discord relay workflow was added (#31, #33). + +___ + v4.3.3 (2026-10-08) ------------------- diff --git a/docs/index.md b/docs/index.md index f48698f..e0b6097 100644 --- a/docs/index.md +++ b/docs/index.md @@ -106,7 +106,7 @@ You can also download the example app as a Docker container from [GitHub Contain docker pull ghcr.io/guard-core/flaskapi-guard-example:latest # Or pull a specific version (matches library releases) -docker pull ghcr.io/guard-core/flaskapi-guard-example:v4.3.3 +docker pull ghcr.io/guard-core/flaskapi-guard-example:v4.4.0 ``` ___ diff --git a/docs/release-notes.md b/docs/release-notes.md index 48ae82f..67e2b79 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -3,6 +3,22 @@ Release Notes ___ +v4.4.0 (2026-10-15) +------------------- + +Engine routing parity with fastapi-guard (v4.4.0) +------------------------------------------------- + +- **Changed** - Passthrough, the route all-checks bypass and the response pass now go through the guard-core engine like fastapi-guard (#40, closes #39). Passthrough uses the engine `BypassHandler.handle_passthrough`, and `@security.bypass_all()` routes use `handle_security_bypass`, which calls the real view and applies the response modifier. Excluded paths stay scoped: the checks that apply to them still run instead of being skipped. +- **Changed (behavior)** - A request with no client address is now answered with `403` under the default `fail_secure=True`. It used to skip the security pipeline and reach the view. If you depend on the old pass-through, set `fail_secure=False` in `SecurityConfig`. +- **Fixed** - Blocked, preflight and bypass responses no longer emit request metrics and no longer get the pass-through response pass. `_after_request` runs the engine response pass only for responses that came out of the view. +- **Fixed** - Global behavioral return rules (`global_behavior_rules`) are now passed to the engine response pass, so they run. +- **Added (tests)** - `tests/test_engine_parity.py` drives the extension with the Flask test client against the real engine handlers. The test that asserted the old no-client-address pass-through now asserts the `403`. +- **Compatibility** - The `guard-core` floor stays at `>=4.1.0`. The detection and dynamic rule fixes in guard-core 4.4.0 reach this adapter by upgrading guard-core (for example `pip install -U guard-core`), with no change to this package. No public API of this adapter changed. +- **Chore** - The sponsor button points at the maintainer's Sponsors page, the mkdocs `site_url` drops `/latest/` so canonical URLs resolve, the README markdown lint errors that blocked the docs deploy are fixed and the README was brought to content parity (#32, #35, #37, #38), a CODEOWNERS file was added and the family Discord relay workflow was added (#31, #33). + +___ + v4.3.3 (2026-10-08) ------------------- diff --git a/docs/versions/versions.json b/docs/versions/versions.json index b2637fa..831c6cd 100644 --- a/docs/versions/versions.json +++ b/docs/versions/versions.json @@ -1,4 +1,5 @@ { + "4.4.0": "4.4.0", "4.3.3": "4.3.3", "4.3.2": "4.3.2", "4.3.1": "4.3.1", @@ -15,5 +16,5 @@ "1.1.0": "1.1.0", "1.0.0": "1.0.0", "0.1.0": "0.1.0", - "latest": "4.3.3" + "latest": "4.4.0" } diff --git a/pyproject.toml b/pyproject.toml index 7b86510..5704a52 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "flaskapi_guard" -version = "4.3.3" +version = "4.4.0" description = "A security library for Flask to control IPs, log requests, and detect penetration attempts." authors = [ {name = "Renzo Franceschini", email = "rennf93@guard-core.com"} From c4893091e71e783eaa6e5d97bd08784a1d0ec908 Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 15 Oct 2026 14:32:19 +0200 Subject: [PATCH 2/2] build(deps): require guard-core>=4.4.0 guard-core 4.4.0 is on PyPI, so the floor moves up and upgrading this adapter brings the engine fixes. The release notes say so instead of asking users to upgrade guard-core separately. --- CHANGELOG.md | 2 +- docs/release-notes.md | 2 +- pyproject.toml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ca991f7..4daed39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,7 @@ Engine routing parity with fastapi-guard (v4.4.0) - **Fixed** - Blocked, preflight and bypass responses no longer emit request metrics and no longer get the pass-through response pass. `_after_request` runs the engine response pass only for responses that came out of the view. - **Fixed** - Global behavioral return rules (`global_behavior_rules`) are now passed to the engine response pass, so they run. - **Added (tests)** - `tests/test_engine_parity.py` drives the extension with the Flask test client against the real engine handlers. The test that asserted the old no-client-address pass-through now asserts the `403`. -- **Compatibility** - The `guard-core` floor stays at `>=4.1.0`. The detection and dynamic rule fixes in guard-core 4.4.0 reach this adapter by upgrading guard-core (for example `pip install -U guard-core`), with no change to this package. No public API of this adapter changed. +- **Compatibility** - The `guard-core` floor rises from `>=4.1.0` to `>=4.4.0`, so upgrading flaskapi-guard also brings the guard-core 4.4.0 detection and dynamic rule fixes (Cookie header scanned per pair, the per-request scan budget, the semantic-only header opt-out and dynamic rule versions applied over the base config). No public API of this adapter changed. - **Chore** - The sponsor button points at the maintainer's Sponsors page, the mkdocs `site_url` drops `/latest/` so canonical URLs resolve, the README markdown lint errors that blocked the docs deploy are fixed and the README was brought to content parity (#32, #35, #37, #38), a CODEOWNERS file was added and the family Discord relay workflow was added (#31, #33). ___ diff --git a/docs/release-notes.md b/docs/release-notes.md index 67e2b79..e60dda6 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -14,7 +14,7 @@ Engine routing parity with fastapi-guard (v4.4.0) - **Fixed** - Blocked, preflight and bypass responses no longer emit request metrics and no longer get the pass-through response pass. `_after_request` runs the engine response pass only for responses that came out of the view. - **Fixed** - Global behavioral return rules (`global_behavior_rules`) are now passed to the engine response pass, so they run. - **Added (tests)** - `tests/test_engine_parity.py` drives the extension with the Flask test client against the real engine handlers. The test that asserted the old no-client-address pass-through now asserts the `403`. -- **Compatibility** - The `guard-core` floor stays at `>=4.1.0`. The detection and dynamic rule fixes in guard-core 4.4.0 reach this adapter by upgrading guard-core (for example `pip install -U guard-core`), with no change to this package. No public API of this adapter changed. +- **Compatibility** - The `guard-core` floor rises from `>=4.1.0` to `>=4.4.0`, so upgrading flaskapi-guard also brings the guard-core 4.4.0 detection and dynamic rule fixes (Cookie header scanned per pair, the per-request scan budget, the semantic-only header opt-out and dynamic rule versions applied over the base config). No public API of this adapter changed. - **Chore** - The sponsor button points at the maintainer's Sponsors page, the mkdocs `site_url` drops `/latest/` so canonical URLs resolve, the README markdown lint errors that blocked the docs deploy are fixed and the README was brought to content parity (#32, #35, #37, #38), a CODEOWNERS file was added and the family Discord relay workflow was added (#31, #33). ___ diff --git a/pyproject.toml b/pyproject.toml index 5704a52..4b28ad9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -23,7 +23,7 @@ classifiers = [ ] dependencies = [ "flask", - "guard-core>=4.1.0", + "guard-core>=4.4.0", "gunicorn", "werkzeug", ]