release(4.4.0): Engine routing parity with fastapi-guard

.mike.yml

@@ -2,6 +2,7 @@ version_selector: true
 title_switch: true
 versions_file: docs/versions/versions.json
 versions:
+  - 4.4.0
   - 4.3.3
   - 4.3.2
   - 4.3.1
@@ -20,4 +21,4 @@ versions:
   - 0.1.0
   - latest
 aliases:
-  latest: 4.3.3
+  latest: 4.4.0

CHANGELOG.md

@@ -3,6 +3,22 @@ Changelog
 
 ___
 
+v4.4.0 (2026-10-15)
+-------------------
+
+Engine routing parity with fastapi-guard (v4.4.0)
+-------------------------------------------------
+
+- **Changed** - Passthrough, the route all-checks bypass and the response pass now go through the guard-core engine like fastapi-guard (#40, closes #39). Passthrough uses the engine `BypassHandler.handle_passthrough`, and `@security.bypass_all()` routes use `handle_security_bypass`, which calls the real view and applies the response modifier. Excluded paths stay scoped: the checks that apply to them still run instead of being skipped.
+- **Changed (behavior)** - A request with no client address is now answered with `403` under the default `fail_secure=True`. It used to skip the security pipeline and reach the view. If you depend on the old pass-through, set `fail_secure=False` in `SecurityConfig`.
+- **Fixed** - Blocked, preflight and bypass responses no longer emit request metrics and no longer get the pass-through response pass. `_after_request` runs the engine response pass only for responses that came out of the view.
+- **Fixed** - Global behavioral return rules (`global_behavior_rules`) are now passed to the engine response pass, so they run.
+- **Added (tests)** - `tests/test_engine_parity.py` drives the extension with the Flask test client against the real engine handlers. The test that asserted the old no-client-address pass-through now asserts the `403`.
+- **Compatibility** - The `guard-core` floor rises from `>=4.1.0` to `>=4.4.0`, so upgrading flaskapi-guard also brings the guard-core 4.4.0 detection and dynamic rule fixes (Cookie header scanned per pair, the per-request scan budget, the semantic-only header opt-out and dynamic rule versions applied over the base config). No public API of this adapter changed.
+- **Chore** - The sponsor button points at the maintainer's Sponsors page, the mkdocs `site_url` drops `/latest/` so canonical URLs resolve, the README markdown lint errors that blocked the docs deploy are fixed and the README was brought to content parity (#32, #35, #37, #38), a CODEOWNERS file was added and the family Discord relay workflow was added (#31, #33).
+
+___
+
 v4.3.3 (2026-10-08)
 -------------------
 

docs/index.md

@@ -106,7 +106,7 @@ You can also download the example app as a Docker container from [GitHub Contain
 docker pull ghcr.io/guard-core/flaskapi-guard-example:latest
 
 # Or pull a specific version (matches library releases)
-docker pull ghcr.io/guard-core/flaskapi-guard-example:v4.3.3
+docker pull ghcr.io/guard-core/flaskapi-guard-example:v4.4.0
 ```
 
 ___

docs/release-notes.md

@@ -3,6 +3,22 @@ Release Notes
 
 ___
 
+v4.4.0 (2026-10-15)
+-------------------
+
+Engine routing parity with fastapi-guard (v4.4.0)
+-------------------------------------------------
+
+- **Changed** - Passthrough, the route all-checks bypass and the response pass now go through the guard-core engine like fastapi-guard (#40, closes #39). Passthrough uses the engine `BypassHandler.handle_passthrough`, and `@security.bypass_all()` routes use `handle_security_bypass`, which calls the real view and applies the response modifier. Excluded paths stay scoped: the checks that apply to them still run instead of being skipped.
+- **Changed (behavior)** - A request with no client address is now answered with `403` under the default `fail_secure=True`. It used to skip the security pipeline and reach the view. If you depend on the old pass-through, set `fail_secure=False` in `SecurityConfig`.
+- **Fixed** - Blocked, preflight and bypass responses no longer emit request metrics and no longer get the pass-through response pass. `_after_request` runs the engine response pass only for responses that came out of the view.
+- **Fixed** - Global behavioral return rules (`global_behavior_rules`) are now passed to the engine response pass, so they run.
+- **Added (tests)** - `tests/test_engine_parity.py` drives the extension with the Flask test client against the real engine handlers. The test that asserted the old no-client-address pass-through now asserts the `403`.
+- **Compatibility** - The `guard-core` floor rises from `>=4.1.0` to `>=4.4.0`, so upgrading flaskapi-guard also brings the guard-core 4.4.0 detection and dynamic rule fixes (Cookie header scanned per pair, the per-request scan budget, the semantic-only header opt-out and dynamic rule versions applied over the base config). No public API of this adapter changed.
+- **Chore** - The sponsor button points at the maintainer's Sponsors page, the mkdocs `site_url` drops `/latest/` so canonical URLs resolve, the README markdown lint errors that blocked the docs deploy are fixed and the README was brought to content parity (#32, #35, #37, #38), a CODEOWNERS file was added and the family Discord relay workflow was added (#31, #33).
+
+___
+
 v4.3.3 (2026-10-08)
 -------------------
 

docs/versions/versions.json

@@ -1,4 +1,5 @@
 {
+    "4.4.0": "4.4.0",
     "4.3.3": "4.3.3",
     "4.3.2": "4.3.2",
     "4.3.1": "4.3.1",
@@ -15,5 +16,5 @@
     "1.1.0": "1.1.0",
     "1.0.0": "1.0.0",
     "0.1.0": "0.1.0",
-    "latest": "4.3.3"
+    "latest": "4.4.0"
 }

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "flaskapi_guard"
-version = "4.3.3"
+version = "4.4.0"
 description = "A security library for Flask to control IPs, log requests, and detect penetration attempts."
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@guard-core.com"}
@@ -23,7 +23,7 @@ classifiers = [
 ]
 dependencies = [
     "flask",
-    "guard-core>=4.1.0",
+    "guard-core>=4.4.0",
     "gunicorn",
     "werkzeug",
 ]