chore(release): 0.4.4

Prune unused WASM and relay dependencies while preserving WAF behavior.

Harden supply-chain, CI, security policy, packaging, and release metadata for v0.4.4.

Author: vicotrbb

.github/workflows/bench.yml

@@ -2,6 +2,9 @@ name: bench
 on:
   pull_request:
     paths:
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
       - 'crates/purple-wolf-core/**'
       - '.github/workflows/bench.yml'
 
@@ -15,13 +18,20 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Establish baseline from main
         run: |
+          set -euo pipefail
           git fetch origin main
-          git checkout origin/main -- crates/purple-wolf-core
-          cargo bench -p purple-wolf-core --bench pipeline -- --save-baseline main
-          git checkout HEAD -- crates/purple-wolf-core
+          baseline_dir="$RUNNER_TEMP/purple-wolf-main"
+          git worktree add --detach "$baseline_dir" origin/main
+          trap 'git worktree remove --force "$baseline_dir"' EXIT
+          (
+            cd "$baseline_dir"
+            CARGO_TARGET_DIR="$GITHUB_WORKSPACE/target" \
+              cargo bench --locked -p purple-wolf-core --bench pipeline -- \
+              --save-baseline main
+          )
       - name: Compare PR against baseline (fail >10% regression)
         run: |
-          cargo bench -p purple-wolf-core --bench pipeline -- --baseline main \
+          cargo bench --locked -p purple-wolf-core --bench pipeline -- --baseline main \
             --noise-threshold 0.10 --significance-level 0.05 2>&1 | tee bench.txt
           # criterion exits 0 even on regression; parse the report and gate.
           if grep -E 'Performance has regressed' bench.txt; then

.github/workflows/ci.yml

@@ -39,6 +39,12 @@ jobs:
         with: { components: "rustfmt,clippy" }
       - run: cargo fmt --all --check
       - run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Test core without optional TOML support
+        run: cargo test -p purple-wolf-core --lib --no-default-features
+      - name: Document core without optional TOML support
+        env:
+          RUSTDOCFLAGS: "-D warnings"
+        run: cargo doc -p purple-wolf-core --no-default-features --no-deps
 
   supply-chain:
     runs-on: ubuntu-latest
@@ -60,7 +66,7 @@ jobs:
       - name: Install wasi-sdk
         run: |
           curl -sSL https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-22/wasi-sdk-22.0-linux.tar.gz | tar xz -C /opt
-          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> $GITHUB_ENV
+          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> "$GITHUB_ENV"
       - uses: Swatinem/rust-cache@v2
       - run: cargo build -p purple-wolf-traefik --target wasm32-wasip1 --release
       - run: ls -lh target/wasm32-wasip1/release/purple_wolf_traefik.wasm
@@ -127,7 +133,7 @@ jobs:
       - name: Install wasi-sdk
         run: |
           curl -sSL https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-22/wasi-sdk-22.0-linux.tar.gz | tar xz -C /opt
-          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> $GITHUB_ENV
+          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> "$GITHUB_ENV"
       - uses: Swatinem/rust-cache@v2
       - name: Build release WASM
         run: cargo build -p purple-wolf-traefik --target wasm32-wasip1 --release
@@ -157,7 +163,7 @@ jobs:
       - name: Install wasi-sdk
         run: |
           curl -sSL https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-22/wasi-sdk-22.0-linux.tar.gz | tar xz -C /opt
-          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> $GITHUB_ENV
+          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> "$GITHUB_ENV"
       - uses: Swatinem/rust-cache@v2
       - name: Build release WASM + debug relay
         run: |

.github/workflows/publish-image-aliases.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing release tag to alias, for example v0.4.3
+        description: Existing release tag to alias, for example v0.4.4
         required: true
         type: string
 

.github/workflows/publish-images.yml

@@ -33,10 +33,10 @@ jobs:
       - name: Install wasi-sdk
         run: |
           curl -sSL https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-22/wasi-sdk-22.0-linux.tar.gz | tar xz -C /opt
-          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> $GITHUB_ENV
+          echo "WASI_SDK_PATH=/opt/wasi-sdk-22.0" >> "$GITHUB_ENV"
       - uses: Swatinem/rust-cache@v2
       - name: Build release wasm
-        run: cargo build -p purple-wolf-traefik --target wasm32-wasip1 --release
+        run: cargo build --locked -p purple-wolf-traefik --target wasm32-wasip1 --release
       - name: Stage wasm next to its Dockerfile
         run: cp target/wasm32-wasip1/release/purple_wolf_traefik.wasm crates/purple-wolf-traefik/purple_wolf_traefik.wasm
       - uses: docker/login-action@v3

.github/workflows/release.yml

@@ -56,8 +56,8 @@ jobs:
       - name: Build release WASM and relay
         run: |
           set -euo pipefail
-          cargo build -p purple-wolf-traefik --target wasm32-wasip1 --release
-          cargo build --release -p purple-wolf-relay
+          cargo build --locked -p purple-wolf-traefik --target wasm32-wasip1 --release
+          cargo build --locked --release -p purple-wolf-relay
           mkdir -p dist
           cp target/wasm32-wasip1/release/purple_wolf_traefik.wasm dist/purple_wolf_traefik.wasm
           cp target/release/purple-wolf-relay dist/purple-wolf-relay-linux-amd64
@@ -196,7 +196,7 @@ jobs:
           TARGET: ${{ matrix.target }}
         run: |
           set -euo pipefail
-          cargo build --release -p purple-wolf-relay --target "$TARGET"
+          cargo build --locked --release -p purple-wolf-relay --target "$TARGET"
           mkdir -p dist
           out="purple-wolf-relay-${TARGET}"
           cp "target/${TARGET}/release/purple-wolf-relay" "dist/${out}"

CHANGELOG.md

@@ -6,6 +6,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.4] - 2026-07-10
+
+### Security
+
+- Update `quinn-proto` to 0.11.15 in the workspace and fuzz lockfiles,
+  resolving `RUSTSEC-2026-0185`, and synchronize the fuzz lockfile with the
+  existing `anyhow` 1.0.103 fix. Replace the placeholder vulnerability-reporting
+  address with Guara Cloud's published contact, retain private GitHub Security
+  Advisories as the preferred channel, and correct the supported release line
+  and signed WASM artifact name.
+
+### Performance
+
+- Make TOML parsing a default-on `purple-wolf-core` feature and disable it for
+  the JSON-only Traefik guest, removing the TOML parser stack from WASM builds.
+  Default users retain `Config::parse`; embedders that disable default features
+  must enable `toml-config` when they need that method.
+- Avoid a heap allocation while deriving SQLi suffix probes from ordinary
+  browser User-Agent values, preserving the existing candidate order and
+  deduplication behavior.
+- Remove the relay's unused dependency on `purple-wolf-core` and compile only
+  the Tokio/Hyper features its HTTP/1 admin server and subscriber client use.
+
+### Reliability
+
+- Test and document the core crate with optional TOML support disabled in CI.
+  Build benchmark baselines from an isolated `origin/main` worktree, include
+  root manifest, lockfile, and toolchain changes in benchmark triggers, and use
+  locked graphs. Require the committed lockfile in release, dev-image, and
+  production relay-container builds.
+- Add crates.io keywords/categories for publishable packages and remove an
+  unmatched license allowance from `cargo-deny` configuration. Complete the
+  Helm chart metadata, make workflow environment-file writes shell-safe, and
+  validate the workflow set with `actionlint`.
+
 ## [0.4.3] - 2026-07-10
 
 ### Security

Cargo.lock

@@ -8,7 +8,7 @@ members = [
 exclude = ["fuzz", "tests/relay_integration", "tests/traefik_integration"]
 
 [workspace.package]
-version = "0.4.3"
+version = "0.4.4"
 edition = "2021"
 # v0.3 bumps MSRV from 1.75 to 1.88. The relay's dep tree pulls in
 # icu_* / idna (via reqwest's URL stack) which require 1.86, and
@@ -20,6 +20,8 @@ license = "MIT OR Apache-2.0"
 repository = "https://github.com/guaracloud/purple-wolf"
 homepage   = "https://github.com/guaracloud/purple-wolf"
 readme = "README.md"
+keywords = ["waf", "security", "traefik", "webassembly", "observability"]
+categories = ["web-programming", "network-programming"]
 
 [workspace.dependencies]
 serde      = { version = "1", features = ["derive"] }
@@ -29,7 +31,7 @@ percent-encoding = "2"
 # Workspace-level path+version pin for the core crate. Member
 # manifests reference this via `purple-wolf-core.workspace = true`,
 # so a `cargo release` bump propagates atomically.
-purple-wolf-core = { path = "crates/purple-wolf-core", version = "0.4.3" }
+purple-wolf-core = { path = "crates/purple-wolf-core", version = "0.4.4", default-features = false }
 
 # Size-optimised release for the WASM plugin artifact.
 [profile.release]

Cargo.toml

@@ -2,15 +2,16 @@
 
 A fast, low-memory Web Application Firewall delivered as a Traefik plugin.
 
-**Status:** v0.4.3 released. The current release includes audit labels,
+**Status:** v0.4.4 released. The current release includes audit labels,
 webhook relay delivery, signed artifacts, SBOMs, Helm OCI packaging,
 Kustomize overlays, an O(1) reputation limiter, bounded
 percent-decode-to-fixpoint normalization, an expanded signature pack,
 User-Agent SQLi suffix probing, over-cap body-prefix inspection, an offline
 config validator, relay SSRF hardening, optional relay admin auth, and new
-fuzz targets. v0.4.3 selectively optimizes the WAF engine and matcher, removes
-common http-wasm and relay-parser allocations, clamps impossible body limits,
-pins active Traefik deployments, and hardens cross-platform integration tests. See
+fuzz targets. v0.4.4 keeps WAF behavior compatible while removing the TOML
+parser from the JSON-only guest, pruning unused core and HTTP/2 code from the
+relay, eliminating a User-Agent suffix-probe allocation, and tightening CI,
+supply-chain, crate metadata, and vulnerability-reporting quality. See
 [CHANGELOG.md](CHANGELOG.md) for the full list,
 [THREAT_MODEL.md](THREAT_MODEL.md) for what the WAF is and is not designed
 to catch, and [docs/configuration.md](docs/configuration.md) for the
@@ -76,7 +77,7 @@ Install the OCI Helm chart in monitor mode:
 
 ```bash
 helm install purple-wolf oci://ghcr.io/guaracloud/charts/purple-wolf \
-  --version 0.4.3 \
+  --version 0.4.4 \
   -f charts/purple-wolf/values.monitor.yaml
 ```
 
@@ -96,7 +97,7 @@ Before production use, verify checksums, Cosign signatures, SBOMs, image
 digests, and the release manifest:
 
 ```bash
-gh release download v0.4.3 --repo guaracloud/purple-wolf --dir purple-wolf-release
+gh release download v0.4.4 --repo guaracloud/purple-wolf --dir purple-wolf-release
 ```
 
 Follow [`docs/release-verification.md`](docs/release-verification.md) and deploy

README.md

@@ -5,27 +5,30 @@
 Only the latest released `v0.x` line receives security updates during
 the v0.x stream. Older patch versions are not backported.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 0.2.x   | :white_check_mark: |
-| 0.1.x   | :x: (pre-release; superseded) |
+| Version | Supported |
+| ------- | --------- |
+| Latest 0.4.x patch | :white_check_mark: |
+| 0.3.x and earlier | :x: (superseded) |
 
 ## Reporting a vulnerability
 
 **Please do not file a public GitHub issue for a vulnerability.**
 Public issues are indexed by scanners and visible to attackers before
 maintainers can ship a fix.
 
-Use one of the following private channels instead:
+Use one of these private channels:
 
 1. **GitHub Security Advisories (preferred):**
    <https://github.com/guaracloud/purple-wolf/security/advisories/new>
-   This opens a private draft that only repo admins can see; it has
-   a built-in CVE-request workflow once a fix is ready.
+   This opens a private draft visible only to repository administrators and
+   supports coordinated disclosure and CVE requests.
+2. **Email:** **`contact@guaracloud.com`**, with a subject beginning
+   `[purple-wolf security]`. This is the contact address published on the
+   [Guara Cloud GitHub organization](https://github.com/guaracloud).
 
-2. **Email:** `security@guaracloud.example`
-   PGP fingerprint: *(to be published before v0.2.0 stable release;
-   until then prefer the GitHub Security Advisory path)*.
+The project does not currently publish a PGP key. If an email report contains
+sensitive production data, send a high-level description first and ask the
+maintainers to arrange an encrypted exchange.
 
 Please include:
 - Affected version (`cargo pkgid purple-wolf-core` or the GitHub
@@ -44,9 +47,9 @@ Please include:
   acknowledgement, as recommended by Google Project Zero. Critical
   vulnerabilities with active exploitation get an expedited path.
 
-If you don't hear back within those windows, please ping
-`security@guaracloud.example` again - the most likely cause is that
-the report was lost in transit, not ignored.
+If you don't hear back within those windows, follow up through the same private
+channel. Please do not switch to a public issue while the report is under
+embargo.
 
 ## Scope
 
@@ -95,16 +98,16 @@ fix ships, but no later than 90 days from acknowledgement".
 
 ## Cosign signature verification
 
-Every `purple-wolf.wasm` release artifact attached to a GitHub Release
+Every `purple_wolf_traefik.wasm` release artifact attached to a GitHub Release
 is cosign-keyless-signed. To verify before deployment:
 
 ```bash
 cosign verify-blob \
-  --signature purple-wolf.wasm.sig \
-  --certificate purple-wolf.wasm.pem \
+  --signature purple_wolf_traefik.wasm.sig \
+  --certificate purple_wolf_traefik.wasm.pem \
   --certificate-identity-regexp '^https://github\.com/guaracloud/purple-wolf/' \
   --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
-  purple-wolf.wasm
+  purple_wolf_traefik.wasm
 ```
 
 The release workflow also runs `cosign verify-blob` against its own