🚀 release: v1.4.0-rc.1 — remote TLS upstreams, swarm/SecurityOpt confinement rails, 3 presets#106

Merged

scttbnsn merged 42 commits into

mainfrom

Jun 16, 2026

Commits on Jun 11, 2026

✨ feat(filter): evaluate SecurityOpt label= and systempaths= policies
scttbnsn
committed
✨ feat(filter): swarm seccomp/AppArmor confinement mode rails
scttbnsn
committed
🐛 fix(metrics): clear per-profile in-flight gauges on profile removal
scttbnsn
committed
⚡ perf(ratelimit): allocation-free packed token-bucket state
scttbnsn
committed
🧪 test(ratelimit): correct benchmark sentinels for the packed-bucket ceiling
scttbnsn
committed
📝 docs: document the v1.4 roadmap batch — SELinux/systempaths, swarm confinement modes, gauge cleanup, packed bucket
scttbnsn
committed
🔧 chore(ci): run the full verify suite on PRs targeting dev/* release branches
scttbnsn
committed
Merge pull request #93 from CodesWhat/feat/v1.4-roadmap-batch
scttbnsn
authored
🔄 refactor(release): merge main (1.3.0-rc.3 changelog) into dev/v1.4
scttbnsn
committed
📦 deps: bump github.com/sigstore/sigstore-go

dependabot[bot]
authored and
scttbnsn
committed
📦 deps: bump github/codeql-action

dependabot[bot]
authored and
scttbnsn
committed
📦 deps: bump the npm-minor group across 1 directory with 7 updates

dependabot[bot]
authored and
scttbnsn
committed
📦 deps: dedupe package-lock.json after the npm-minor bump
scttbnsn
committed
🔒 security(deps): resolve postcss XSS advisory via override spec fix + lockfile regen
scttbnsn
committed
🔒 security(deps): mirror the postcss override into workspace manifests for standalone resolvers
scttbnsn
committed
🔧 chore(security): ignore SNYK-JS-POSTCSS-16189065 via .snyk policy (never installed)
scttbnsn
committed
Merge pull request #95 from CodesWhat/deps/batch-v1.4
scttbnsn
authored
🔄 refactor(release): merge main (v1.3.0 final) into dev/v1.4
scttbnsn
committed

Commits on Jun 13, 2026

Commits on Jun 16, 2026