Changelog

All notable changes to Zentinel are documented here.

The format is based on Keep a Changelog. Zentinel uses CalVer (YY.MM_PATCH) for releases and SemVer for crate versions on crates.io. CalVer is the primary, operator-facing version. See Versioning for details.

Release Overview

CalVerCrate VersionDateHighlights
26.04_10.6.42026-04-09Numeric route priorities, host extraction fix, GLIBC fix, Gateway API conformance CI
26.03_10.5.122026-03-01March release, image optimization agent v0.2.0
26.02_50.5.112026-02-27include directive support in single-file config loading
26.02_40.4.102026-02-04Install script fix, CI workflows, Pingora fork security fix
26.02_30.4.92026-02-03First-time user smoke tests, protocol-version config, docs refresh
26.02_10.4.72026-02-02Pingora 0.7 upgrade, drop fork, major dependency sweep
26.02_00.4.52026-01-29Supply chain security: SBOM, cosign signing, SLSA provenance
26.01_110.4.52026-01-29Per-request allocation reduction in hot path
26.01_100.4.32026-01-27Security fixes, dependency updates
26.01_90.4.22026-01-21Sticky load balancing, install script UX
26.01_80.4.12026-01-21Dependency updates (prost, tonic, tungstenite, sysinfo)
26.01_70.4.02026-01-21DNS-01 ACME challenge support
26.01_60.3.12026-01-14Agent Protocol v2 connection pooling
26.01_40.3.02026-01-11Agent Protocol v2, WASM runtime
26.01_30.2.32026-01-05Bug fixes
26.01_00.2.02026-01-01First CalVer release
25.120.1.x2025-12Initial public releases

26.04_1

Date: 2026-04-09 Crate version: 0.6.4

Changed

  • Numeric route priorities — priority now accepts integers and named aliases
  • Route matcher host extraction fix — HTTP/2 and relative-URI support
  • Docker image GLIBC fix — pinned to ubuntu-22.04
  • Gateway API conformance CI restored — 42/235 baseline
  • Dependency updates: sha2 0.11, hmac 0.13, tokio 1.51, hyper 1.9, wasmtime 43

26.03_1

Date: 2026-03-01 Crate version: 0.5.12

Changed

  • Image optimization agent v0.2.0 — Content-Type header is now set correctly during response header phase (proxy commits headers before body filtering). Conversion fallback paths restore original Content-Type. Cache directory defaults to ~/.cache/zentinel/image-optimization instead of requiring root access. Fixed event name response_body → response_body_chunk in agent manifest.

26.02_5

Date: 2026-02-27 Crate version: 0.5.11

Added

  • include directive in single-file config — include "routes/*.kdl" now works directly in zentinel.kdl when loaded via Config::from_file() or zentinel --config. Previously, include directives only worked through the multi-file loader (--config-dir). Includes support glob patterns, relative path resolution, recursive expansion, and circular include detection.

Changed

  • Improved error message for include in raw KDL — When include is encountered via Config::from_kdl() (raw string parsing), the error now explains to use Config::from_file() instead of showing the generic “unknown block” message.

26.02_4

Date: 2026-02-04 Crate version: 0.4.10

Fixed

  • Install script — get_latest_version() now queries /releases and selects the first release with actual binary assets, instead of relying on /releases/latest which could point to a release without binaries (#67).
  • Release workflow — Version bump push to main now falls back to creating a PR when blocked by branch protection.
  • 16 rustdoc warnings — Fixed bare URLs, unclosed HTML tags, unresolved type references, and private module links across 10 files.
  • Clippy warnings — Resolved warnings and migrated to updated dependency APIs.
  • _build.yml header comment — Fixed misleading “Called by” reference.

Changed

  • Pingora switched to fork — All Pingora dependencies now point to raskell-io/pingora fork (rev 5847d5e) which disables the prometheus protobuf default feature, removing the RUSTSEC-2024-0437 vulnerability.
  • Dependency updates:
    • cargo update — 61 packages updated to latest compatible versions
    • reqwest 0.12 → 0.13 (feature renames: rustls-tls → rustls, query now opt-in)
    • jsonschema 0.40 → 0.41 (performance improvements)
    • bytes 1.9 → 1.11.1 (integer overflow fix)

Added

  • CI workflow (.github/workflows/ci.yml) — Formatting, clippy, tests, and docs checks on PRs and pushes to main.
  • Weekly audit workflow (.github/workflows/audit.yml) — Runs cargo audit weekly, creates/updates GitHub issues on vulnerabilities.
  • Cargo audit ignore list (.cargo/audit.toml) — Documented ignores for upstream-only advisories (daemonize, derivative, fxhash, rustls-pemfile).
  • Branch protection — Required status checks (Formatting, Clippy, Tests, Documentation) on main.

26.02_3

Date: 2026-02-03 Crate version: 0.4.9

Added

  • First-time user smoke tests — Self-contained integration tests (test_first_time_waf.sh, test_first_time_lua.sh) that validate building Zentinel + an agent from source, wiring them together, and verifying end-to-end behavior. WAF test covers 8 scenarios (SQLi, XSS, path traversal, fail-open, recovery); Lua test covers 4 (header injection, blocking, fail-open).
  • protocol-version KDL config — Agent blocks now accept protocol-version "v2" to explicitly select Protocol v2 for gRPC agents, instead of always defaulting to v1.
  • Makefile targets — test-first-time, test-first-time-waf, test-first-time-lua for running smoke tests.

Fixed

  • Example configs — All configs in config/examples/ now pass zentinel test validation.
  • Install script — Removed stale linux-arm64 block, fixed sudo fallback.

Changed

  • README — Replaced Inference Gateway section with Use Cases overview; updated feature table with caching, WebSocket, hot reload details; linked to full features page.

26.02_1

Date: 2026-02-02 Crate version: 0.4.7

Changed

  • Pingora 0.6 → 0.7 — Upgraded to upstream Pingora 0.7.0, removing the raskell-io/pingora security fork and all 16 [patch.crates-io] overrides. Zentinel now builds against upstream Pingora with zero patches.
    • ForcedInvalidationKind renamed to ForcedFreshness in cache layer
    • range_header_filter now accepts max_multipart_ranges parameter (defaults to 200)
  • Major dependency updates:
    • thiserror 1.x → 2.0
    • redis 0.27 → 1.0 (distributed rate limiting)
    • criterion 0.6 → 0.8 (benchmarking)
    • instant-acme 0.7 → 0.8 (ACME client rewritten for new builder/stream API)
    • jsonschema 0.18 → 0.40 (validation module rewritten for new API: JSONSchema → Validator, compile → draft7::new)
    • quick-xml 0.37 → 0.39 (data masking agent: unescape() → decode())
    • async-memcached 0.5 → 0.6
    • tiktoken-rs 0.6 → 0.9
    • sysinfo 0.37 → 0.38

Security

  • Resolved all three security issues previously requiring a Pingora fork:
    • RUSTSEC-2026-0002: lru crate vulnerability (fixed in upstream Pingora 0.7)
    • atty unmaintained dependency removed (fixed in upstream Pingora 0.7)
    • protobuf uncontrolled recursion bounded (fixed in upstream Pingora 0.7)

Removed

  • [patch.crates-io] section with 16 git overrides pointing to raskell-io/pingora fork

See the blog post for a detailed writeup.

26.02_0

Date: 2026-01-29 Crate version: 0.4.5

Added

  • Supply chain security for release pipeline
    • SBOM generation in CycloneDX 1.5 and SPDX 2.3 formats via cargo-sbom
    • Binary signing with Sigstore cosign (keyless, GitHub Actions OIDC)
    • Container image signing with cosign and SBOM attestation via syft
    • SLSA v1.0 provenance via slsa-github-generator (Build Level 3)
    • Sigstore bundles (.bundle), SBOMs (.cdx.json, .spdx.json), and SLSA provenance (.intoto.jsonl) attached to every GitHub release
    • Supply chain verification commands in release notes

See Supply Chain Security for verification procedures.

26.01_11

Date: 2026-01-29 Crate version: 0.4.5

Changed

  • Performance: Reduce per-request allocations in hot path
  • Performance: Avoid cloning header modification maps per request
  • Performance: Optimize agent header map construction

26.01_10

Date: 2026-01-27 Crate version: 0.4.3

Fixed

  • Prevent single connection failure from permanently marking upstream target unhealthy
  • Update code for rand 0.9 and hickory-resolver 0.25 API changes
  • Use pingora fork to resolve remaining security vulnerabilities

Security

  • Resolve dependabot security alerts

Changed

  • Dependency updates:
    • opentelemetry_sdk 0.27 → 0.31
    • opentelemetry-otlp 0.27 → 0.31
    • hickory-resolver 0.24 → 0.25
    • rand 0.8 → 0.9
    • wasmtime 40.0 → 41.0
    • notify 6.1 → 8.2
    • validator 0.18 → 0.20
    • nix 0.29 → 0.31
    • webpki-roots 0.26 → 1.0

26.01_9

Date: 2026-01-21 Crate version: 0.4.2

Added

  • Sticky load balancing algorithm support in simulation framework

Changed

  • Improved install script user experience

26.01_8

Date: 2026-01-21 Crate version: 0.4.1

Changed

  • Dependency updates with breaking change fixes:
    • prost 0.13 → 0.14 (with tonic ecosystem upgrade to 0.14)
    • tonic 0.12 → 0.14 (TLS features renamed: tls → tls-ring, tls-roots → tls-native-roots)
    • tungstenite 0.24 → 0.28 (Message::Text now uses Utf8Bytes)
    • sysinfo 0.31 → 0.37 (RefreshKind::new() → RefreshKind::nothing())
    • toml 0.8 → 0.9
    • brotli 7.0 → 8.0
    • directories 5.0 → 6.0
    • signal-hook 0.3 → 0.4
    • jsonschema 0.17 → 0.18
    • ip2location 0.5 → 0.6
    • tokio-tungstenite 0.24 → 0.28
  • GitHub Actions updates: checkout v6, github-script v8, docker/build-push-action v6

Fixed

  • WebSocket test compatibility with tungstenite 0.28 API changes
  • System metrics collection with sysinfo 0.37 API changes

26.01_7

Date: 2026-01-21 Crate version: 0.4.0

Added

  • DNS-01 ACME challenge support for wildcard certificate issuance
    • Modular DNS provider system with DnsProvider trait
    • Hetzner DNS provider implementation
    • Generic webhook provider for custom DNS integrations
    • DNS propagation checking with configurable nameservers
    • Secure credential loading from files or environment variables
  • New configuration options for DNS-01 challenges:
    • challenge-type option in ACME config (http-01 or dns-01)
    • dns-provider block with provider-specific settings
    • propagation block for DNS propagation check tuning
  • Integration tests for DNS providers using wiremock

Changed

  • ACME scheduler now supports both HTTP-01 and DNS-01 renewal flows
  • ACME client extended with create_order_dns01() method

26.01_6

Date: 2026-01-14 Crate version: 0.3.1

Added

  • Agent Protocol v2 with connection pooling and load balancing
  • Reverse connection support for NAT traversal
  • gRPC transport with bidirectional streaming
  • Request cancellation support
  • Prometheus metrics export for agent pools

Changed

  • Improved agent health tracking with circuit breakers
  • Better error messages for configuration validation

Fixed

  • Connection leak in agent pool under high load
  • Race condition in route matching cache

26.01_4

Date: 2026-01-11 Crate version: 0.3.0

Added

  • Initial Agent Protocol v2 implementation
  • Binary UDS transport for lower latency
  • Connection pooling with multiple strategies (RoundRobin, LeastConnections, HealthBased)
  • WASM agent runtime using Wasmtime

Changed

  • Agent protocol documentation reorganized into v1/ and v2/

26.01_3

Date: 2026-01-05 Crate version: 0.2.3

See GitHub Release.

26.01_0

Date: 2026-01-01 Crate version: 0.2.0

First release using CalVer tagging.

See GitHub Release.

25.12

Crate versions: 0.1.0 – 0.1.8 Releases: 25.12_0 through 25.12_19

Initial public release series. Core proxy, routing, upstreams, agent system, observability, and KDL configuration.

See GitHub Releases for individual release notes.