Changelog

Release notes and version history.

v1.5.5 February 14, 2026 Major Release

Security Hardening & Compliance

  • Security Fixed polynomial regex vulnerability in rule analyzers (ReDoS prevention)
  • Security Tightened Helmet middleware configuration
  • Security Improved cryptographic random number generation (crypto.randomInt)
  • Security Added method allowlist for dynamic dispatch in contract rules
  • Security Fixed incomplete string escaping in rule suggester
  • Security Sanitized user-controlled input in log format strings
  • Added OWASP ASVS Level 1 compliance badge and documentation
  • Added OpenSSF Scorecard automated security analysis
  • Added OpenSSF Best Practices Badge (Passing)
  • Added SLSA Build Level 1 provenance for npm packages
  • Added CodeQL static analysis in CI pipeline
  • Added SECURITY.md vulnerability reporting policy
  • Added CONTRIBUTING.md contribution guidelines
  • Changed Pinned all GitHub Actions dependencies to SHA hashes
  • Changed Enabled Dependabot security alerts and updates
  • Changed Updated dependencies to resolve known vulnerabilities
v1.5.4 February 2, 2026

Multi-Platform CI

  • Added Python CI pipeline: lint, type check, test, build (Python 3.10–3.12)
  • Added Java CI pipeline: compile, test, package (JDK 17, 21)
  • Changed Updated all packages to version 1.5.4
v1.5.3 February 2, 2026 Major Release

Java/Spring Boot Support

  • Added Java/Spring Boot support via Maven Central (dev.contractshield)
  • Added @ValidateContract annotation for schema validation on endpoints
  • Added @CELExpression repeatable annotation for business rules
  • Added Spring Boot auto-configuration with application.yml
  • Added contractshield-spring-boot-starter-test for test utilities
  • Changed Improved monorepo structure for multi-platform support
v1.5.2 January 31, 2026 Major Release

Python Support

  • Added Python/FastAPI support via pip install contractshield
  • Added Flask middleware via pip install contractshield[flask]
  • Added PyPI publication workflow with automatic Pro obfuscation
  • Changed Updated licensing structure
  • Security Pro modules now properly obfuscated before npm/PyPI publication
v1.5.0 January 19, 2026 Major Release Pro

Learning Mode

  • Added Learning Mode - observe API traffic and auto-generate security rules
  • Added Fixed-rate sampling with configurable rate (default 10%)
  • Added Automatic sensitive data redaction (passwords, tokens, credit cards)
  • Added Schema inference from observed traffic
  • Added Invariant discovery (tenant binding, format patterns)
  • Added Vulnerability pattern detection in collected samples
  • Added CLI commands: status, analyze, suggest, clear, purge
v1.2.0 January 19, 2026

License System

  • Added LemonSqueezy online license validation
  • Added 24-hour license cache with secure storage
  • Added Graceful degradation to OSS mode on network failure
  • Added Instance activation tracking and limit enforcement
  • Added Feature gating: gateFeature(), checkFeature()
v1.1.0 January 17, 2026

Hot Reload & Performance

  • Added Policy hot-reload with file watching
  • Added Unix socket support for sidecar (~0.1ms latency)
  • Added @cshield/client SDK with LRU cache
  • Added Enhanced health checks with /live and /ready probes
  • Added Prometheus metrics (decisions, latency, cache hits)
  • Improved Sidecar latency reduced from ~5ms to ~0.1ms
v1.0.0 January 17, 2026 Major Release Pro

Production Ready

  • Added Sink-aware RASP protection (Pro)
  • Added Command execution protection (exec, spawn, etc.)
  • Added Filesystem protection (path traversal, sensitive paths)
  • Added SSRF prevention (private IPs, cloud metadata)
  • Added Request context tracking with AsyncLocalStorage
  • Added Monitor and enforce operation modes
v0.3.1 January 17, 2026

Open Core Licensing

  • Added Apache 2.0 license for open source packages
  • Added @cshield/license package for offline verification
  • Added License generator tool for Pro/Enterprise keys
  • Added Commercial license structure for Pro features
v0.3.0 January 17, 2026

Webhooks & Multi-Framework

  • Added Generic webhook plugin system
  • Added Built-in plugins: Stripe, GitHub, Slack, Twilio
  • Added Fastify adapter (@cshield/pep-fastify)
  • Added Redis replay store for production
  • Added Sidecar server for language-agnostic deployment
  • Added Docker and Kubernetes support
v0.2.0 January 17, 2026

Vulnerability Checks

  • Added Prototype pollution detection
  • Added Path traversal protection
  • Added SSRF detection (internal IPs, metadata endpoints)
  • Added NoSQL injection detection (opt-in)
  • Added Command injection detection (opt-in)
  • Added Per-route vulnerability overrides
v0.1.0 January 14, 2026

Initial Release

  • Added PDP (Policy Decision Point) implementation
  • Added JSON Schema contract validation
  • Added CEL invariants for business rules
  • Added Stripe webhook signature verification
  • Added Express adapter (@cshield/pep-express)

Stay updated

Watch the GitHub repository to get notified of new releases.

Watch on GitHub