Prepare 1.4.7 release metadata

Author: eldryoth

CHANGELOG.md

@@ -7,7 +7,7 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
-## 1.4.7-dev - Unreleased
+## 1.4.7 - 2026-05-31
 
 ### Changed
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.4.7-dev"
+version = "1.4.7"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"

Cargo.toml

@@ -23,7 +23,7 @@
 
 Fluxheim is a modular Rust edge server built on
 [Pingora](https://github.com/cloudflare/pingora). The current stable release is
-`1.4.6`: static sites, vhosts, route-level proxying, redirects, rustls SNI,
+`1.4.7`: static sites, vhosts, route-level proxying, redirects, rustls SNI,
 managed ACME issuance and renewal, secure headers, container/native systemd
 operation, production proxy-cache controls, Prometheus/OpenTelemetry operations
 support, focused full/cache-edge/proxy-edge/PHP image profiles, opt-in PHP-FPM
@@ -37,8 +37,9 @@ origin controls, gRPC pass-through policy, proxy-operations migration blockers,
 the `1.4.2` proxy module split, the `1.4.3` config module split, Apple Silicon
 macOS Level 1 developer support, bounded GeoIP/Geo-Context policy with local
 MMDB support for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open datasets, and the
-TCP stream proxy foundation. The current `1.4.7-dev` line hardens TCP stream
-proxying.
+TCP stream proxy foundation hardened with true idle timeouts, stream upstream
+TLS/mTLS controls, weighted/drain/backup stream upstream policy, PROXY protocol
+coverage, and bounded stream write/connect behavior.
 
 Fluxheim is licensed under the European Union Public Licence 1.2.
 
@@ -235,7 +236,7 @@ Individual module features:
 | `web` | Yes | Static file resolver and static response handling. Runtime serving currently uses `proxy` sessions. |
 | `cache` | Yes | Cache module compiled in; runtime cache remains disabled until configured. |
 | `load-balancer` | No | Pingora load-balancing module and health checks. |
-| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream semantics. Depends on the shared proxy runtime in `1.4.6`; hardening continues in `1.4.7-dev`. |
+| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream semantics. Depends on the shared proxy runtime in `1.4.6`; hardened in `1.4.7` with true idle timeouts, stream upstream TLS/mTLS controls, weighted/drain/backup policy, and expanded smoke coverage. |
 | `metrics` | No | Prometheus metrics listener. |
 | `acme` | No | ACME planning/renewal support. Requires TLS config and should be paired with one TLS backend for serving. |
 | `acme-client` | No | Live ACME account/order HTTP client and background renewal service for HTTP-01 and rustls TLS-ALPN-01 certificate issuance and renewal. |

README.md

@@ -208,7 +208,7 @@ upstream_tls = false
 - `upstream_proxy_protocol` writes a HAProxy PROXY protocol header to the
   selected upstream before forwarding stream bytes. Use it only when the
   upstream explicitly expects PROXY protocol. It cannot be combined with
-  `upstream_tls` in `1.4.7-dev`; stream TLS handshakes need a dedicated
+  `upstream_tls` in `1.4.7`; stream TLS handshakes need a dedicated
   pre-TLS PROXY connector before that combination can be enabled safely.
 - `upstream_tls = true` sends TLS to the selected stream upstream.
   `upstream_sni` is optional; when unset Fluxheim derives SNI from the selected

docs/config-reference.md

@@ -44,7 +44,7 @@ before Cargo starts compiling Pingora.
 | `compression-gzip` | No | gzip response compression for eligible known-length responses. |
 | `compression-zstd` | No | Zstandard response compression for eligible known-length responses. |
 | `geoip` | No | Local MMDB Geo-Context lookup for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open datasets, exposed to bounded access policy and structured logs. |
-| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream routes, bounded connection lifetime/byte caps, and route-local PROXY protocol receive/send. Depends on the shared proxy runtime in `1.4.6`. |
+| `stream-proxy` | No | Raw L4 TCP stream proxy service with separate stream routes, bounded idle/lifetime/byte caps, route-local PROXY protocol receive/send, stream upstream TLS/mTLS controls, and weighted/drain/backup policy. Depends on the shared proxy runtime in `1.4.6`; hardened in `1.4.7`. |
 | `privacy-mode` | No | Zero-retention static/proxy build profile. |
 | `tls` | No | Internal marker for TLS-aware code; select a concrete backend for serving. |
 

docs/features.md

@@ -8,7 +8,7 @@
 
 Name:           fluxheim
 Version:        1.4.7
-Release:        0.dev%{?dist}
+Release:        1%{?dist}
 Summary:        Modular Pingora-based reverse proxy and static web server
 License:        EUPL-1.2
 URL:            https://github.com/valkyoth/fluxheim
@@ -153,8 +153,11 @@ fi
 %config(noreplace) %attr(0644,fluxheim,fluxheim) /srv/fluxheim/index.html
 
 %changelog
-* Sat May 30 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.4.7-0.dev
-- Start the 1.4.7 TCP stream hardening development line.
+* Sun May 31 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.4.7-1
+- Release 1.4.7 TCP stream hardening.
+- Add true stream idle timeouts, stream upstream TLS/mTLS controls,
+  weighted/drain/backup stream upstream policy, and expanded stream smoke
+  coverage.
 
 * Sat May 30 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.4.6-1
 - Release 1.4.6 TCP stream proxy foundation.

packaging/rpm/fluxheim.spec

@@ -1,7 +1,7 @@
 # Fluxheim 1.4.7 Release Notes
 
-Fluxheim 1.4.7 is planned as a TCP stream hardening follow-up to the 1.4.6
-stream proxy foundation.
+Fluxheim 1.4.7 is a TCP stream hardening follow-up to the 1.4.6 stream proxy
+foundation.
 
 ## Added
 
@@ -24,10 +24,6 @@ stream proxy foundation.
   deadlines, RFC 6066-safe SNI derivation, and temporary upstream mTLS
   private-key zeroization after parsing.
 
-## Planned Scope
-
-- Additional release hardening from CI, CodeQL, and pentest feedback.
-
 ## Out Of Scope
 
 - UDP proxying.