@@ -7,7 +7,7 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
77minor versions may still change configuration shape, feature names, and runtime
88behavior when the change improves security or project direction.
99
10- ## 1.7.1 - Unreleased
10+ ## 1.7.1 - 2026-07-04
1111
1212### Added
1313
@@ -16,6 +16,25 @@ behavior when the change improves security or project direction.
1616- Add config fixtures that accept valid plugin declarations and reject unknown
1717 plugin references, attachment phase mismatches, unsafe ` fail_open ` security
1818 decisions, disabled registries, and invalid execution admission budgets.
19+ - Add deterministic Wasm attachment priorities and process-wide, per-plugin,
20+ and per-attachment execution admission ceilings.
21+ - Wire live native HTTP/1 ` access-decision ` Wasm hooks with ` first-deny-wins `
22+ composition, fail-closed execution behavior, and non-overridable built-in
23+ ACL decisions.
24+ - Add Wasm status and low-cardinality metrics coverage for execution limits,
25+ invocations, duration, and admission rejections.
26+
27+ ### Changed
28+
29+ - Compile live Wasm modules once at native hook-registry construction time,
30+ then instantiate isolated stores per request.
31+ - Classify Wasm registry, attachment, limit, and admission changes as
32+ ` wasm-runtime-changed ` reload-impact changes until atomic compiled-module
33+ hot reload is implemented.
34+ - Update Docker GitHub Action pins, Prometheus smoke coverage to ` v3.13.0 ` ,
35+ and ` base64-ng ` to ` 1.3.5 ` .
36+ - Document the 1.7.1 Wasm/config modularity exceptions with explicit split
37+ targets for the follow-up 1.7 cleanup work.
1938
2039## 1.7.0 - 2026-07-03
2140
0 commit comments