Start Fluxheim 1.7.9 and harden snapshot paths

Author: eldryoth

CHANGELOG.md

@@ -7,6 +7,17 @@ Fluxheim follows semantic versioning once `1.0.0` is released. Before `1.0.0`,
 minor versions may still change configuration shape, feature names, and runtime
 behavior when the change improves security or project direction.
 
+## 1.7.9 - Unreleased
+
+### Security
+
+- Open snapshot files with no-follow semantics before validating the opened
+  descriptor, closing the check-then-open race while preserving typed unsafe
+  path rejection.
+- Route snapshot corruption fixtures through the atomic store writer and
+  descriptor-based permission changes so security tests do not normalize raw
+  path mutation patterns.
+
 ## 1.7.8 - 2026-07-11
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"

Cargo.toml

@@ -137,7 +137,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | GeoIP/Geo-Context policy | ✅ | `1.4.5`; optional bounded local MMDB support with trusted-file enforcement for MaxMind GeoIP2/GeoLite2 and CIRCL Geo Open datasets, plus vhost/route country and ASN ACLs. The [GeoIP guide](docs/geoip.md) includes a pinned real CIRCL database proof for static, proxy, and load-balancer paths. |
 | Pingora-free runtime | ✅ | `1.6.34`; normal Fluxheim builds no longer compile Pingora crates. Server/listener/TLS, HTTP/1, HTTP/2, WebSocket, cache, load-balancer, admin, metrics, stream, and background-service paths run through Fluxheim-owned Rust crates. |
 | HTTP/3/QUIC | ❌ | Planned as a Fluxheim-owned `1.9` protocol milestone using the Rust `quinn`/`h3` stack after the `1.8` macOS/Windows production parity line. |
-| WASM extensibility | 🧪 | Active `1.7.x` line. `1.7.0` added the optional `wasm` feature, strict plugin-file loading, bounded Wasmtime execution, and real-Wasm smoke coverage. `1.7.1` adds config-level plugin registry validation, deterministic attachment ordering, admission limits, metrics, and live native HTTP/1 access-decision hooks. `1.7.2` adds bounded native HTTP/1 request/response header hooks. `1.7.3` starts bounded native HTTP/1 route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. `1.7.4` starts VCL-like cache-policy hooks with bounded cache-lookup and cache-store decisions for continue/pass/bypass/skip-store/deny around cache lookup and storage. `1.7.5` adds bounded symbolic cache-key component hooks for low-cardinality cache variants plus fixed-ID cache-store TTL/tag/header metadata, symbolic content-type inspection, and a checked-in cache-policy example. `1.7.6` starts mature-runtime hardening with explicit compiled-module identities that isolate module reuse by plugin digest, ABI version, native feature surface, and Fluxheim version. `1.7.7` adds the opt-in `wasm-proxy-abi` compatibility preview boundary. `1.7.8` starts an opt-in WASI Preview 1 boundary with explicit clock/randomness grants and fail-closed import filtering. Direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer store policy hooks remain staged for later `1.7.x`. |
+| WASM extensibility | 🧪 | Active `1.7.x` line. `1.7.0` added the optional `wasm` feature, strict plugin-file loading, bounded Wasmtime execution, and real-Wasm smoke coverage. `1.7.1` adds config-level plugin registry validation, deterministic attachment ordering, admission limits, metrics, and live native HTTP/1 access-decision hooks. `1.7.2` adds bounded native HTTP/1 request/response header hooks. `1.7.3` starts bounded native HTTP/1 route-decision hooks with configured canary and mirror branch selection, including selected native load-balanced and persistent routes. `1.7.4` starts VCL-like cache-policy hooks with bounded cache-lookup and cache-store decisions for continue/pass/bypass/skip-store/deny around cache lookup and storage. `1.7.5` adds bounded symbolic cache-key component hooks for low-cardinality cache variants plus fixed-ID cache-store TTL/tag/header metadata, symbolic content-type inspection, and a checked-in cache-policy example. `1.7.6` starts mature-runtime hardening with explicit compiled-module identities that isolate module reuse by plugin digest, ABI version, native feature surface, and Fluxheim version. `1.7.7` adds the opt-in `wasm-proxy-abi` compatibility preview boundary. `1.7.8` starts an opt-in WASI Preview 1 boundary with explicit clock/randomness grants and fail-closed import filtering. `1.7.9` is the documentation and runnable-example parity line for F5 iRules-style, nginx Lua/OpenResty-style, HAProxy Lua/SPOE-style, and VCL-like policy migrations. Direct backend choice, plugin-provided persistence keys, and dynamic mirror/shadow target choice remain constrained follow-up work. |
 
 See [Production Readiness](docs/production-readiness.md) for the precise
 stable-core promise and deployment checks. See
@@ -258,7 +258,7 @@ Individual module features:
 | `php-fpm` | No | PHP-FPM FastCGI bridge for WordPress-style PHP applications. Implies `proxy` and `web`; not included in default/focused images. |
 | `privacy-mode` | No | Zero-retention static/proxy build profile. |
 | `security` | Yes | Compile-time security profile marker plus release hardening checks. Runtime enforcement lives in the concrete config, TLS, filesystem, admin, and request-handling modules. |
-| `wasm` | No | Optional `1.7.x` WebAssembly policy runtime. `1.7.8` supports live native HTTP/1 access-decision hooks, bounded request/response header hooks, constrained route-decision hooks, cache-policy hooks, isolated compiled-module identities, the opt-in proxy-ABI preview, and an opt-in WASI Preview 1 capability boundary. Later `1.7.x` releases add direct backend choice, plugin-provided persistence keys, dynamic mirror/shadow target choice, and richer store policy hooks. |
+| `wasm` | No | Optional `1.7.x` WebAssembly policy runtime. `1.7.9` packages the existing typed hooks as documented, runnable migration examples while retaining isolated compiled-module identities, the opt-in proxy-ABI preview, and the opt-in WASI Preview 1 boundary. Later `1.7.x` work retains constrained follow-ups such as direct backend choice, plugin-provided persistence keys, and dynamic mirror/shadow target choice. |
 | `wasm-proxy-abi` | No | Opt-in compatibility preview for a reviewed safe subset of proxy-oriented Wasm ABI calls. Depends on `wasm`, remains off by default, requires `allow_preview_abi = true`, and rejects unsupported preview calls deterministically. |
 | `wasm-wasi` | No | Opt-in WASI Preview 1 access-decision capability boundary. Depends on `wasm`; clocks and randomness require separate explicit grants. Environment, arguments, inherited stdio, filesystem, sockets/network, and process state remain unavailable. |
 | `tls` | No | Internal TLS marker used by TLS/ACME code; select a concrete backend for serving. |
@@ -351,8 +351,8 @@ Release tags use the same profile/OS suffixes on both registries. The first
 `1.7.x` image tags include `v1.7.0-wolfi`, `v1.7.0-cache-wolfi`,
 `v1.7.0-proxy-wolfi`, `v1.7.0-load-balancer-wolfi`, and `v1.7.0-php-wolfi`;
 follow-up `1.7.x` releases use the same suffix pattern, for example
-`v1.7.8-wolfi`, `v1.7.8-cache-wolfi`, `v1.7.8-proxy-wolfi`,
-`v1.7.8-load-balancer-wolfi`, and `v1.7.8-php-wolfi`.
+`v1.7.9-wolfi`, `v1.7.9-cache-wolfi`, `v1.7.9-proxy-wolfi`,
+`v1.7.9-load-balancer-wolfi`, and `v1.7.9-php-wolfi`.
 
 Release note for `1.5.15`: the signed git tag `v1.5.15` is the canonical code
 tag. The GitHub Release page is published under `v1.5.15-release` because the

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-acme"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"

crates/fluxheim-acme/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-cache"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"

crates/fluxheim-cache/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-common"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"

crates/fluxheim-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-compression"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"

crates/fluxheim-compression/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-config"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"

crates/fluxheim-config/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-geoip"
-version = "1.7.8"
+version = "1.7.9"
 edition = "2024"
 rust-version = "1.97.0"
 license = "EUPL-1.2"