v1.3.0

First release since v1.2.13 (Apr 2024). A large correctness, concurrency, and security hardening pass — 68 commits: 47 bug fixes, new backward-compatible APIs, and dependency cleanup.

⚠️ Breaking changes

• encrypt/aes (#53): now generates a random IV per encryption, returns errors instead of swallowing them, and validates padding on decrypt.
  • Migration: update call sites to handle the new error return values. The ciphertext format changed (a per-message random IV is now included), so data encrypted by earlier versions will not decrypt with this release — re-encrypt any data at rest.

✨ New APIs / features (backward-compatible)

• NewSnowflakeE — error-returning Snowflake constructor (#69)
• NewLease, NewBackendSQLDBE — error-returning distributed constructors (#71)
• NewStdLoggerWithLevel — level-filtering standard logger (#77)
• PadKeyToLength, egroup WithContext option + Shutdown, and a leftcycle option

🔒 Security

• #68 — hardened CSPRNG usage, removed insecure default keys, closed page_token prefix-forgery, and fixed format-string vulnerabilities
• #53 — AES random IV + padding validation (see Breaking changes)
• Dependency CVE audit: the 6 open Dependabot alerts (pgx/v5, grpc, x/crypto) were verified not reachable in gkit via call-graph analysis (govulncheck) + manual audit — the vulnerable code paths (server-side Postgres/gRPC, x/crypto ssh) are never exercised by gkit's client-only usage. Dismissed as not-in-execution-path; no version forced.

🐛 Notable fixes

Concurrency / lifecycle / races

• Plug scheduler/ticker/pool/signal/global lifecycle leaks (#70); close lifecycle races (#69)
• bbr: defer release, idempotent closure, ctx-aware wait (#72)
• cache: boundary OOB, Free(0) panic, pool race, local_cache TOCTOU (#73)
• controller_redis: FIFO delayed pop, surface watch errors, structured logs (#74)
• goroutine: Delegate ctx race (#65), send-on-closed-channel recover (#48)
• egroup: release wg counter on refused task (#64); correct CAS in Shutdown (#45)
• delayed: data race + blocking refresh + index panic (#30); rand_string shared source (#39)
• registry: copy-on-write matrix + start sentinel consumer + Close() send-on-closed panic (#77)

Correctness

• tools/codec: cycle-safe deepcopy, bind nil-panic, parser corruption, AES oracle (#76)
• distributed: correct locker contract + nanosecond→duration expire (#71, #54)
• log: level filter (#77), preserve With() prefix (#46), resolve Valuers (#51)
• bbr: minRT=1 on empty samples (#60), done-after-next ordering (#40)
• net/tcp, page_token, zset, sys/cpu, timeout, backend_redis TTL, and more

📦 Dependencies

• Bump gorm to v1.25.10 + drivers — removes vulnerable pgx/v4 and pgproto3/v2 (#63)
• Pin x/crypto to v0.33.0 and Go directive to 1.20 for low-version consumer compatibility (#67)

---

Full changelog: v1.2.13...v1.3.0

v1.2.13

Full Changelog: v1.2.12...v1.2.13

v1.2.12

What's Changed

• update goroutine panic wrong stack text formate. by @ShuBo6 in #16
• build(deps): bump golang.org/x/net from 0.7.0 to 0.17.0 by @dependabot in #20
• build(deps): bump golang.org/x/crypto from 0.6.0 to 0.17.0 by @dependabot in #21

New Contributors

• @dependabot made their first contribution in #20

Full Changelog: v1.2.11...v1.2.12

v1.2.11

Full Changelog: v1.2.10...v1.2.11

v1.2.10

Full Changelog: v1.2.9...v1.2.10

v1.2.9

What's Changed

• feat: page_token by @songzhibin97 in #13
• rock steadier subset by @songzhibin97 in #14
• fix: lease redis lock

Full Changelog: v1.2.8...v1.2.9

v1.2.8

What's Changed

• bugfix:func SendTaskWithContext state SetStateStarted->SetStatePending by @ShuBo6 in #11
• feat: stm struct to map
• fix: goroutine recover stack

v1.2.7

fix: ternary no impot time

v1.2.6

fix

1. fix typo
2. fix parse
3. json parser decoder

feat

1. ternary
2. rand_string
3. pointer

v1.2.5

feat: structure(import gopkg)