chore(release): v1.39.0 dependency maintenance (#83)

* chore(release): prepare v1.39.0 and runtime compatibility matrix

Document the five dependency groups, SDK migration and container runtime changes. Keep package, widget, chart, security policy and Python versions synchronized. Exercise minimum and container runtime lines before publication.

* ci: validate Python requirement floors against the hash lock

Author: cport1

.github/workflows/unit-tests.yml

@@ -22,6 +22,21 @@ on:
   pull_request:
 
 jobs:
+  node:
+    name: Node (${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ['22', '24', '26']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+      - run: npm ci && npm audit --omit=dev && npm test
+        working-directory: server-node
+
   browser:
     name: Browser lifecycle and dependency audit
     runs-on: ubuntu-latest
@@ -40,16 +55,20 @@ jobs:
         working-directory: test/browser
 
   go:
-    name: Go
+    name: Go (${{ matrix.go }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go: ['1.26.8', '1.27.1']
     steps:
       - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v7
         with:
           # crypto/tls only exposes ClientHelloInfo.Extensions from 1.24, which
           # native JA4 needs. go.mod says so; keep this in step with it.
-          go-version: '1.26.8'
+          go-version: ${{ matrix.go }}
           cache-dependency-path: server-go/go.sum
 
       - name: Vet
@@ -67,20 +86,26 @@ jobs:
           govulncheck ./...
 
   python:
-    name: Python
+    name: Python (${{ matrix.python }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.12', '3.14']
     steps:
       - uses: actions/checkout@v7
 
       - uses: actions/setup-python@v7
         with:
-          python-version: '3.12'
+          python-version: ${{ matrix.python }}
           cache: pip
           cache-dependency-path: server-python/requirements.lock
 
       - name: Install dependencies
         working-directory: server-python
-        run: pip install --require-hashes -r requirements.lock
+        # Resolve both files together so a requirements-only update cannot
+        # silently leave CI exercising an incompatible older lockfile.
+        run: pip install --require-hashes -r requirements.lock -r requirements.txt
 
       # Discovery, not a loop over files: a file that stops being discoverable
       # should show up as a drop in the count rather than as silence. It used to

CHANGELOG.md

@@ -13,6 +13,32 @@ the project uses [Semantic Versioning](https://semver.org/) — with the caveat
 that pre-2.0 it has used minor bumps for behaviour changes that a stricter
 reading would call major. Read the **Breaking** entries rather than the number.
 
+## [1.39.0] — 2026-09-14
+
+### Dependencies and compatibility
+- Merge the five grouped maintenance updates: Go, Python, containers,
+  JavaScript, and GitHub Actions (#78–#82).
+- The bundled Node server now uses Express 5.2 and Redis client 6.2. Express
+  middleware consumers may continue using Express 4; the peer declaration now
+  also accepts Express 5. Node 22 remains the minimum supported runtime.
+- Upgrade Node Web Bot Auth to 0.2 and Go Web Bot Auth to 0.4.1. Migrate the
+  Node adapter to the new request-descriptor and verifier-object API. Resolve
+  keys and report verified identity from the signed dictionary member, not an
+  unrelated first member. Discovery failures remain unverified presence signals;
+  only an actual cryptographic rejection counts as forgery.
+- Keep Go's stricter signed-agent identity requirement; update its cryptographic
+  fixture and retain a regression check for missing agent identity.
+- Raise Python requirement floors to match the supported dependency baseline;
+  the existing hash lock already satisfies them. Update Playwright to 1.63.
+- Update pinned container bases to Go 1.27.1, Alpine 3.24.1, Node 26, and Python
+  3.14.7. Container runtime upgrades can affect custom images or extensions:
+  validate those before deployment. Go source builds still support 1.26.8.
+- Update GitHub Actions and test the minimum and container runtime lines:
+  Node 22/24/26, Go 1.26.8/1.27.1, and Python 3.12/3.14.
+
+Token format, admission limits, and browser verification behavior are unchanged
+from 1.38.0. Older deployments should still read [HARDENING.md](HARDENING.md).
+
 ## [1.38.0] — 2026-09-14
 
 Read [HARDENING.md](HARDENING.md) before upgrading. This release follows the

HARDENING.md

@@ -91,7 +91,10 @@ uses `requirements.lock` with mandatory hashes. Refresh the Python lock with:
 uv pip compile --python-version 3.12 --generate-hashes server-python/requirements.txt -o server-python/requirements.lock
 ```
 
-Go builds use 1.26.8, and CI runs `govulncheck`. Dependency-update automation and
+Go source builds require at least 1.26.8; the Go containers build with 1.27.1.
+The Node and Python containers use Node 26 and Python 3.14. CI covers Node
+22/24/26, Go 1.26.8/1.27.1, and Python 3.12/3.14, including `govulncheck`.
+Dependency-update automation and
 Docker provenance/SBOM generation are enabled in the repository workflows.
 
 The fast-JavaScript detector was removed from every scoring implementation and

README.md

@@ -135,7 +135,7 @@ Two options, and the tradeoff is real:
 
 <!-- CDN widget: still requires a running FCaptcha API. -->
 <script
-  src="https://cdn.jsdelivr.net/npm/@webdecoy/fcaptcha-client@1.38.0/dist/fcaptcha.min.js"
+  src="https://cdn.jsdelivr.net/npm/@webdecoy/fcaptcha-client@1.39.0/dist/fcaptcha.min.js"
   integrity="sha384-…"
   crossorigin="anonymous"></script>
 ```

SECURITY.md

@@ -81,8 +81,8 @@ is, older lines are not maintained — upgrade rather than expect a backport.
 
 | Version | Supported |
 |---------|-----------|
-| 1.38.x  | Yes       |
-| < 1.38  | No        |
+| 1.39.x  | Yes       |
+| < 1.39  | No        |
 
 ## Deployment notes that are security-relevant
 

charts/fcaptcha/Chart.yaml

@@ -4,8 +4,8 @@ description: Open source CAPTCHA with proof of work, behavioural biometrics, and
 type: application
 # Chart version moves independently of the app: a fix to a template is a chart
 # release, not an FCaptcha release.
-version: 0.1.18
-appVersion: "1.38.0"
+version: 0.1.19
+appVersion: "1.39.0"
 home: https://github.com/WebDecoy/FCaptcha
 sources:
   - https://github.com/WebDecoy/FCaptcha

client/fcaptcha.js

@@ -14,7 +14,7 @@
     // Keep in sync with server-node/package.json when cutting a release; this
     // string ships to integrators. server-node/version.test.js enforces it
     // across every file that carries the version, and lists them.
-    version: '1.38.0',
+    version: '1.39.0',
     widgets: new Map(),
     serverUrl: '',
     // Site-wide language default. Per-widget `lang` still wins; leaving both

client/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha-client",
-  "version": "1.38.0",
+  "version": "1.39.0",
   "description": "Browser widget for FCaptcha — proof of work, behavioural signals, and AI-agent detection",
   "main": "fcaptcha.js",
   "browser": "fcaptcha.js",