docs: record v1.3.0 security release and current installation

README.md

@@ -18,7 +18,7 @@ AWS distribution.
 Use Go 1.27.3 or newer for the current source. Lambda binaries target
 `provided.al2023`, with Linux `amd64` (`x86_64`) or `arm64`. Keep CGO disabled.
 
-The latest stable version is [v1.2.0](https://github.com/rambow-cloud/powertools-lambda-go/releases/tag/v1.2.0).
+The latest stable version is [v1.3.0](https://github.com/rambow-cloud/powertools-lambda-go/releases/tag/v1.3.0).
 This README follows `main`; the installation and minimal example below use that
 published version. See [version policy](docs/VERSION_POLICY.md) for released APIs
 versus development changes.
@@ -28,7 +28,7 @@ From a new application directory in PowerShell:
 ```powershell
 $env:CGO_ENABLED = '0'
 go mod init example.com/hello
-go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0 github.com/aws/aws-lambda-go@v1.55.0
+go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0 github.com/aws/aws-lambda-go@v1.55.0
 ```
 
 Each utility has its own module. Install the modules you use; see
@@ -112,7 +112,7 @@ The [quickstart](docs/GETTING_STARTED.md) shows repository packaging and
 ## Documentation
 
 Read the [documentation site](https://powertools-lambda-go.rambow.cloud/) or
-[Go package documentation](https://pkg.go.dev/github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0).
+[Go package documentation](https://pkg.go.dev/github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0).
 
 | Area | Guides |
 | --- | --- |

docs/APPSYNC_EVENTS.md

@@ -8,10 +8,10 @@ Handle AppSync Events publish and subscribe requests using channel routes.
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/appsyncevents@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/appsyncevents@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/APPSYNC_GRAPHQL.md

@@ -8,10 +8,10 @@ Route AppSync GraphQL resolver events to Go query, mutation and batch handlers.
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/appsyncgraphql@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/appsyncgraphql@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/BATCH.md

@@ -8,11 +8,11 @@ Process SQS, Kinesis and DynamoDB Streams records individually and return the ID
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/batch@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/batch@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/BEDROCK.md

@@ -8,10 +8,10 @@ Implement functions for a Bedrock Agent Action Group and return tool results to
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/bedrock@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/bedrock@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/CHECKLIST.md

@@ -403,6 +403,10 @@ Race-detector execution is intentionally excluded because CGO must remain disabl
 
 - [x] DOC-DISCOVERY-LOCAL: Add an all-crawler robots policy, generated canonical llms.txt index, individual user-guide descriptions, social metadata and WebSite/TechArticle JSON-LD with homepage source-repository identity. Keep static article content, canonical sitemap coverage, independent community attribution and OpenTelemetry/X-Ray migration boundaries. Verify all 87 guides and 18 crawler policies, six discovery regression guards, locked dependencies, navigation, eighteen utility-guide checks, strict site build and documentation-workflow actionlint with CGO disabled. Read-only Cloudflare inspection finds AI blocking, Bot Fight Mode and robots preference synchronization disabled with no custom firewall ruleset; no security configuration mutation is needed. Publication, live browser acceptance, search-console ownership/submission and actual search/AI indexing remain separate owner checks. See [discovery maintenance](DOCUMENTATION.md#search-engines-and-ai-discovery) (2026-10-10).
 
+- [x] SECURITY-255-V130: Require Go 1.27.3, select x/crypto v0.58.0 with patched HTTP/2/gRPC dependencies, and move Avro to the maintained codec with integer-boundary fixes and allocation caps. Verify all 31 packaged modules, 28 isolated consumers and 62 production-package scans for Linux amd64/arm64 on release commit 2df7e85986d5, with CGO disabled. Official npm audit reports zero advisories for 103 dependency entries after protobufjs v7.6.6; pip-audit reports no advisories for eleven locked documentation packages. Preserve failed-scanner diagnostics, strict root dependency isolation and actual Avro runtime-closure checks. Record [dated security acceptance](SECURITY_ACCEPTANCE_V1_3_0.json), including scanner/database identity. This does not assess unused upstream tool packages; frozen X-Ray source is patched but excluded from publication. See #255, #256, #259 and #260; no race or AWS cloud tests (2026-10-23).
+
+- [x] RELEASE-257-V130: Publish one stable Latest v1.3.0 Release after reviewed preparation PR #261 and exact PR/main Full regression. Verify all 27 maintained tags at commit 2df7e85986d5 and all 27 fresh public proxy/checksum consumers, with GOWORK off, CGO disabled and no replacements. Publication run 39890005244 completed without a recovery or rewritten tag. Independently run public Logger v1.3.0 to verify Preview APIs, error identity, attached stacks, compact single-line JSON and opt-out; public Tracer selects x/crypto v0.58.0. Update current installation pins and Preview availability, retaining historical records; 26 guide contracts, strict site build and discovery for 122 guides/19 crawler policies pass. Record [publication acceptance](RELEASE_ACCEPTANCE_V1_3_0.json). The root internal changed-file disclosure omission remains the separate non-blocking P3 #262; source packaging is intact. Lambda runtime execution covers amd64, while arm64 is cross-built/scanned. Browser/pkg.go.dev presentation is an owner check; no new AWS cloud tests (2026-10-23).
+
 - [x] RELEASE-229-V120: Publish stable v1.2.0 from exact merged commit 6d0ee9e0e454 after preparation PR #230 and main Full regression pass. Verify all 27 maintained module tags at that commit, one stable Latest project Release and all 27 fresh public proxy/checksum consumers with CGO disabled, GOWORK off and no replacements. Resume the same reviewed plan after a GitHub HTTP 502 without changing existing tags. Record [publication acceptance](RELEASE_ACCEPTANCE_V1_2_0.json), update stable installation and compiler availability, and build the exact README application against public Logger v1.2.0 for Linux arm64. Locked dependencies, navigation, eighteen utility guides, strict site build and discovery checks passed. Preserve historical records and the frozen X-Ray exclusion. Browser/pkg.go.dev presentation and live AWS testing remain separate checks. See issues #229 and #231 (2026-10-13).
 
 - [x] RELEASE-153-V110: Publish stable v1.1.0 from exact merged commit caac78d27493 after preparation PR #154 and main Full regression pass. Verify all 27 maintained module tags at the same commit, one stable Latest project Release and all 27 fresh public proxy/checksum consumers with CGO disabled, GOWORK off and no replacements. Record [publication acceptance](RELEASE_ACCEPTANCE_V1_1_0.json), update stable installation pins and build the exact README application against public Logger v1.1.0 for Linux arm64. Preserve historical acceptance and the frozen X-Ray exclusion. Browser/pkg.go.dev presentation and live AWS testing remain separate checks. See issues #153 and #155 (2026-10-10).

docs/COMMONS.md

@@ -8,11 +8,11 @@ Shared helpers for configuration, encoding, JSON values and caches. Most applica
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 ```
 
 ## Decode Base64 text

docs/COMPATIBILITY.md

@@ -4,7 +4,7 @@ This project is an independent community **Go port of Powertools for AWS Lambda
 
 ## Supported applications
 
-- Go 1.27 or newer, with `CGO_ENABLED=0`.
+- Go 1.27.3 or newer, with `CGO_ENABLED=0`.
 - Native Lambda binaries for `provided.al2023` on Linux amd64 or arm64.
 - Independent modules: install only the utilities your application needs.
 - A unified release version for maintained modules; see [module installation](MODULES.md).

docs/DATAMASKING.md

@@ -8,11 +8,11 @@ Remove sensitive values before logging or returning a payload. Mask selected fie
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/datamasking@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/datamasking@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 ```
 
 ## Mask a customer field

docs/DATAMASKING_KMS.md

@@ -8,7 +8,7 @@ Use the optional KMS provider to encrypt and decrypt fields with the AWS Encrypt
 
 ## Encrypt and restore a customer secret
 
-Install `datamasking/kms@v1.2.0`. The fragment assumes `ctx`, a payload, and imports for `datamasking`, `os` and `maskkms` (`datamasking/kms`). It calls KMS: set `KMS_KEY_ARN` to a full key ARN, configure the AWS SDK, and grant the required data-key/decrypt permissions.
+Install `datamasking/kms@v1.3.0`. The fragment assumes `ctx`, a payload, and imports for `datamasking`, `os` and `maskkms` (`datamasking/kms`). It calls KMS: set `KMS_KEY_ARN` to a full key ARN, configure the AWS SDK, and grant the required data-key/decrypt permissions.
 
 **Input**
 

docs/GETTING_STARTED.md

@@ -9,11 +9,11 @@ Start with structured logs. This handler accepts a name, returns a greeting and
 
 ## Install
 
-Use Go 1.27 or newer and initialize your application:
+Use Go 1.27.3 or newer and initialize your application:
 
 ```sh
 go mod init example.com/hello
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0 github.com/aws/aws-lambda-go@v1.55.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0 github.com/aws/aws-lambda-go@v1.55.0
 ```
 
 ## Write the handler

docs/HTTP.md

@@ -8,11 +8,11 @@ Route API Gateway, ALB and Lambda Function URL requests with path parameters, JS
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/HTTP_MIDDLEWARE.md

@@ -9,7 +9,7 @@ Add cross-origin response headers and compress large HTTP responses. These middl
 ## Install
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http@v1.3.0
 ```
 
 Both examples include their imports and belong to the same `package main` as your

docs/HTTP_OBSERVABILITY.md

@@ -11,7 +11,7 @@ Add route metrics and OpenTelemetry spans to an existing HTTP router. Each integ
 Install the optional integration:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http/metrics@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http/metrics@v1.3.0
 ```
 
 Save the following as `http_metrics.go` in your HTTP application. In the routing
@@ -62,7 +62,7 @@ This is an excerpt of the emitted EMF document. It also contains the namespace,
 Install the optional integration:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http/tracer@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http/tracer@v1.3.0
 ```
 
 Save this as `http_tracing.go`. Create `tr` once as shown in the

docs/HTTP_STREAMING.md

@@ -8,11 +8,11 @@ Return a reader and send its content through the native Go Lambda streaming adap
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/eventhandler/http@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/IDEMPOTENCY.md

@@ -8,10 +8,10 @@ Return a stored result for repeated requests, so a retried Lambda invocation doe
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/idempotency@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/idempotency@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 CGO_ENABLED=0 go get github.com/aws/aws-sdk-go-v2/config@v1.33.4
 ```

docs/IDEMPOTENCY_CACHE.md

@@ -8,7 +8,7 @@ Use an existing Redis or Valkey deployment as the persistence store for [Idempot
 
 ## Replay a completed operation
 
-Install `idempotency/cache@v1.2.0` and import the adapter as `cache`, the Idempotency core, and `github.com/redis/go-redis/v9` as `redis`. This example requires a reachable Redis-compatible server; configure its TLS and credentials for your deployment.
+Install `idempotency/cache@v1.3.0` and import the adapter as `cache`, the Idempotency core, and `github.com/redis/go-redis/v9` as `redis`. This example requires a reachable Redis-compatible server; configure its TLS and credentials for your deployment.
 
 **Input**
 
@@ -41,7 +41,7 @@ for range 2 {
 }
 ```
 
-Also install `logger@v1.2.0` and import it as `logger`. Run this inside a function returning `error`, with a context carrying the invocation deadline. The output below shows three log excerpts, omitting standard Logger fields.
+Also install `logger@v1.3.0` and import it as `logger`. Run this inside a function returning `error`, with a context carrying the invocation deadline. The output below shows three log excerpts, omitting standard Logger fields.
 
 **Output**
 

docs/JMESPATH.md

@@ -8,11 +8,11 @@ Select and transform values in JSON documents, including JSON/Base64 data inside
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/jmespath@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/jmespath@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 ```
 
 ## Select paid order IDs

docs/JSON_SCHEMA_VALIDATION.md

@@ -8,11 +8,11 @@ Validate payloads against JSON Schema documents. Check input before your busines
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/validation@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/validation@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 ```
 
 ## Validate an order

docs/KAFKA.md

@@ -8,11 +8,11 @@ Decode key, value and header data in Lambda Kafka events, with optional Avro and
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/kafka@v1.2.0
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/kafka@v1.3.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 CGO_ENABLED=0 go get github.com/aws/aws-lambda-go@v1.55.0
 ```
 

docs/KAFKA_BINARY.md

@@ -8,7 +8,7 @@ Decode binary values with optional adapters. Your application supplies the schem
 
 ## Decode an Avro order
 
-Install `kafka/avro@v1.2.0` and `logger@v1.2.0`. Import the adapter as `kafkaavro` and Powertools Logger as `logger`. The Base64 value below encodes a record with one string field. Each snippet runs independently in a function returning `error`, with `ctx` available.
+Install `kafka/avro@v1.3.0` and `logger@v1.3.0`. Import the adapter as `kafkaavro` and Powertools Logger as `logger`. The Base64 value below encodes a record with one string field. Each snippet runs independently in a function returning `error`, with `ctx` available.
 
 **Input**
 
@@ -47,7 +47,7 @@ consumer := kafka.New(kafka.Config{Value: kafkaavro.New(schema)})
 
 ## Decode a Protobuf message
 
-Install `kafka/protobuf@v1.2.0` and import it as `kafkaproto`. This example uses the well-known `StringValue` descriptor from `wrapperspb` and `protojson` from the official Go Protobuf library. Import `encoding/json/jsontext` to attach the Protobuf JSON value to a structured log.
+Install `kafka/protobuf@v1.3.0` and import it as `kafkaproto`. This example uses the well-known `StringValue` descriptor from `wrapperspb` and `protojson` from the official Go Protobuf library. Import `encoding/json/jsontext` to attach the Protobuf JSON value to a structured log.
 
 ```go
 appLog := logger.New(logger.WithServiceName("orders"))

docs/LOGGER.md

@@ -9,10 +9,10 @@ Write JSON logs with searchable fields, service names and Lambda request context
 
 ## Install
 
-Use Go 1.27 or newer:
+Use Go 1.27.3 or newer:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.2.0
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 ```
 
 ## Write your first log
@@ -89,24 +89,25 @@ if err := appLog.Error("Payment failed", paymentErr); err != nil {
 
 The record has `level: "ERROR"`, `message: "Payment failed"` and `error.message: "card declined"`. It is written to stderr. Logging it does not return the business error from your handler.
 
-This example targets stable **v1.2.0**, which does not automatically collect error stacks or log handler panics. The following Preview has different defaults.
+In **v1.3.0**, error logs also include a stack by default, as shown in the Preview below. Historical v1.2.0 does not automatically collect error stacks or log handler panics.
 
 ## Error stacks and panic logging (Preview)
 
-> This Preview is not included in v1.2.0.
+> This Preview is included in v1.3.0 and main. It is not included in v1.2.0.
 
-Install it explicitly in your application:
+Install the published Preview in your application:
 
 ```sh
-CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@main
+CGO_ENABLED=0 go get github.com/rambow-cloud/powertools-lambda-go/logger@v1.3.0
 ```
 
-Omitting a version does not select `main`. Go resolves a branch to a pseudo-version;
+To use development source instead, select `logger@main`. Omitting a version does
+not select `main`. Go resolves a branch to a pseudo-version;
 use `@<commit-SHA>` instead of `@main` to pin a preview. See
 [Go version queries](https://go.dev/ref/mod#version-queries).
 If a module proxy still resolves `main` to an older commit, select the intended
 main commit SHA explicitly.
-The stable installation above and its examples continue to target v1.2.0.
+The installation above targets v1.3.0, including these Preview defaults.
 
 ### Attach the error's source
 
@@ -196,7 +197,7 @@ appLog := logger.New(
 )
 ```
 
-Both options default to `true` on main and can be overridden on child loggers.
+Both options default to `true` in v1.3.0 and on main. Child loggers can override them.
 `WithStackTrace(false)` suppresses attached, fallback and panic stack fields;
 `WithPanicLogging(false)` suppresses the new automatic panic record. Disable both
 to retain the previous logging behavior. These options do not exist in v1.2.0.