From e884f776c405804517e276e5ad56a1f4992d0352 Mon Sep 17 00:00:00 2001 From: Adam Yang Date: Sat, 27 Jun 2026 12:06:48 +1200 Subject: [PATCH] docs: add v0.4.0 release notes Backfill the curated release notes for 0.4.0 (RedactWire PII detection, PiiBlocked status + clear block messaging, widget.js cache fix). Co-Authored-By: Claude Opus 4.8 --- docs/release-notes/v0.4.0.md | 40 ++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 docs/release-notes/v0.4.0.md diff --git a/docs/release-notes/v0.4.0.md b/docs/release-notes/v0.4.0.md new file mode 100644 index 0000000..e6e94cd --- /dev/null +++ b/docs/release-notes/v0.4.0.md @@ -0,0 +1,40 @@ +## BotWire v0.4.0 — RedactWire PII detection + clear block messaging + +This release replaces BotWire's built-in PII guard with [RedactWire](https://github.com/adamy/RedactWire), and makes a blocked message tell the user *why* it was refused instead of showing a generic error. Defaults stay on; `AdditionalPatterns` keeps working. + +### New features + +- **RedactWire-backed PII detection** — the old 4-pattern regex guard is replaced by RedactWire 0.4.0: invariant rules (email, credit card with Luhn, IPv4, IBAN with mod-97) plus secret/credential detection (API keys, tokens), evaluated against the default culture (`CultureInfo.CurrentCulture`). Checksum validation means far fewer false positives than a bare regex. + +- **`PiiGuardOptions.ConfigureDetector`** — an `Action` hook to configure RedactWire directly: enable country rule packs (`AddCulture`), add custom `IPiiRule`s, or pick an overlap strategy. + + ```csharp + builder.Services.AddBotWire(opts => + { + opts.PiiGuard.ConfigureDetector = b => b.AddCulture(new CultureInfo("en-US")); + }); + ``` + +- **Clear PII messaging** — a blocked message now returns a distinct **`PiiBlocked`** status carrying the configurable `PiiGuardOptions.RejectionMessage`. The embedded widget and the `botwire-js` client surface that message instead of the generic "Something went wrong", so users know their message contained personal data. + +- **Dedicated prompt-injection message** — injection blocks no longer reuse the PII copy; they get their own neutral `PromptInjectionOptions.RejectionMessage`. + +### Breaking changes + +- **PII blocks now return status `PiiBlocked`** (previously `Blocked`). Clients that branch on `Blocked` to detect a PII refusal should add `PiiBlocked`. +- **Stronger, broader detection.** Messages containing IBANs, IP addresses, or secrets/API keys are now blocked where the old four-pattern guard let them through. Tune via `ConfigureDetector` or adjust `RejectionMessage`. +- **`PiiGuardOptions` exposes RedactWire's `PiiDetectorBuilder`**, so RedactWire is now a public dependency of `BotWire.Core`. (Its base package does not pull `System.Text.Json` — structured scanning lives in a separate add-on — so there is no net-new transitive dependency.) + +`AdditionalPatterns` is unchanged: custom regex patterns still work, now bridged to RedactWire custom rules and compiled with a 100 ms match timeout to bound ReDoS. + +### Fixes + +- The embedded `widget.js` is now served with `Cache-Control: no-cache` and a content-hash **ETag** instead of a one-hour `max-age`. A rebuilt widget reaches browsers immediately (304 when unchanged) rather than being stuck behind a stale cache. + +### Get started + +``` +dotnet add package BotWire.AspNetCore +``` + +See the [README](https://github.com/adamy/BotWire#readme) for the quick start and `PiiGuardOptions` for PII configuration.