# Dependency review: coder/websocket

- Decision: approved for the independently versioned
  `github.com/spice-framework/starter-websocket` module.
- Version: `github.com/coder/websocket` v1.8.15.
- Upstream: <https://github.com/coder/websocket>.
- License: ISC; retained with the mechanically vendored source.
- Maintenance: Coder actively maintains the v1 line. The selected release was
  published June 15, 2026. The library implements RFC 6455, passes the Autobahn
  test suite, supports context-aware I/O, close handshakes, concurrent writes,
  ping/pong, subprotocols, same-origin checks, and RFC 7692 compression.
- Dependency scope: the module is small and adds no transitive modules. Spice
  does not adopt a separate HTTP server, router, codec, or message protocol.
- Security: inbound TLS, authentication, and same-origin checks are required by
  default. Anonymous access is explicit. Plaintext clients and servers are
  restricted to loopback even when insecure development is enabled.
  Cross-origin patterns are explicit, and any-origin behavior additionally
  requires authentication. Outbound URLs reject embedded credentials,
  fragments, missing ports, and non-loopback plaintext. TLS verification
  cannot be disabled. Authorization is a dedicated bounded value; generic
  headers cannot smuggle authorization, cookies, or WebSocket control headers.
  Redirects are rejected so credentials cannot move to a different endpoint.
  Messages, connections, subprotocols, origins, headers, compression
  thresholds, handshake timeouts, and close timeouts are bounded.
- Cancellation: reads, writes, ping, dial, and close use caller contexts. Dial
  also applies an explicit bounded handshake timeout. Native read cancellation
  closes the connection and is documented. Close performs one bounded,
  idempotent handshake and force-closes on cancellation.
- Observability: the Spice seam exposes direction, subprotocol, outcome, and
  duration only. It cannot receive headers, URLs, peer addresses, close reasons,
  or payload bytes. Authentication failures and peer close errors do not retain
  credential diagnostics or close-reason text.
- Configuration: `NewHandler` performs no network work and returns an ordinary
  `http.Handler`. `Dial` is the only outbound connection operation. No package
  import starts a listener, installs a global registry, or downloads modules.
- Verification: race-enabled tests exercise real local TLS and certificate
  validation, authenticated concurrent sessions, repeated cleanup, handshake
  timeout, text exchange, subprotocol negotiation, ping/read coordination,
  insecure non-loopback rejection, cross-origin rejection, capacity exhaustion,
  size limits, close cancellation, payload-safe diagnostics, observation, and
  defensive configuration.

Primary references:

- <https://github.com/coder/websocket/releases/tag/v1.8.15>
- <https://pkg.go.dev/github.com/coder/websocket@v1.8.15>
- <https://github.com/coder/websocket/blob/v1.8.15/LICENSE.txt>

## Build-only dependencies: Spice release tools

- Decision: approved as the repository-authorized release signer, renderer,
  and independent verifier.
- Signer version: `github.com/spice-framework/development`
  `v0.0.0-20260806132124-4c308d1b9fda`.
- Signer tool: `github.com/spice-framework/development/cmd/spice-dev` through the
  standard Go `tool` directive; invocations always use the full package path.
- Verifier version: `github.com/spice-framework/toolchain`
  `v0.0.0-20260806133530-71211498297c`.
- Verifier tool:
  `github.com/spice-framework/toolchain/cmd/spice-library-release-verify`.
- License: Apache-2.0, with its notice retained in `vendor`.
- Runtime scope: none. Product packages do not import the development module,
  and released applications acquire no runtime dependency on it.
- Dependency graph: the tool participates in normal Go minimal-version
  selection. That build-time coupling is accepted and visible in `go.mod`,
  `go.sum`, and `vendor/modules.txt`; no parallel tool registry is introduced.
- Integrity and network behavior: the exact pseudo-version is pinned and
  checksummed. Release rehearsal runs with `GOWORK=off`, `GOPROXY=off`,
  `GOTOOLCHAIN=local`, and `GOFLAGS=-mod=vendor`, so it cannot select an ambient
  checkout, upgrade itself, or download dependencies.
- Security: the trusted native renderer reads the exact committed Git graph
  and writes only to caller-supplied temporary output directories. The
  independent verifier authenticates release artifacts against an external
  trust anchor and exact Git objects. Neither tool generates private material.
- Maintenance: the protected central workflow is the sole production builder.
  The caller maps only the repository
  `SPICE_LIBRARY_RELEASE_SIGNING_KEY` secret; secret inheritance and
  additional mappings are rejected by repository verification. The protected
  signing and publishing environments remain approval boundaries. The former
  repository-local builder was removed after the protected, independently
  verified central path was established.