bompus · Nov 7, 2026 · Nov 7, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,9 +1,10 @@
 # Changelog
 
-## Unreleased
+## 1.0.5 - 2026-11-06
 
 - In Cloudflare Workers and browsers (the WebCrypto entry), a refused `eventSigner` `sign` call, for example one with a `now` of `NaN` or a `null` message, no longer makes every later call on that signer reject. It now leaves the signer where it was, as the Node, Bun and Deno entries do.
 - On the same entry, `chunk(data)` and `sign(message)` now read the buffer when they are called, not when their turn in the queue comes. A caller that reused its buffer straight after the call got a signature for the new bytes; it now gets the one the other entries give.
+- The built files that Node and Bun load are byte-identical to those of 1.0.2 to 1.0.4, so the speed, memory and import figures were not measured again. The WebCrypto entry grows (minified) by 22 bytes for `getAuthHeaders`, 331 for `chunkSigner` and 159 for `eventSigner`; `bench/results/release-1.0.5.md` has the new sizes.
 
 ## 1.0.4 - 2026-11-01
 

diff --git a/bench/results/benchmarked.json b/bench/results/benchmarked.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.0.4",
-  "srcTree": "90a032d5d5296cca4471ac13dcacd154e5459ded",
-  "date": "2026-11-01"
+  "version": "1.0.5",
+  "srcTree": "c5281a3b1fcd6e04f08392a47e41bad21d3aabe2",
+  "date": "2026-11-06"
 }
diff --git a/bench/results/client-correctness.json b/bench/results/client-correctness.json
@@ -1,10 +1,10 @@
 {
   "runtime": "Bun 1.4.4",
-  "sigflintVersion": "1.0.4",
+  "sigflintVersion": "1.0.5",
   "corpusSha256": "a4f907d61241c241f2bc13edf4cd81f71f7b8d93043cea891b0360191efb9cfe",
   "presignCorpusSha256": "b87350155d161c69312ea40b03b1ad98d6434afe1831377cd915c247718fac19",
   "generalCorpusSha256": "014989b79e5499d1932fc822868f1de6d345e0e778a877a7b326b0aca4b60d7b",
-  "dependencyLockSha256": "d07ad4d0d6ac9702c7e05b93a4d0f0419b11e4249a4748612a8496c5a2436952",
+  "dependencyLockSha256": "565dc9f1128fd55ca868e8254c0fdc3d14b2a5c7c84d0f673608316db07dde24",
   "corpusCases": 3360,
   "ordinaryCases": 1520,
   "edgeBaseline": {

diff --git a/bench/results/release-1.0.5.md b/bench/results/release-1.0.5.md
@@ -0,0 +1,25 @@
+# Release 1.0.5: benchmark gate, 2026-11-06
+
+The speed, memory and import measurements were not run again for 1.0.5. The release 1.0.4 cohort (`protocol-release-1.0.4.md`, `release-1.0.4/`) stands for the Node and Bun builds.
+
+## Why that cohort still applies
+
+Between v1.0.4 and 1.0.5, `src/` changed only in `src/web.js`, the WebCrypto entry used on Cloudflare Workers and in browsers (`chunkSigner` and `eventSigner`). The files Node and Bun load, built from `src/` with `bun build` 1.4.4, are byte-identical to the artifacts measured for 1.0.4:
+
+```
+7153026dd6ac0cd8bd7875b665c23beca078aeb968aaefe9fd0fd2ae2d34c2ff  dist/node.js
+69009b478cae42d0d920df1b20aaa4f6b2a1e77230ea836dde3c7f790a2d62fd  dist/bun.js
+```
+
+Both hashes equal `release-1.0.4-artifacts.sha256`. The speed, memory and import runs time those two files, so a new run would measure the same bytes again.
+
+The repository's release rule asks for all four measurements on the code being released. This release departs from it on purpose, because the built files did not change; the maintainer chose that on 2026-11-06. `benchmarked.json` is recorded for 1.0.5 on that basis.
+
+## What was measured again
+
+- Size by signer and entry (`bun bench/tiers.mjs`, `results/tiers.json`). The Node and Bun rows are unchanged. The web rows grew: `getAuthHeaders` 5,235 to 5,257 bytes minified (2,593 to 2,605 gzipped), chunked uploads 2,532 to 2,863 (1,329 to 1,484), event streams 2,719 to 2,878 (1,432 to 1,506), everything 11,816 to 12,197 (4,916 to 5,094). `docs/benchmarks.md` cites the `getAuthHeaders` figure.
+- The Node and Bun correctness screens and the client correctness screen, so their records carry 1.0.5. Signature counts are unchanged.
+
+## Not measured
+
+The speed and memory of the WebCrypto entry's `chunkSigner` and `eventSigner` before and after the change. No published figure covers them.
diff --git a/bench/results/screen-bun.json b/bench/results/screen-bun.json
@@ -10,7 +10,7 @@
  "candidates": {
   "sigflint": {
    "label": "sigflint",
-   "version": "1.0.4",
+   "version": "1.0.5",
    "unsupported": 0,
    "byTag": {
     "well-formed": {

diff --git a/bench/results/screen-node.json b/bench/results/screen-node.json
@@ -10,7 +10,7 @@
  "candidates": {
   "sigflint": {
    "label": "sigflint",
-   "version": "1.0.4",
+   "version": "1.0.5",
    "unsupported": 0,
    "byTag": {
     "well-formed": {

diff --git a/bench/results/tiers.json b/bench/results/tiers.json
@@ -75,39 +75,39 @@
  },
  "web": {
   "headers": {
-   "minifiedBytes": 5235,
-   "gzipBytes": 2593,
-   "brotliBytes": 2391
+   "minifiedBytes": 5257,
+   "gzipBytes": 2605,
+   "brotliBytes": 2419
   },
   "headers + presign": {
-   "minifiedBytes": 6778,
-   "gzipBytes": 3160,
-   "brotliBytes": 2882
+   "minifiedBytes": 6800,
+   "gzipBytes": 3174,
+   "brotliBytes": 2891
   },
   "SigV4a headers": {
-   "minifiedBytes": 6387,
-   "gzipBytes": 3041,
-   "brotliBytes": 2813
+   "minifiedBytes": 6409,
+   "gzipBytes": 3057,
+   "brotliBytes": 2833
   },
   "SigV4a presign": {
-   "minifiedBytes": 6411,
-   "gzipBytes": 3086,
-   "brotliBytes": 2823
+   "minifiedBytes": 6433,
+   "gzipBytes": 3101,
+   "brotliBytes": 2837
   },
   "chunked uploads": {
-   "minifiedBytes": 2532,
-   "gzipBytes": 1329,
-   "brotliBytes": 1201
+   "minifiedBytes": 2863,
+   "gzipBytes": 1484,
+   "brotliBytes": 1345
   },
   "event streams": {
-   "minifiedBytes": 2719,
-   "gzipBytes": 1432,
-   "brotliBytes": 1304
+   "minifiedBytes": 2878,
+   "gzipBytes": 1506,
+   "brotliBytes": 1369
   },
   "everything": {
-   "minifiedBytes": 11816,
-   "gzipBytes": 4916,
-   "brotliBytes": 4478
+   "minifiedBytes": 12197,
+   "gzipBytes": 5094,
+   "brotliBytes": 4630
   }
  }
 }
diff --git a/docs/benchmarks.md b/docs/benchmarks.md
@@ -2,7 +2,7 @@
 
 How sigflint compares with the other libraries, and how it is checked. The summary is in the [README](../README.md). Library comparisons put sigflint first as the reference, then alternatives alphabetically by displayed name. Correctness rows stay grouped by input method.
 
-The figures below describe the sigflint code of versions 1.0.2, 1.0.3 and 1.0.4, whose source trees are identical. Speed, memory, import and size were measured again on 2026-11-01 on Node.js 26.13.0 and Bun 1.4.4, with Tinybench and Hyperfine, which replaced the hand-written timers used for earlier releases, so these figures are not comparable with those of earlier releases. The current unminified Node and Bun builds match the measured artifact hashes byte for byte. Builds, checks and publishing use Bun 1.4.4.
+The speed, memory and import figures below describe the unminified Node and Bun builds of sigflint 1.0.2 to 1.0.5, which are byte-identical: the source of 1.0.2 to 1.0.4 is one tree, and 1.0.5 changes only the WebCrypto entry (`src/web.js`), whose sizes were measured again for 1.0.5 ([release note](../bench/results/release-1.0.5.md)). Speed, memory, import and size were measured again on 2026-11-01 on Node.js 26.13.0 and Bun 1.4.4, with Tinybench and Hyperfine, which replaced the hand-written timers used for earlier releases, so these figures are not comparable with those of earlier releases. The current unminified Node and Bun builds match the measured artifact hashes byte for byte. Builds, checks and publishing use Bun 1.4.4.
 
 The speed matrices use two fresh processes per library and runtime; memory and import use five rounds (four for the one `s3-lite-client` round that was out of attempts). A/A controls and reporting bands accompany the results. Raw evidence and reproducible protocols are linked under Methodology and limits.
 
@@ -47,14 +47,14 @@ Matches against botocore with the same key and clock. Compare libraries within a
 
 | Library | Input method | Version | Ordinary matches / supported | Unsupported ordinary | Edge matches / tested | Common decoded-key matches / 578 |
 |---|---|---|--:|--:|--:|--:|
-| **sigflint** | Serialized URL | 1.0.4 | 1,520 / 1,520 | 0 | 1,838 / 1,838 | Not applicable |
+| **sigflint** | Serialized URL | 1.0.5 | 1,520 / 1,520 | 0 | 1,838 / 1,838 | Not applicable |
 | aws4 | Serialized URL | 1.13.2 | 1,264 / 1,520 | 0 | 424 / 1,838 | Not applicable |
 | aws4fetch | Serialized URL | 1.0.20 | 1,408 / 1,520 | 0 | 790 / 1,838 | Not applicable |
 | aws-sig | Serialized URL | 2.1.0 | 379 / 1,520 | 0 | 65 / 1,838 | Not applicable |
 | minio | Serialized URL | 8.0.7 | 526 / 1,520 | 0 | 40 / 1,838 | Not applicable |
 | @smithy/signature-v4 | Serialized URL | 5.7.5 | 904 / 1,520 | 0 | 333 / 1,838 | Not applicable |
 | @wdl-dev/aws-sigv4 | Serialized URL | 3.0.4 | 1,174 / 1,520 | 0 | 234 / 1,838 | Not applicable |
-| **sigflint** | Decoded key | 1.0.4 | 1,520 / 1,520 | 0 | 1,252 / 1,252 (588 unsupported) | 578 / 578 |
+| **sigflint** | Decoded key | 1.0.5 | 1,520 / 1,520 | 0 | 1,252 / 1,252 (588 unsupported) | 578 / 578 |
 | lean-s3 | Decoded key | 0.11.2 source | 1,293 / 1,520 | 0 | 1,013 / 1,252 (588 unsupported) | 458 / 578 |
 | s3-lite-client | Decoded key | 1.0.1 | 1,519 / 1,520 | 0 | 1,252 / 1,252 (588 unsupported) | 578 / 578 |
 | s3mini | Decoded key | 1.0.3 | 494 / 578 | 942 | 567 / 645 (1,195 unsupported) | 494 / 578 |
@@ -71,9 +71,9 @@ Some of the other libraries expect the caller to canonicalize the path and query
 
 The table and chart above include both input methods and the decoded-key edge screen. The serialized-URL screen tests
 URL parsing as well as signing. The decoded-key screen ran on Bun 1.4.4 on
-2026-10-31 with `bun bench/compat-clients.mjs` (run `bun bench/compat/build-clients.mjs` first, which compiles the pinned lean-s3 and tiny-oss source cores and s3mini's key escaper). It uses decoded keys and query
+2026-11-06 with `bun bench/compat-clients.mjs` (run `bun bench/compat/build-clients.mjs` first, which compiles the pinned lean-s3 and tiny-oss source cores and s3mini's key escaper). It uses decoded keys and query
 pairs from normalized canonical requests, so it does not test arbitrary URL
-parsing or complete client operations. Both screens use sigflint 1.0.4. These
+parsing or complete client operations. Both screens use sigflint 1.0.5. These
 are distinct input methods, not directly comparable rankings.
 
 s3mini cannot express the other 942 ordinary requests because its signing path
@@ -373,7 +373,7 @@ What a bundle contains depends on what it imports. Minified size of the `node` e
 | `eventSigner` | 3,125 | 1,601 |
 | all six | 12,263 | 5,118 |
 
-The Bun and web entries are 5,036 / 2,529 and 5,235 / 2,593 bytes for `getAuthHeaders`. Node and Bun load one built file (`dist/`, made by `npm run build`) rather than six modules. The `workerd`, `worker` and `browser` conditions and bundlers that do not pick the `node` or `bun` condition get the per-signer modules in `src/`; a bundler that does pick `node` gets the built file and drops unused signers just as well. The package sets `"sideEffects": false`; nothing runs at import, and the lookup tables and the one-shot HMAC check are built on first use. Tree shaking was checked with `bun build` and `esbuild`; other bundlers were not.
+The Bun and web entries are 5,036 / 2,529 and 5,257 / 2,605 bytes for `getAuthHeaders`. Node and Bun load one built file (`dist/`, made by `npm run build`) rather than six modules. The `workerd`, `worker` and `browser` conditions and bundlers that do not pick the `node` or `bun` condition get the per-signer modules in `src/`; a bundler that does pick `node` gets the built file and drops unused signers just as well. The package sets `"sideEffects": false`; nothing runs at import, and the lookup tables and the one-shot HMAC check are built on first use. Tree shaking was checked with `bun build` and `esbuild`; other bundlers were not.
 
 ## How it is tested
 

diff --git a/docs/tables.md b/docs/tables.md
@@ -4,14 +4,14 @@ Matches against botocore with the same key and clock. Compare libraries within a
 
 | Library | Input method | Version | Ordinary matches / supported | Unsupported ordinary | Edge matches / tested | Common decoded-key matches / 578 |
 |---|---|---|--:|--:|--:|--:|
-| **sigflint** | Serialized URL | 1.0.4 | 1,520 / 1,520 | 0 | 1,838 / 1,838 | Not applicable |
+| **sigflint** | Serialized URL | 1.0.5 | 1,520 / 1,520 | 0 | 1,838 / 1,838 | Not applicable |
 | aws4 | Serialized URL | 1.13.2 | 1,264 / 1,520 | 0 | 424 / 1,838 | Not applicable |
 | aws4fetch | Serialized URL | 1.0.20 | 1,408 / 1,520 | 0 | 790 / 1,838 | Not applicable |
 | aws-sig | Serialized URL | 2.1.0 | 379 / 1,520 | 0 | 65 / 1,838 | Not applicable |
 | minio | Serialized URL | 8.0.7 | 526 / 1,520 | 0 | 40 / 1,838 | Not applicable |
 | @smithy/signature-v4 | Serialized URL | 5.7.5 | 904 / 1,520 | 0 | 333 / 1,838 | Not applicable |
 | @wdl-dev/aws-sigv4 | Serialized URL | 3.0.4 | 1,174 / 1,520 | 0 | 234 / 1,838 | Not applicable |
-| **sigflint** | Decoded key | 1.0.4 | 1,520 / 1,520 | 0 | 1,252 / 1,252 (588 unsupported) | 578 / 578 |
+| **sigflint** | Decoded key | 1.0.5 | 1,520 / 1,520 | 0 | 1,252 / 1,252 (588 unsupported) | 578 / 578 |
 | lean-s3 | Decoded key | 0.11.2 source | 1,293 / 1,520 | 0 | 1,013 / 1,252 (588 unsupported) | 458 / 578 |
 | s3-lite-client | Decoded key | 1.0.1 | 1,519 / 1,520 | 0 | 1,252 / 1,252 (588 unsupported) | 578 / 578 |
 | s3mini | Decoded key | 1.0.3 | 494 / 578 | 942 | 567 / 645 (1,195 unsupported) | 494 / 578 |

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sigflint",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Fast, dependency-free AWS Signature Version 4 signing for every AWS service: headers, presigned URLs, SigV4a, chunked uploads and event streams. Node.js, Bun, Deno, Cloudflare Workers and browsers.",
   "keywords": [
     "authorization",