Prepare v0.17.1 release

[soulteary]

Prepares the v0.17.1 release.

What is being released

Three commits since v0.17.0 (compare), all dependency work — nine soulteary kits onto new major module paths:

• deps: upgrade httpcache-kit v4, logger-kit v3, metrics-kit v3 — these move together because httpcache-kit's API takes logger-kit and metrics-kit types directly, and a module path is part of a type's identity. Also fixes a latent nil-interface panic: httpcache.GetDefaultMetrics() now returns the Metrics interface and never nil, so the old nil guard in the cache-stats API was a panic waiting to happen; UpdateCacheStats(stats) is now called unconditionally.
• deps: upgrade health-kit v4, middleware-kit v3, version-kit v4 — Fiber support moved into fiberadapter subpackages. /healthz and /readyz keep the local fiberHealthHandler, the same four security headers are returned, and the -X ldflags inject main.version rather than version-kit package variables, so the silent-dev trap in version-kit's upgrade notes does not apply here.
• deps: upgrade tracing-kit v2 and http-kit v2 — the OTLP exporter moved to a subpackage (tracing.InitTracer → otlp.InitTracer, same arguments and return values, failure still non-fatal), and http-kit dropped Client.InjectTraceContext, which this repository never called.

Nothing user-visible changes: the apt_proxy_cache_* series, the response headers, /healthz and /readyz are all as they were. Patch rather than minor, which the repository already uses (v0.10.1, v0.5.1–v0.5.3, v0.3.1–v0.3.3).

Why there is no version bump in the diff

Every version reference in this repository comes from the tag: VERSION in the Makefile is git describe, GoReleaser templates the image tags from {{ .Tag }}, and docker/Dockerfile defaults ARG VERSION=dev for local builds only. No file pins 0.17.x, so there is nothing to bump — pushing the tag is sufficient.

What the diff does change

GoReleaser builds the release body from commit subjects, and this release is 100% dependency commits that currently reach no group:

• ^chore: in the exclude list does not match chore(deps): (Dependabot's prefix here, 11 commits in recent history).
• deps: (used by hand, 3 commits — all three of this release) matches no group regexp.

Both fall through to Others, so v0.17.1 would publish as one untitled list. This adds a Dependencies group covering deps:, chore(deps): and build(deps):, placed after Bug fixes so a fix(deps): still reads as a fix — GoReleaser takes the first group that matches, in definition order.

Verified against Go's regexp package, the engine GoReleaser uses:

subject	group
deps: upgrade tracing-kit v2 and http-kit v2	Dependencies
deps: upgrade health-kit v4, middleware-kit v3, version-kit v4	Dependencies
deps: upgrade httpcache-kit v4, logger-kit v3, metrics-kit v3	Dependencies
chore(deps): bump …	Dependencies
build(deps): bump …	Dependencies
feat(proxy): …	Features
fix(proxy): …	Bug fixes
perf(cache): …	Performance
refactor: …	Others

Release readiness

Run on this branch:

• go build ./... — OK
• go vet ./... — OK
• go test -short ./... — all 12 packages pass

After merging

git switch main && git pull --ff-only
git tag -a v0.17.1 -m "Release v0.17.1"
git push origin v0.17.1

Note, not part of this PR

apt-proxy is the only one of these services without a CHANGELOG.md, so the detail in these commit bodies does not survive into the release notes — GoReleaser only carries the subject lines. Adding one is a separate change and is deliberately left out of this release prep.

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.