github.com/larsartmann/httputil/server_timing

Composable HTTP middleware and server lifecycle for Go — CORS, CSRF, rate limiting, compression, security headers, CSP nonces, request IDs, timeouts, panic recovery, W3C Server-Timing, language negotiation, and health checks. Pure stdlib net/http, four dependencies.