v1.22.0 includes the preflight Vary fix (https://github.com/go-pkgz/rest/pull/44): rest.CORS now adds Vary: Access-Control-Request-Method and Access-Control-Request-Headers on preflight itself, making the local wrapper that added them redundant. corsMiddleware now returns rest.CORS directly; TestCorsMiddleware still asserts those preflight Vary headers, now supplied upstream. Also tidies the _example/memory_store module for the new version.