JustAPI v2.0.8 Release Notes

What's New

Security Fixes (Critical)

• P0-1: Fixed global panic hook race condition in panic.rs
• P0-2: Fixed RwLock poisoning panics in PerRouteCircuitBreakerMiddleware
• P0-3: Fixed division by zero in rate limiter

Security Fixes (High)

• H-1: Added SQL identifier validation for CRUD table/column names
• H-2: Fixed WebSocket unwrap on hot path
• H-3: GraphiQL now gated on JUSTAPI_ENABLE_GRAPHIQL env var
• H-4: Eliminated TLS service_fn duplication (~300 lines)
• H-5: Added 5-second per-check timeout in health checks

Security Fixes (Medium)

• M-5: Added Mutex poison recovery to Python bindings (7 files)
• M-6: Fixed ChaosMiddleware potential panic on misconfigured latency
• M-7: Added nosniff header to large file streaming path
• M-8: Increased fuzzing duration from 60s to 5min per target
• M-9: Docker Compose credentials now via env vars
• M-10: Added .dockerignore for faster builds

Bug Fixes

• P1-1: Added GraphQL query depth/complexity limits
• P1-2: Added 4 MiB gRPC message size limit
• P1-3: Added 1024-route capacity for circuit breakers
• P1-4: Added symlink resolution in static file serving
• P1-5: Added x-content-type-options: nosniff header
• P1-6: Fixed poisoned mutex cascading panics in coalesce
• P1-7: Redis dependency now feature-gated

Performance Improvements

• P2-6: Router FIFO cache eviction now O(1) with VecDeque
• P2-7: Accept-Encoding now respects RFC 7231 quality values
• P2-8: Health checks now run in parallel
• P2-9: Metrics no longer misclassify 1xx status codes
• P2-10: Env vars now cached with LazyLock
• P2-11: CRUD query params now URL-decoded
• P2-12: Gateway config file permissions checked

Code Quality

• P2-1: Server code partially split (2,560 → 2,120 lines)
  • Extracted ws.rs, sse_ws.rs, handler_exec.rs
• P3-2: ANSI injection prevention in diagnostics
• P3-3: Secret file permission warnings
• P3-5: BufferPool max_per_bucket now configurable
• P3-6: CookieJar now handles quoted values (RFC 6265)
• P3-7: Array schema handling improved
• CQ-2: Added #[non_exhaustive] to public enums

CI/CD Improvements

• Added --tests flag to clippy in CI
• Added --all-features to cargo test in CI
• Added fuzz_pipeline target to fuzz workflow
• Added WebSocket and gRPC fuzz targets
• Added benchmark regression gate to CI

Documentation

• Created troubleshooting guide
• Created performance tuning guide
• Created migration guide from Robyn/Granian
• Created API stability guarantees document
• All docs integrated into docs_site

Installation

pip install justapi

Or with optional features:

pip install "justapi[full]"

Upgrade Notes

This release includes breaking changes for security:

• GraphiQL is now disabled by default in production
• WebSocket upgrade now uses defensive error handling
• Health checks now timeout after 5 seconds

Contributors

Thanks to all contributors who helped make this release possible!

Full Changelog

See CHANGELOG.md for the complete list of changes.