swadhinbiswas p1: add built-in GraphQL execution and hardened schema validation · 7/24/2026
be6133d
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
[workspace]
resolver = "2"
members = [
"crates/justapi-core",
"crates/justapi-py",
"crates/justapi-cli",
"crates/justapi-bench",
"crates/justapi-inference",
]
exclude = ["fuzz"]
[workspace.package]
version = "2.0.0"
edition = "2021"
license = "MIT"
# Release builds abort on panic instead of unwinding. This is required for the
# pyo3 extension-module FFI boundary: a Rust panic that unwinds across the
# pyo3/Python boundary is undefined behaviour. With `panic = "abort"` a panic
# safely terminates the process and the supervisor (Docker/k8s, systemd)
# restarts it. This is why `gil_pool` does NOT wrap each GIL job in
# `catch_unwind` (that measured as a ~3x regression on the GIL path). Dev/test
# builds keep the default `unwind` so `cargo test` panics still surface.
[profile.release]
panic = "abort"
[workspace.dependencies]
# Internal crates
justapi-core = { path = "crates/justapi-core" }
justapi-py = { path = "crates/justapi-py" }
# Async runtime
tokio = { version = "1", features = ["full"] }
libc = "0.2"
# HTTP stack
hyper = { version = "1", features = ["full"] }
hyper-util = { version = "0.1", features = ["tokio", "http1", "http2", "server"] }
http-body-util = "0.1"
# Python bindings
pyo3 = { version = "0.29", features = ["extension-module", "experimental-async", "abi3-py311"] }
# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_urlencoded = "0.7"
simd-json = { version = "0.14", features = ["serde_impl"] }
quick-xml = { version = "0.36", features = ["serialize"] }
# Validation: Rust-native JSON Schema. `default-features = false` drops the
# `$ref` resolver's network/file backends (resolve-http/resolve-file/tls)
# we don't need — drafts + the `format` keyword are compiled in by
# default in 0.46 (auto-detected per schema) and enforced at runtime.
jsonschema = { version = "0.46", default-features = false }
# Observability
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tracing-appender = "0.2"
# Routing
matchit = "0.9"
# WebSocket
tokio-tungstenite = "0.24"
tokio-stream = "0.1"
tokio-util = "0.7"
sha1 = "0.10"
base64 = "0.22"
# TLS
rustls = { version = "0.23", default-features = false, features = ["ring"] }
tokio-rustls = { version = "0.26" }
rustls-pemfile = { version = "2" }
# Compression
flate2 = "1"
brotli = "7"
zstd = "0.13"
# OpenTelemetry
opentelemetry = "0.26"
opentelemetry_sdk = { version = "0.26", features = ["rt-tokio"] }
opentelemetry-stdout = { version = "0.26", features = ["trace"] }
opentelemetry-otlp = { version = "0.26", features = ["grpc-tonic"] }
tracing-opentelemetry = "0.27"
# Utilities
anyhow = "1"
thiserror = "1"
clap = { version = "4", features = ["derive"] }
async-trait = "0.1"
jsonwebtoken = "9"
governor = "0.8"
# Database
sqlx = { version = "0.8", features = ["runtime-tokio", "postgres", "sqlite", "mysql", "migrate", "any", "tls-rustls"] }