📝 changelog: consolidate 2.0.8 release notes
swadhinbiswas committed 2 months ago
ebc90d9
1 parent 1537f66
commit ebc90d9
1 file changed
+23 -25
Showing 1 changed file+23-25
▼CHANGELOG.md
+23-25
| @@ -5,7 +5,7 @@ All notable changes to JustAPI will be documented in this file. | ||
5 | 5 | The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), |
6 | 6 | and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). |
7 | 7 | |
8 | -## [2.0.8] - 2026-07-28 | |
8 | +## [2.0.8] - 2026-08-06 | |
9 | 9 | |
10 | 10 | ### Security Fixes |
11 | 11 | - **CRITICAL:** Fixed global panic hook race condition in `panic.rs` (P0-1) |
| @@ -19,7 +19,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 | ||
19 | 19 | - **MEDIUM:** Fixed ChaosMiddleware potential panic on misconfigured latency (M-6) |
20 | 20 | - **MEDIUM:** Added `nosniff` header to large file streaming path (M-7) |
21 | 21 | |
22 | -### Bug Fixes | |
22 | +### Added | |
23 | +- **HTTP/3 (QUIC) transport** — `app.enable_http3(cert_path, key_path)` serves the app over HTTP/3 on the same port as TCP (feature `http3`; h3 + h3-quinn + quinn). Python handlers, DI, schema validation, and the GIL pool all work over QUIC (ADR-079, ADR-082) | |
24 | +- **`Security` dependency marker** — `Security(dep, scopes=...)` is `Depends` with OAuth2-scope metadata (FastAPI parity); top-level re-exports of `JwtAuth`, `OAuth2PasswordBearer`, `OAuth2PasswordRequestForm`, `OAuth2PasswordRequestFormStrict` from `justapi.auth` | |
25 | +- **`JustAPP` alias** — `JustAPP()` is the same class as `JustAPIApp()` (also `JustAPI`) | |
26 | +- **QUERY method (RFC 10008) testability** — `TestClient::query`/`query_with`, `JustAPITestClient.query`/`query_with`, `AsyncTestClient.query` (RFC requires Content-Type; enforced with 400) | |
27 | +- **`__version__`** — `justapi.__version__` now exposed (2.0.8) | |
28 | +- **`scripts/sanitize.sh`** — fast memory-safety gate: ASan on the full core suite + targeted Miri on the only `unsafe` module (`memory.rs`); replaces the 20+ min full-suite Miri run | |
29 | +- **4 portable wheels** — manylinux + musllinux × x86_64 + aarch64 via `maturin --zig`; `scripts/publish.sh` builds/verifies/upload all | |
30 | + | |
31 | +### Fixed | |
32 | +- **CRITICAL: Python-handler write-path collapse** — concurrent writes dropped to ~3 RPS at c=11 (was 150 at c=10): the request-scoped auto-transaction double-acquired pool connections (`2N` for `N` writes). Removed; SQLite BUSY/LOCK now maps to 503 Retry-After. Writes now flat ~150 RPS c=1..50 (ADR-080) | |
33 | +- **CRITICAL: GIL pool not fork-safe** — a forked child inherited the parent's initialized pool whose worker threads don't exist → every Python request hung (504s). Pool now tracks its PID and rebuilds after `fork(2)`; fixes prefork deployments and the long-standing `test_circuit_breaker` flake (ADR-081) | |
34 | +- **DI awaitedness bug** — `Depends`/`Security` on async callable *instances* (e.g. `OAuth2PasswordBearer`) were invoked without awaiting (unawaited coroutines leaked); `_is_async_callable` now checks `__call__` | |
35 | +- **Default-feature test gate** — `db_bridge`/`edge_cases` integration tests now carry proper `#![cfg(feature = ...)]` guards; `cargo test --workspace` passes on default features | |
23 | 36 | - Added GraphQL query depth/complexity limits (depth=10, complexity=200) |
24 | 37 | - Added 4 MiB gRPC message size limit |
25 | 38 | - Added 1024-route capacity for circuit breakers with FIFO eviction |
| @@ -36,14 +49,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 | ||
36 | 49 | - Environment variables cached with `LazyLock` |
37 | 50 | - CRUD query params now URL-decoded |
38 | 51 | |
39 | -### Code Quality | |
52 | +### Changed | |
53 | +- **PLAN.md honesty pass** — phase table distinguishes ✅ verified vs 🟡 implemented/unverified (all AI/inference phases marked unverified: MockModel-only, no GPU/real weights); Phase 52 stays frozen | |
54 | +- **Docs fabrication sweep** — removed false APIs from docs (`justapi.middleware`, `PyScheduler`, `enable_rate_limiter`, `enable_compression`, `fastapi.security` imports); rewrote security tutorials, scheduler API, performance-tuning with the real API; added HTTP/3 deployment guide | |
55 | +- **README comparison table** — now states the honest breakdown (700k native fast path / 120k Python / 180k DB SELECT) instead of a single number | |
56 | +- **Release infra** — version bumped to 2.0.8 everywhere; publish consolidated to `wheels.yml` (7-platform matrix, sole PyPI publisher); duplicate publish jobs disabled; classifier set to "4 - Beta" | |
40 | 57 | - Server code partially split: `ws.rs`, `sse_ws.rs`, `handler_exec.rs` extracted |
41 | 58 | - Added `#[non_exhaustive]` to public enums for forward compatibility |
42 | 59 | - ANSI injection prevention in diagnostics |
43 | -- Documented known limitations in code comments | |
44 | 60 | - Implemented `GatewayState::get_route()` (was a stub returning `None`) |
45 | 61 | |
46 | 62 | ### CI/CD |
63 | +- Memory-safety gate now `scripts/sanitize.sh` (ASan + targeted Miri) instead of the 20-min full-suite Miri run | |
47 | 64 | - Added `--tests` flag to clippy in CI |
48 | 65 | - Added `--all-features` to cargo test in CI |
49 | 66 | - Added `fuzz_pipeline`, `fuzz_websocket`, `fuzz_grpc` targets to fuzz workflow |
| @@ -62,27 +79,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 | ||
62 | 79 | ### Testing |
63 | 80 | - 6 new edge case tests for SQL validation, health timeouts, chaos config |
64 | 81 | - 2 new fuzz targets (WebSocket, gRPC) |
65 | -- 521 total tests passing | |
66 | - | |
67 | -## [2.0.9-dev] - 2026-08-06 | |
68 | - | |
69 | -### Added | |
70 | -- **HTTP/3 (QUIC) transport** — `app.enable_http3(cert_path, key_path)` serves the app over HTTP/3 on the same port as TCP (feature `http3`; h3 + h3-quinn + quinn). Python handlers, DI, schema validation, and the GIL pool all work over QUIC (ADR-079, ADR-082) | |
71 | -- **`Security` dependency marker** — `Security(dep, scopes=...)` is `Depends` with OAuth2-scope metadata (FastAPI parity); top-level re-exports of `JwtAuth`, `OAuth2PasswordBearer`, `OAuth2PasswordRequestForm`, `OAuth2PasswordRequestFormStrict` from `justapi.auth` | |
72 | -- **QUERY method (RFC 10008) testability** — `TestClient::query`/`query_with`, `JustAPITestClient.query`/`query_with`, `AsyncTestClient.query` (RFC requires Content-Type; enforced with 400) | |
73 | -- **`scripts/sanitize.sh`** — fast memory-safety gate: ASan on the full core suite + targeted Miri on the only `unsafe` module (`memory.rs`); replaces the 20+ min full-suite Miri run | |
74 | -- **4 portable wheels** — manylinux + musllinux × x86_64 + aarch64 via `maturin --zig`; `scripts/publish.sh` builds/verifies/upload all | |
75 | - | |
76 | -### Fixed | |
77 | -- **CRITICAL: Python-handler write-path collapse** — concurrent writes dropped to ~3 RPS at c=11 (was 150 at c=10): the request-scoped auto-transaction double-acquired pool connections (`2N` for `N` writes). Removed; SQLite BUSY/LOCK now maps to 503 Retry-After. Writes now flat ~150 RPS c=1..50 (ADR-080) | |
78 | -- **CRITICAL: GIL pool not fork-safe** — a forked child inherited the parent's initialized pool whose worker threads don't exist → every Python request hung (504s). Pool now tracks its PID and rebuilds after `fork(2)`; fixes prefork deployments and the long-standing `test_circuit_breaker` flake (ADR-081) | |
79 | -- **DI awaitedness bug** — `Depends`/`Security` on async callable *instances* (e.g. `OAuth2PasswordBearer`) were invoked without awaiting (unawaited coroutines leaked); `_is_async_callable` now checks `__call__` | |
80 | -- **Default-feature test gate** — `db_bridge`/`edge_cases` integration tests now carry proper `#![cfg(feature = ...)]` guards; `cargo test --workspace` passes on default features | |
81 | - | |
82 | -### Changed | |
83 | -- **PLAN.md honesty pass** — phase table distinguishes ✅ verified vs 🟡 implemented/unverified (all AI/inference phases marked unverified: MockModel-only, no GPU/real weights); Phase 52 stays frozen | |
84 | -- **Docs fabrication sweep** — removed false APIs from docs (`justapi.middleware`, `PyScheduler`, `enable_rate_limiter`, `enable_compression`, `fastapi.security` imports); rewrote security tutorials, scheduler API, performance-tuning with the real API | |
85 | -- **README comparison table** — now states the honest breakdown (700k native fast path / 120k Python / 180k DB SELECT) instead of a single number | |
82 | +- New regression tests: write-path collapse, fork-safety, async-callable DI, `JustAPP` alias, HTTP/3 e2e | |
83 | +- 521+ total tests passing (170 Python, workspace suites green) | |
86 | 84 | |
87 | 85 | ## [Unreleased] |
88 | 86 | |
89 | 87 | |