view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

         where multiple file uploads under the same form field name failed
         to parse cleanly into uploaded_files.

1.7.0  2026-08-29
       [FEATURE]
       - File uploads: a request body with Content-Type multipart/form-data
         is now parsed (per RFC 7578) instead of unconditionally failing
         JSON decode and hard-rejecting with 422 before any handler or
         dependency ran. New PAGI::FastAPI::Context methods: form_data(),
         uploaded_files(), uploaded_file().
       - Background tasks: new $c->background(async sub {...}) on
         PAGI::FastAPI::Context for fire-and-forget work that keeps
         running after the response has been sent. Retention is owned by
         the application (not the request), a failing task is logged
         rather than crashing anything, and any still-pending tasks are
         drained on PAGI Lifespan shutdown before on_shutdown callbacks
         run.
       - Per-route OpenAPI metadata: get/post/put/patch/delete now accept
         tags, summary, description, deprecated, and a responses => {...}
         map (merged over, not replacing, the existing default 200/422
         entries), threaded into the generated OpenAPI document for that
         route. summary still defaults to "$method $path" when omitted.
       - PAGI::FastAPI::Context now includes a file() method for returning
         file responses with configurable MIME types and attachment headers.
       - Swagger UI rendering now accepts an injectable $swagger_ui_parameters
         configuration hash during app instantiation.
       - Added $swagger_ui_css_url and $swagger_ui_bundle_url constructor
         attributes, allowing developers to override CDN links or serve
         Swagger UI assets locally.

       [BUGFIX]
       - PAGI::FastAPI->new's default 'version' (when not explicitly
         passed) was the blessed version object itself rather than a
         plain string, which crashed encode_json on /openapi.json for any
         app that didn't pass an explicit version. Found via testing the
         OpenAPI metadata feature above; unrelated to it otherwise.
       - Resolved random visual shuffling of endpoints in the /docs UI by
         explicitly defaulting operationsSorter to 'method' and tagsSorter
         to 'alpha'.

       [TESTING]
       - Added the following unit tests to cover new features added:
         - t/37-multipart_file_uploads.t
         - t/38-background_tasks.t
         - t/39-openapi_route_options.t

       [EXAMPLES]
       - Added the following applications to demo new features:
         - eg/background_demo.pl
         - eg/docs_demo.pl
         - eg/file_uploads_demo.pl

1.6.0  2026-08-25
       [SECURITY FIXES]
       - Added 'trust_proxies' configuration parameter to
         PAGI::FastAPI::Middleware::BotProtection, defaults to 0.
       - Added pow() reader method to PAGI::FastAPI::Middleware::BotProtection
         to expose the underlying PAGI::FastAPI::BotProtection::ProofOfWork
         instance for inspection and testing.
       - Fixed IP spoofing security vulnerability by ignoring untrusted
         'X-Forwarded-For' headers unless 'trust_proxies' is explicitly
         enabled.
       - Properly extract the original client IP from comma-separated
         'X-Forwarded-For' proxy chains when 'trust_proxies' is enabled.

       [TESTING]
       - Added unit test: t/36-middleware_bot_protection_trust_proxies.t

1.5.0  2026-08-25
       [SECURITY FIXES]
       - CWE-1188: Removed default fallback string 'change_me_in_production'
         from $secret in PAGI::FastAPI::BotProtection::ProofOfWork and
         PAGI::FastAPI::Middleware::BotProtection.
       - Enforced mandatory check for defined $secret; throws an exception
         when unconfigured.

       [POD]
       - Updated BotProtection SYNOPSIS and POD documentation to reflect
         required secret initialisation.

       [TESTING]
       - Added unit test: t/35-security_cwe_1188_secret_default.t

1.4.0  2026-08-24
       [SECURITY FIXES]
       - Fix silent dropping of object-based middleware in to_app() (CWE-306,
         CWE-352). Object middleware (implementing 'wrap' or 'call', such as
         CSRF and Basic Auth) registered via 'add_middleware' or 'enable_csrf'
         were ignored when deployed using to_app(), bypassing authentication
         and forgery protection. Unified to_app() and to_pagi() execution
         pipelines. Reported by CPANSec.

        [TESTING]
        - Add t/34-security_cwe_306_object_middleware_execution.t to verify
          object middleware pipeline execution in to_app().

1.3.0  2026-08-23
       [SECURITY FIXES]
       - Fix rate-limit key resolution using untrusted HTTP request headers
         (CWE-807). Default key_cb now strictly identifies clients by their
         TCP socket address ($c->scope->{client}[0]) rather than prioritising
         client-controlled headers. Header-derived identity can be explicitly
         enabled by setting 'trust_proxies => 1'. Reported by CPANSec.
       - Fix unbounded memory growth in PAGI::FastAPI::RateLimit::Driver::Memory
         (CWE-770). Enforce a maximum active key limit (`max_keys`, defaults
         to 10000) with key eviction, and add periodic probabilistic cache
         sweeps to purge stale entries. Reported by CPANSec.

       [ENHANCEMENTS]
       - Add trust_proxies parameter to PAGI::FastAPI::Middleware::RateLimit.
       - Add max_keys parameter and count() introspection method to
         PAGI::FastAPI::RateLimit::Driver::Memory.

       [TESTING]
       - Add t/32-security_cwe_807_key_spoofing.t to test header-spoofing resilience.
       - Add t/33-security_cwe_770_memory_cap.t to test driver memory bounds.

1.2.6  2026-08-23
       [DEMO]
       - Added demo app for Webhook: eg/webhook_demo.pl

1.2.5  2026-08-21
       [IMPROVEMENT]
       - Updated demo app and capture job_id when adding task.