v0.2.0

Race-safe idempotency keys

Two requests carrying the same new Idempotency-Key could previously both reach the payment provider before the unique constraint caught the second one. Keys are now reserved before the provider is called:

• A duplicate that arrives while the first request is still running gets 409 idempotency_key_in_progress with Retry-After, and the provider is called once.
• A request that fails releases its key, so the client can retry straight away.
• A request that crashes frees its key when IDEMPOTENCY_LOCK_SECONDS (new setting, default 60) runs out.
• A new CI job races 8 concurrent requests for one key on PostgreSQL and checks that exactly one wins.

Also in this release: CodeQL scanning, Dependabot, README screenshots, and a read-only CI token.

Upgrading from v0.1.0

ALTER TABLE idempotency_keys ADD COLUMN state VARCHAR(16) NOT NULL DEFAULT 'completed';
ALTER TABLE idempotency_keys ADD COLUMN locked_until TIMESTAMPTZ;
ALTER TABLE idempotency_keys ALTER COLUMN status_code DROP NOT NULL;
ALTER TABLE idempotency_keys ALTER COLUMN response_body DROP NOT NULL;

Full changelog: v0.1.0...v0.2.0 · PR #13