v0.29.0

Added

• site: Serve sitemap.xml and robots.txt for search engines (0b09352)
• cli: Add -prefix to openapi:export and the codegen generators (9062d20)
• api: Add RegisterWith for a caller-supplied input schema (bbc07c4)
• ulid: Add a monotonic ULID generator with Valid and TimeOf (f71f287)
• auth: Accept the token from extra headers, with Vary (3604e4c)
• queue: Let a handler report a permanent failure and see its attempt (6d90e21)
• postgres: Add an sse.Broker on LISTEN/NOTIFY (f6ce304)
• openapi: Carry examples in schemas, parameters and media types (cb9fff1)
• openapi: Reject a path prefix that matches no route (0ab4aaf)
• schema: Expose a Schema's dialect and record a migration's SQL (ad353df)
• queue: Ship the queue tables as a registrable migration (ddfe2fd)
• session: Ship the sessions table as a registrable migration (f5ae66b)
• cache: Ship the cache table as a registrable migration (4430efb)
• webhook: Ship the delivery log table as a registrable migration (38fdf2c)
• schema: Add stores.Migrations for the tables vukem owns (0408641)
• ui: Give the generated password fields a toggle and live rule checks (e5b876c)
• cli: Choose the auth message catalogs with install:auth --locales (6ca182d)

Changed

• auth: Read the listed token owner from its row (da63a05)
• cli: Keep starter package comments in a doc.go (264fb46)

Fixed

• apidocs: Give Scalar's caption labels and combobox field accessible markup (082ab73)
• release: Match changelog headings literally and refuse an empty body (89a19bb)
• openapi: Describe path parameters from their doc tag (174cdb3)
• cli: Pin install:billing to contrib/stripe v0.4.0 (9b51f70)
• cli: Keep the demo resource's links inside the demo (c3eb298)
• cli: Generate the Dockerfile for the package manager the project uses (3e3c92c)
• docker: Give the starter image a mailer so its commands can run (04b9c2b)
• cli: Make a fresh scaffold pass the repository's golangci-lint (d76e7b7)
• cli: Scope the API keys install:api mints instead of granting "*" (7791277)
• cli: Commit the generated git hooks with the executable bit (be9ceea)

Security

• vukem: Add WithOpenAPI so an app owns its document info (697c8a0)
• cli: Scaffold the project standards behind flags on vukem new (68e6763)
• cli: Point a new project at the documentation it needs next (bc09220)

v0.28.0

Added

• site: Wrap code blocks and add Term and Quote components (7328830)
• signed: Add Signer.WithClock for the app clock (b1fc8b0)
• api: Eager-load includes and add a cursor-aware Request.CursorPaginate (ab96f97)
• apidocs: Configurable route names for several references (751431c)
• vukem: Add MiddlewareOptions.CSRFTokenFallback (656bc11)
• vukem: Add WithViewFuncs for custom template functions (f5d6d4f)
• vukem: Add WithEventsFake and WithRateLimiters options (f3f7efc)
• BREAKING: config: Resolve @file: secrets in the process environment (ea204d2)
• otel: Read OTEL_SERVICE_VERSION into service.version (5c32abe)
• config: Escape a literal @file: value as @@file: (46a7c04)

Fixed

• site: Fit the header on 390px phones (cbc14fe)
• cli: Ignore .env.local in new projects (4a47421)
• site: Fit code blocks and steps on phones (d077dac)
• authz: Let T values use the policy registered for *T (242e495)
• inertia: Name the page script after Config.RootID (6c57955)
• inertia: Keep X-Inertia-Location on https behind a trusted proxy (a43acd6)
• app: Warn about a missing Inertia error page without WithEnv (e8b6990)
• authz: Document the shallow copy for value subjects and test fallback edges (a0ab556)
• schema: Pluralise Constrained() targets like the orm (0605a43)
• schema: Rebind ? placeholders in Raw for the dialect (43c7aa0)
• orm: Name the Field() name in built-in rule messages (46745cd)
• BREAKING: orm: Read Chunk batches by keyset instead of OFFSET (7e8b6ce)
• BREAKING: orm: Cap Paginate and CursorPaginate per page at 100 (9f0bedf)
• mongo: Answer 404 for ErrNotFound and return [] from All (2f02c82)
• orm: Group OR filters in keyset Chunk and check the selected key up front (56659b5)
• auth: Match the Bearer scheme case-insensitively (a7f1ed1)
• jwt: Answer key set and user store outages with 503 (2d5e1b4)
• cli: Revoke API tokens instead of deleting them on email proof (e75382d)
• cli: Require the password and a rate limit to regenerate 2fa recovery codes (4d78c0a)
• BREAKING: cli: Refuse install:auth --social x (694b6ae)
• upload: Accept Verify keys for types outside the extension table (7658d96)
• storage: Send the real Last-Modified and hide local temporary files (d031b68)
• BREAKING: storage: Require UploadRules.Types in PutUploaded (d30d7aa)
• schedule: Log lock errors and measure took from the task start (fb039f7)
• upload: Keep scanner causes and log tus completion failures (709123d)
• events: Name listeners by function and recover sync panics (eeb50d5)
• vukem: Explain queue commands on in-process queue drivers (ff78253)
• BREAKING: mail: Validate tags for every transport (938c891)
• mail: Retry network errors in the Resend and Mailtrap transports (78da6ed)
• BREAKING: vukem: Fail boot on a mail transport that cannot send (a74ee8d)
• events: Re-panic http.ErrAbortHandler and wrap error panics from sync listeners (01ee89d)
• api: Parse typed handler input with the request context and logger (0958e16)
• BREAKING: api: Replay only representation headers on idempotent repeats (1925d67)
• cli: Create the output directory of codegen:types -o (eee86eb)
• graphql: Cost page-size arguments by their SDL default when omitted (903c041)
• BREAKING: graphql: Reject introspection in Handler unless opted in (03d0326)
• BREAKING: graphql: Validate nested inputs, mask Validate errors, check fields at build (3625e30)
• openapi: Reject duplicate operationIds (beb0ac6)
• api: Never replay credential headers on idempotent repeats (4282e95)
• BREAKING: middleware: Let a route raise the router-wide body limit (bd64d69)
• web: Send the c.Status code with the next writer's headers (daefe5c)
• BREAKING: web: Reject unknown JSON fields in BindJSON as documented (1387d1b)
• web: Answer 422 when FormFile reads a non-multipart request (c6243d2)
• BREAKING: router: Make a group's "/" route exact like the root route (e6f8e5c)
• router: Strip inlined-closure suffixes from middleware names (46edb46)
• middleware: Detect fingerprints strictly and add ETags to embedded files (d11e4dd)
• csrf: Trigger the token fallback on the session cookie only (b24352c)
• web: Pass the error to error views in debug mode (067a370)
• session: Report no id for cookie sessions, even after Regenerate (4bbb51e)
• z: Use the singular in default messages for a count of 1 (a1b5717)
• z: Leave Nullable-only keys out of the JS...

v0.27.0

Added

• site: Add a changelog page linked from the header (6381fa5)
• auth: Add ProblemJSON so every API auth failure is problem+json (0c183cf)
• vukem: Warn once when proxy headers arrive without TRUSTED_PROXIES (06ee06a)
• ratelimit: Export IPKey and group throttle keys by it (b0e40f5)
• vukem: Let lazy store funcs fall back with ErrUseDefault (7c2b800)
• telegram: Read the Bot API base URL from TELEGRAM_API_URL (eaab1b3)
• fixinline: Check every go:fix inline wrapper against go fix (8655ddb)
• database: Add ScanTime for timestamps SQLite returns as text (7198679)
• factory: Add en and pt-BR locales with commerce and address data (9c5bf18)
• factory: Add CreateMany to insert factory models in batches (7dc730b)
• vukem: Select seeders and pass seeder flags in db:seed (4312444)
• flags: Add typed feature flags with a cached database store (30031c3)
• vukem: Register feature flags with WithFlags and build them with app.Flags (ffed272)
• admin: Add a feature flags page with audit events (041c0f5)
• cli: Add install:flags and wire feature flags into the admin scaffold (f70d6b0)
• web: Let a frontend adapter render the error page (358087f)
• cli: Ship an Error page in the Inertia starters (f9c00a7)
• BREAKING: vukem: Cap request headers at 64 KiB with HTTP_MAX_HEADER_BYTES (320b89b)
• grpc: Let operators raise the gRPC port's header cap (7db5602)
• vukem: Keep an existing ErrorPage hook and warn without an Error page (0ab65c5)

Changed

• vukem: Group the root package files by theme (a90f9c8)
• factory: Replace NewFakerWithLocale with Faker.WithLocale (fe297b4)
• flags: Type scopes, version cached values and describe flags with Info (5593d07)
• web: Pass error pages to the hook as a web.ErrorPage struct (b34be2b)

Fixed

• BREAKING: cli: Require the account's login to verify an email address (37da4e1)
• cli: Send expired verification links to the resend page (379620d)
• BREAKING: ratelimit: Key IPv6 clients by their /64 in ByIP (6f66901)
• vukem: Harden the ErrUseDefault fallback of lazy store funcs (9ac99f1)
• BREAKING: grpc: Give the gRPC port its own cleartext opt-in (91cf1f5)
• BREAKING: otel: Export metrics to the generic OTLP endpoint by default (4cb0b8e)
• apicheck: Reject trailing braces and foreign-major exception versions (4156585)
• orm: Scan text timestamps into time fields on SQLite (fc0eac7)
• vukem: Fail closed on db:seed --class without a name (4de9aa6)
• database: Accept space-separated RFC 3339 text in ScanTime (ea2ef1c)
• flags: Match FLAG_ keys exactly when checking for unknown flags (7895fad)
• vukem: Refuse FLAG_ keys in .env when no flag is registered (c5c2697)
• admin: Redact string flag values and survive a failed audit row (52881da)
• cli: Make install:flags safe to re-run (7bbcbf6)
• apidocs: Load the API reference with zero CSP violations (770263f)

Security

• repo: Move the community health files into .github (49c22b0)
• apicheck: Add a versioned exception list for security-driven breaks (e4542e7)
• BREAKING: inertia: Render an Error page for errors on Inertia requests (d9d3876)
• web: Render the built-in status pages under the default CSP (83fcc01)

drivers/postgres/v0.5.0

Module github.com/AlexGalhardo/vukem/drivers/postgres.

go get github.com/AlexGalhardo/vukem/drivers/postgres@v0.5.0

Changes under drivers/postgres/ since drivers/postgres/v0.4.0.

Added

• postgres: Add an sse.Broker on LISTEN/NOTIFY (f6ce304)
• session: Store hashed ids and revoke a user's other sessions (a79cc72)

Fixed

• auth: Keep revoking possible on access_tokens without revoked_at (30404bd)
• session: Never resurrect revoked sessions and harden legacy re-key (ed1a998)

drivers/otel/v0.4.0

Module github.com/AlexGalhardo/vukem/drivers/otel.

go get github.com/AlexGalhardo/vukem/drivers/otel@v0.4.0

Changes under drivers/otel/ since drivers/otel/v0.3.0.

Added

• otel: Read OTEL_SERVICE_VERSION into service.version (5c32abe)

drivers/otel/v0.3.0

Module github.com/AlexGalhardo/vukem/drivers/otel.

go get github.com/AlexGalhardo/vukem/drivers/otel@v0.3.0

Changes under drivers/otel/ since drivers/otel/v0.2.0.

Fixed

• otel: Export metrics to the generic OTLP endpoint by default (4cb0b8e)

drivers/mongo/v0.2.1

Module github.com/AlexGalhardo/vukem/drivers/mongo.

go get github.com/AlexGalhardo/vukem/drivers/mongo@v0.2.1

Changes under drivers/mongo/ since drivers/mongo/v0.2.0.

Fixed

• mongo: Answer 404 for ErrNotFound and return [] from All (2f02c82)

contrib/stripe/v0.4.0

Module github.com/AlexGalhardo/vukem/contrib/stripe.

go get github.com/AlexGalhardo/vukem/contrib/stripe@v0.4.0

Changes under contrib/stripe/ since contrib/stripe/v0.3.0.

Fixed

• stripe: Bound param nesting, refuse NaN/Inf and send []byte as a string (91d625a)
• stripe: Form-encode every map and slice type, refuse the rest (9958167)

contrib/grpc/v0.4.0

Module github.com/AlexGalhardo/vukem/contrib/grpc.

go get github.com/AlexGalhardo/vukem/contrib/grpc@v0.4.0

Changes under contrib/grpc/ since contrib/grpc/v0.3.0.

Added

• grpc: Let operators raise the gRPC port's header cap (7db5602)

Fixed

• grpc: Give the gRPC port its own cleartext opt-in (91cf1f5)

contrib/graphql/v0.4.0

Module github.com/AlexGalhardo/vukem/contrib/graphql.

go get github.com/AlexGalhardo/vukem/contrib/graphql@v0.4.0

Changes under contrib/graphql/ since contrib/graphql/v0.3.0.

Fixed

• graphql: Validate nested inputs, mask Validate errors, check fields at build (3625e30)
• graphql: Reject introspection in Handler unless opted in (03d0326)
• graphql: Cost page-size arguments by their SDL default when omitted (903c041)