Skip to content

v0.28.0

Choose a tag to compare

View all tags
@AlexGalhardo AlexGalhardo released this 18 Oct 03:08
· 83 commits to main since this release
v0.28.0
ccb17a4

Added

  • site: Wrap code blocks and add Term and Quote components (7328830)
  • signed: Add Signer.WithClock for the app clock (b1fc8b0)
  • api: Eager-load includes and add a cursor-aware Request.CursorPaginate (ab96f97)
  • apidocs: Configurable route names for several references (751431c)
  • vukem: Add MiddlewareOptions.CSRFTokenFallback (656bc11)
  • vukem: Add WithViewFuncs for custom template functions (f5d6d4f)
  • vukem: Add WithEventsFake and WithRateLimiters options (f3f7efc)
  • BREAKING: config: Resolve @file: secrets in the process environment (ea204d2)
  • otel: Read OTEL_SERVICE_VERSION into service.version (5c32abe)
  • config: Escape a literal @file: value as @@file: (46a7c04)

Fixed

  • site: Fit the header on 390px phones (cbc14fe)
  • cli: Ignore .env.local in new projects (4a47421)
  • site: Fit code blocks and steps on phones (d077dac)
  • authz: Let T values use the policy registered for *T (242e495)
  • inertia: Name the page script after Config.RootID (6c57955)
  • inertia: Keep X-Inertia-Location on https behind a trusted proxy (a43acd6)
  • app: Warn about a missing Inertia error page without WithEnv (e8b6990)
  • authz: Document the shallow copy for value subjects and test fallback edges (a0ab556)
  • schema: Pluralise Constrained() targets like the orm (0605a43)
  • schema: Rebind ? placeholders in Raw for the dialect (43c7aa0)
  • orm: Name the Field() name in built-in rule messages (46745cd)
  • BREAKING: orm: Read Chunk batches by keyset instead of OFFSET (7e8b6ce)
  • BREAKING: orm: Cap Paginate and CursorPaginate per page at 100 (9f0bedf)
  • mongo: Answer 404 for ErrNotFound and return [] from All (2f02c82)
  • orm: Group OR filters in keyset Chunk and check the selected key up front (56659b5)
  • auth: Match the Bearer scheme case-insensitively (a7f1ed1)
  • jwt: Answer key set and user store outages with 503 (2d5e1b4)
  • cli: Revoke API tokens instead of deleting them on email proof (e75382d)
  • cli: Require the password and a rate limit to regenerate 2fa recovery codes (4d78c0a)
  • BREAKING: cli: Refuse install:auth --social x (694b6ae)
  • upload: Accept Verify keys for types outside the extension table (7658d96)
  • storage: Send the real Last-Modified and hide local temporary files (d031b68)
  • BREAKING: storage: Require UploadRules.Types in PutUploaded (d30d7aa)
  • schedule: Log lock errors and measure took from the task start (fb039f7)
  • upload: Keep scanner causes and log tus completion failures (709123d)
  • events: Name listeners by function and recover sync panics (eeb50d5)
  • vukem: Explain queue commands on in-process queue drivers (ff78253)
  • BREAKING: mail: Validate tags for every transport (938c891)
  • mail: Retry network errors in the Resend and Mailtrap transports (78da6ed)
  • BREAKING: vukem: Fail boot on a mail transport that cannot send (a74ee8d)
  • events: Re-panic http.ErrAbortHandler and wrap error panics from sync listeners (01ee89d)
  • api: Parse typed handler input with the request context and logger (0958e16)
  • BREAKING: api: Replay only representation headers on idempotent repeats (1925d67)
  • cli: Create the output directory of codegen:types -o (eee86eb)
  • graphql: Cost page-size arguments by their SDL default when omitted (903c041)
  • BREAKING: graphql: Reject introspection in Handler unless opted in (03d0326)
  • BREAKING: graphql: Validate nested inputs, mask Validate errors, check fields at build (3625e30)
  • openapi: Reject duplicate operationIds (beb0ac6)
  • api: Never replay credential headers on idempotent repeats (4282e95)
  • BREAKING: middleware: Let a route raise the router-wide body limit (bd64d69)
  • web: Send the c.Status code with the next writer's headers (daefe5c)
  • BREAKING: web: Reject unknown JSON fields in BindJSON as documented (1387d1b)
  • web: Answer 422 when FormFile reads a non-multipart request (c6243d2)
  • BREAKING: router: Make a group's "/" route exact like the root route (e6f8e5c)
  • router: Strip inlined-closure suffixes from middleware names (46edb46)
  • middleware: Detect fingerprints strictly and add ETags to embedded files (d11e4dd)
  • csrf: Trigger the token fallback on the session cookie only (b24352c)
  • web: Pass the error to error views in debug mode (067a370)
  • session: Report no id for cookie sessions, even after Regenerate (4bbb51e)
  • z: Use the singular in default messages for a count of 1 (a1b5717)
  • z: Leave Nullable-only keys out of the JSON Schema required list (004e63f)
  • middleware: Keep an earlier body limit in MethodOverride (ab1b31b)
  • web: Apply a pending status only to 200 and commit it on Flush (ff0e6fb)
  • BREAKING: view: Refuse custom template functions that replace built-ins (ed9a6df)
  • BREAKING: telegram: Honour info min level, never nil handler, html-safe send truncation (9f8715c)
  • broadcast: Reject channels with an empty dot segment (0c30e19)
  • BREAKING: webhook: Namespace dedupe keys per provider or route (e722635)
  • webhook: Record deliveries dropped for a disabled endpoint (a177d48)
  • BREAKING: stripe: Form-encode every map and slice type, refuse the rest (9958167)
  • cli: Pin install:billing to the latest contrib/stripe tag (79ef0c4)
  • BREAKING: i18n: Refuse plural objects without other, explain bad catalog names (be0512e)
  • devtools: Treat X-Forwarded-Proto, X-Forwarded-Port and Via as proxied (b10eb56)
  • flags: Stop repeating the flags prefix on invalid values (a15d214)
  • admin: Mount flag routes only for registered flags, skip no-op audits (da22e46)
  • admin: Match short secret words in column names as whole segments (f0e20df)
  • admin: Match secret words anywhere, exempt only known counters (2d8d4c2)
  • webhook: Never namespace dedupe keys by the raw request path (d477a32)
  • telegram: Count UTF-16 units and skip self-closing tags when truncating (05ee8b9)
  • stripe: Bound param nesting, refuse NaN/Inf and send []byte as a string (91d625a)
  • vukemtest: Restore Accept after JSON sends, match HX-Trigger lists and stored nils (d916cd5)
  • cli: Validate generator input before writing and create the policies registry (0a17532)
  • cli: Run templ generate before app-command rebuilds and watch .buildtags (727d365)
  • cli: Check bootstrap/app.go can be patched before install:inertia deletes files (0580ff6)
  • cli: Read APP_ENV from .env too when choosing embedded resources (e8166d5)
  • cli: Build the release binary with CGO_ENABLED=0 like the Dockerfile (0f5d2e1)
  • vukem: Report every boot configuration error at once (d31d8dc)
  • flags: Fail closed when a FLAG_ @file: secret cannot be read (430b7db)
  • vukem: Check @file: secrets are regular files before opening them (6d98bce)
  • schema: Defer closing the table listing rows on every return (320f9a1)

Security

  • vukem: Send security headers on the maintenance 503 (8eff044)
  • BREAKING: openapi: Consistent operationIds, plain route bodies, unknown schemes fail (22a766c)
  • api: Document v0.28 API, OpenAPI and GraphQL fixes and refresh stale names (88691b5)

Contributors

file
Assets 17
Loading