Altair v0.2.1

Altair v0.2.1

The Phase 6 hardening wave, the redesigned website, and the end-to-end showcase demo. This is the last planned milestone before post-release work.

Highlights

• Sessions + flash + CSRF + auth — pluggable Altair::Session backed by an HMAC-SHA256 signed cookie store, one-request Flash, protect_from_forgery with constant-time token checks, and Altair::Auth::JWT (HS256) for stateless API auth — plus sign_in / sign_out / require_login / authenticate! helpers.
• File-driven configuration. .env / .env.<environment> and config/database.yml per-environment settings merged into config at boot.
• Multipart form parsing. File uploads arrive as Altair::HTTP::UploadedFile via params.upload("avatar"), with #save and #content.
• Security middleware set. SecurityHeaders (nosniff / SAMEORIGIN / referrer), RequestId (with request-scoped trace id), and opt-in Cors.
• Website redesign + new docs. Sessions, config, security and uploads guides; feature count bumped to 705 specs passing with Phase 6 complete.

Fixes

• Template form_for transpiler: helper actions with nested parens (e.g. form_for(post_path(post.id), ...)) and block forms no longer break the compile-time transpiler.
• altair update follows redirects: GitHub asset host redirects are now handled with bounded retries and timeouts.

Binaries

Standalone builds for Linux, macOS and Windows (amd64 + arm64), verified by SHA256SUMS. Install with curl -sSL https://.../install.sh | sh, then altair update.

See the CHANGELOG for the complete list.