PyNext 0.1.2

PyNext 0.1.2 fixes review #7's custom rate-limit exemption bypass and the remaining ASGI admission differences from review #6 (PRs #19 and #21).

• Custom hooks delegating to super().is_exempt() preserve decoded literal ? characters, including after str(path). /input%3Fother cannot inherit /input's exemption. Direct public query-aware calls remain compatible.
• Encoded health probes take precedence over same-name public assets on the native server. Cancellation is recorded as 499 for connection/task cancellation or 504 for a native handler deadline, instead of an internal error, including cooperative worker exit before coroutine cancellation. Header-admitted static responses remain in Rust when a limiter is configured.
• Typed pynext.__version__, installed metadata and the compiled native version all identify 0.1.2. All three Cargo workspace crates and the lockfile are aligned, and isolated wheel checks enforce consistency.
• ASGI HTTP and WebSocket share 64 unfinished decisions and a two-second deadline per decision. This limits concurrency, not requests per two seconds. Synchronous callbacks run in the host executor; running work retains capacity after timeout/cancellation, and expired/cancelled queued work never calls the limiter.
• Invalid HTTP paths return 400 before consuming a token. Decision failures, invalid results, timeouts and saturation fail closed with 503 Retry-After: 1.

Already running external calls cannot be forcibly cancelled or rolled back; late token consumption remains possible. Configure backend I/O deadlines. The ASGI host manages whole-request and shutdown timeouts. Use remains limited to small websites and controlled pilots; public production suitability has not been established.

Validation: Python 3.13 full suite 872 passed, 1 skipped; Python 3.14 related suite 174 passed; 18 Rust tests and strict clippy; real Redis/PostgreSQL and Redis restart; installed-wheel mypy/pyright, HTTP serving and Chromium on Axum/Uvicorn. B-1, B-2 and B-3 were reproduced before fixing. CI verifies eight binary wheels and one source distribution across the supported platforms.

pip install pynext-framework==0.1.2
python -c "import pynext; print(pynext.__version__)"

Review #7 fixes · Release notes · Admission contract · Roadmap · PyPI

Attachments include verified distributions, Python/native/image SBOMs, audit reports and SHA256 checksums. Image gating covers fixable High/Critical findings; scan scope is documented in the repository. Prepared by Codex and published using the connected maintainer account and registered PyPI token.

PyNext 0.1.1

PyNext 0.1.1 consolidates PR #17 and includes PR #18's review fixes.

Use only for small websites and controlled pilots. Public production suitability has not been established; further specification and improvement are planned.

• Header-stage HTTP admission, shared HTTP/WebSocket decision capacity, and explicit no-refund behavior.
• Static CORS parity, navigation race fixes, scheme/port-aware CSRF validation, and cooperative synchronous-handler cancellation with retained capacity.
• Non-root, read-only Docker deployment; Python/native/image SBOMs and dependency/image vulnerability checks.
• Public API stubs and py.typed, verified from installed wheels with mypy and pyright.
• Repeated production-build benchmark: 84,000 requests, zero HTTP errors; same-host regression evidence with tail latency and limitations preserved.
• Pillow 13.0.0 and PyO3 0.29.3 security updates.

Validation: 45/45 remote checks, Python 3.13 and 3.14 each 812 passed, 1 skipped, Rust checks, both browser server modes, eight verified wheels and one sdist. The release commit acffbbf25e5e885454ee89e2aee7e407cf806ecc has exactly the tested b98ccb2 tree.

pip install pynext-framework==0.1.1

Release notes · Implementation scope and limits · Production roadmap · PyPI

Assets include SHA256 checksums, Python and native CycloneDX SBOMs, the image SPDX SBOM, audit reports and the raw repeated benchmark. Python/native inventories include development/tool dependencies; the image inventory describes the runtime. Image audit gating covers fixable High/Critical findings. The native SBOM was generated with Syft 1.57.0 from this release's complete Cargo.lock; Python/image reports came from the passing PR workflow.

Prepared by Codex; publishing uses the connected maintainer account and registered PyPI token. Existing historical tags remain intact.

PyNext 0.1.0

PyNext 0.1.0 is an experimental Python and Rust web framework. The package supports CPython 3.13 and 3.14.

Install the published package from PyPI:

pip install pynext-framework==0.1.0

The source changes are available in PR #8.

• Global HTTP middleware, bounded multipart uploads, development error pages, and pynext init.
• Resource lifecycle hooks, SQLite sessions and session-bound CSRF, and authentication and authorization hooks.
• SQLite and Redis shared ISR, Redis-backed rate limiting, cache invalidation, and streaming SSG/ISR.
• Shared island hydration, client-side navigation, JS/TS island development hot replacement, WebSocket controls, and process-local pub/sub.
• Shared-listener workers, Linux standalone builds, optional image optimization, and OpenTelemetry coverage.

The island model is a limited subset; hot replacement can reset island state. Linux standalone builds require compatible system libraries. Django integration is deferred, and React/RSC compatibility is out of scope. The framework remains experimental and is not hardened for direct public internet exposure or untrusted applications. See the release notes and roadmap.

Wheels cover Linux x86-64 (manylinux 2.34+), macOS ARM64, and Windows x86-64; the source distribution requires a Rust toolchain. The version 0.1.0 sorts below the earlier development candidate 0.7.0a1, so existing installations may need an explicit version selection. The pre-existing v0.1.0 tag is unchanged; this release uses 0.1.0v.

PyNext v0.6.0a2 (experimental)

PyNext v0.6.0a2 (experimental)

This is a prerelease of an experimental Python and Rust full-stack framework. It is not compatible with Next.js, React, or React Server Components, and it is not a production security boundary.

What's new

• Stream asynchronous API responses on ASGI and Axum with bounded chunks, backpressure, and disconnect cancellation. Page SSR is still buffered.
• Serve conditional and single-byte-range requests for public assets, SSG pages, and island bundles using content-based ETags.
• Invalidate individual ISR paths in the current process, with protection against an older in-flight render repopulating the cache.
• Activate a hydrated island on a supported button click and replay up to 16 queued clicks after hydration. Keyboard activation is covered; links and form submissions retain their normal behavior.
• Add trie-based routing, configurable native request admission, bounded waiting, HTTP/1 header timeouts, and HTTP/2 prior-knowledge (h2c) support.

Important limits

An already running synchronous Python handler can continue after a timeout or disconnect. ISR caches and invalidation are process-local. Interaction replay supports user clicks on button type="button" after the island's listener is registered; replayed events are synthetic (isTrusted=false). A DOM mismatch, removal, or activation failure discards pending clicks, and overflow clicks are dropped with a warning. Other events are not replayed.

Distributed ISR, streaming SSR, React/RSC, OpenTelemetry, worker isolation, standalone builds, and general client navigation remain unimplemented. Do not expose this prototype directly to the public internet or run untrusted applications with it. See the production roadmap.

Verification and manuals

The release commit passed CI on Linux, macOS, and Windows with Rust and Python tests, package installation and HTTP serving, an example production build, a bounded load smoke test, and Chromium end-to-end tests.

English · 한국어 · 日本語 · 简体中文

Distribution

The source distribution requires CPython 3.13 and a Rust toolchain. Attached CPython 3.13 wheels target Linux x86-64, macOS arm64, and Windows x86-64. The Linux wheel has a linux_x86_64 tag and is not a manylinux wheel. SHA256SUMS lists checksums. This GitHub prerelease is not a PyPI publication. PyNext is licensed under MIT; third-party notices are included.

PyNext v0.6.0a1 (experimental)

PyNext v0.6.0a1 (experimental)

This is an alpha release of an experimental prototype. It is not a production security boundary and is not compatible with Next.js, React, or React Server Components.

Request admission

• Separate the 64 request-body intake slots from the 64 Python execution slots. Request bodies are limited to 1 MiB, and a body read must complete within 10 seconds; timeouts return 408, oversized bodies return 413, and exhausted capacity returns 503.
• Static files and fresh ISR cache hits can be served while Python execution slots are saturated. HTTP/1 connections with unread rejected bodies are closed.
• Add regression tests with slow and disconnected uploads and saturated Python handlers.

Application modules

Page, layout and API modules support package-relative imports and use an isolated module namespace for each app. Imports use current Python source rather than stale timestamp-based bytecode. Invalid ISR policies are rejected during app loading.

Breaking change: PyNext no longer prepends each project root to the process-wide sys.path. If a root-based absolute import no longer resolves, migrate it to a relative import or install the project as a Python package.

Verification and manuals

118 Python tests, five Rust tests, Rust lint, Chromium checks against the server's actual CSP, example HTTP and API checks, and an isolated wheel installation and example build. CI passed on Linux, macOS and Windows.

English · 한국어 · 日本語 · 简体中文

Known limitations

The body deadline does not limit HTTP header reading or the total number of connections. An already running synchronous handler can continue after a 504, including writes. Use explicit upstream timeouts and idempotency. ISR remains process-local. Zero-copy, streaming, distributed ISR, React/RSC, OpenTelemetry, worker isolation and standalone packaging are not implemented. Do not expose the prototype directly to the public internet. See the production roadmap.

Assets

The source distribution requires Python 3.13 and Rust. The attached native wheel is for CPython 3.13 on Linux x86-64; it is not a universal or manylinux wheel. SHA256SUMS contains checksums. This is a GitHub prerelease, not a PyPI publication. PyNext is licensed under MIT, and third-party notices are retained.

PyNext v0.5.0 (experimental)

PyNext v0.5.0 (experimental)

PyNext remains an experimental prototype. It is not a production security boundary and is not compatible with Next.js, React, or React Server Components.

Included

• Report attempted request throughput separately from successful 2xx throughput, with error rate, status-code distribution, transport errors and p50/p95/p99 latency for all attempts and successes.
• Report response sizes, process CPU scope and lifetime peak RSS. When benchmarking a separately running local Linux server, optionally sample CPU for its PID and threads.
• Run the CI suite on Linux, macOS and Windows; build and install a wheel in isolation; save bounded benchmark measurements; and run Chromium end-to-end checks on Linux.
• Normalize module paths and safely invoke the esbuild Node wrapper on Windows.
• Update the English, Korean, Japanese and Simplified Chinese manuals.

Manuals

English · 한국어 · 日本語 · 简体中文

PyNext is licensed under MIT. Third-party notices are retained.

Verification

100 Python tests, five Rust tests, Chromium smoke checks, isolated wheel installation and example build. The platform matrix is linked from the release commit's GitHub Actions checks.

Release assets

The source distribution requires supported Python 3.13 and Rust. The attached native wheel is for CPython 3.13 on Linux x86-64 and was verified in the build environment; it is not a universal or manylinux wheel. SHA256SUMS contains checksums. These GitHub assets are not a PyPI publication.

Known limitations

A synchronous handler already executing can continue after a 504 timeout. ISR is process-local. The benchmark's default CPU and peak RSS include the client and server together, and CI records a bounded smoke benchmark without automated performance or memory regression thresholds. Zero-copy, streaming, distributed ISR, React/RSC, OpenTelemetry, worker isolation and standalone packaging are not implemented. See the production roadmap.

Request-body admission issue: In v0.1.0–v0.5.0, slow request bodies can occupy all native execution slots and cause 503 responses. v0.6.0a1 adds a bounded body-read pool and deadline. Header timeouts and total connection limits still require separate controls. Running synchronous handlers can still continue after a 504. These releases remain experimental and should not be exposed directly to the public internet.

PyNext v0.4.0 (experimental)

PyNext v0.4.0 (experimental)

This is an experimental release, not a production-ready or Next.js/React-compatible framework. Do not expose it directly to the public internet.

Included

• Island activation strategies: load, visible and idle, with scheduling fallbacks and cancellation.
• Malformed query UTF-8 and JSON return HTTP 400 via ASGI and Axum.
• Limit parsed query fields, validate response headers, and add default CSP and cache-variation headers.
• English, Korean, Japanese and Simplified Chinese manuals and a production roadmap.

Manuals

English · 한국어 · 日本語 · 简体中文

PyNext is licensed under MIT. Third-party notices are retained.

Verification

92 Python tests and five Rust tests; Chromium SSR/SSG/ISR, hydration and lazy activation smoke test; isolated wheel installation and example build.

Release assets

The source distribution requires a supported Python 3.13 and Rust toolchain. The native wheel is for CPython 3.13 on Linux x86-64 and was verified in the build environment; it is not a universal or manylinux wheel. SHA256SUMS contains checksums. These GitHub assets are not a PyPI publication.

Known limitations

ISR is process-local. A synchronous handler already executing can continue after a 504 timeout. WebSockets, streaming, distributed ISR, React/RSC, OpenTelemetry and standalone packaging are not implemented. This release is not a production security boundary.

Production roadmap and acceptance criteria.

Request-body admission issue: In v0.1.0–v0.5.0, slow request bodies can occupy all native execution slots and cause 503 responses. v0.6.0a1 adds a bounded body-read pool and deadline. Header timeouts and total connection limits still require separate controls. Running synchronous handlers can still continue after a 504. These releases remain experimental and should not be exposed directly to the public internet.

PyNext v0.3.0 (experimental)

PyNext v0.3.0 (experimental)

This is an experimental release, not a production-ready or Next.js/React-compatible framework. Do not expose it directly to the public internet.

v0.1.0–v0.3.0 were reconstructed from preserved development source distributions and released together. These are not claims of earlier published releases.

Included

• Opt-in island hydration, server DOM comparison, mismatch recovery and cleanup.
• All server and island-mounting functionality from v0.2.0.
• The later malformed-query/JSON fix was backported to this reconstructed snapshot.

Manuals

English · 한국어 · 日本語 · 简体中文

PyNext is licensed under MIT. Third-party notices are retained.

Verification

66 Python tests; Chromium mount and DOM-preserving hydration smoke test; isolated wheel installation and example build.

Release assets

The source distribution requires a supported Python 3.13 and Rust toolchain. The native wheel is for CPython 3.13 on Linux x86-64 and was verified in the build environment; it is not a universal or manylinux wheel. SHA256SUMS contains checksums. These GitHub assets are not a PyPI publication.

Known limitations

ISR is process-local. A synchronous handler already executing can continue after a 504 timeout. WebSockets, streaming, distributed ISR, React/RSC, OpenTelemetry and standalone packaging are not implemented. This release is not a production security boundary.

Lazy activation strategies are not included in this version.

Request-body admission issue: In v0.1.0–v0.5.0, slow request bodies can occupy all native execution slots and cause 503 responses. v0.6.0a1 adds a bounded body-read pool and deadline. Header timeouts and total connection limits still require separate controls. Running synchronous handlers can still continue after a 504. These releases remain experimental and should not be exposed directly to the public internet.

PyNext v0.2.0 (experimental)

PyNext v0.2.0 (experimental)

This is an experimental release, not a production-ready or Next.js/React-compatible framework. Do not expose it directly to the public internet.

v0.1.0–v0.3.0 were reconstructed from preserved development source distributions and released together. These are not claims of earlier published releases.

Included

• JavaScript/TypeScript island bundling, browser mounting and cleanup.
• All server and static-generation functionality from v0.1.0.
• The later malformed-query/JSON fix was backported to this reconstructed snapshot.

Manuals

English · 한국어 · 日本語 · 简体中文

PyNext is licensed under MIT. Third-party notices are retained.

Verification

61 Python tests; Chromium mount/click smoke test; isolated wheel installation and example build.

Release assets

The source distribution requires a supported Python 3.13 and Rust toolchain. The native wheel is for CPython 3.13 on Linux x86-64 and was verified in the build environment; it is not a universal or manylinux wheel. SHA256SUMS contains checksums. These GitHub assets are not a PyPI publication.

Known limitations

ISR is process-local. A synchronous handler already executing can continue after a 504 timeout. WebSockets, streaming, distributed ISR, React/RSC, OpenTelemetry and standalone packaging are not implemented. This release is not a production security boundary.

Hydration and lazy activation are not included in this version.

Request-body admission issue: In v0.1.0–v0.5.0, slow request bodies can occupy all native execution slots and cause 503 responses. v0.6.0a1 adds a bounded body-read pool and deadline. Header timeouts and total connection limits still require separate controls. Running synchronous handlers can still continue after a 504. These releases remain experimental and should not be exposed directly to the public internet.

PyNext v0.1.0 (experimental)

PyNext v0.1.0 (experimental)

This is an experimental release, not a production-ready or Next.js/React-compatible framework. Do not expose it directly to the public internet.

v0.1.0–v0.3.0 were reconstructed from preserved development source distributions and released together. These are not claims of earlier published releases.

Included

• File-based routing, buffered SSR and API handlers on Python + Rust.
• ASGI and Axum adapters, SSG, public files and process-local ISR.
• The later malformed-query/JSON fix was backported to this reconstructed snapshot.

Manuals

English · 한국어 · 日本語 · 简体中文

PyNext is licensed under MIT. Third-party notices are retained.

Verification

43 Python tests; six-route example build; isolated wheel installation and example build.

Release assets

The source distribution requires a supported Python 3.13 and Rust toolchain. The native wheel is for CPython 3.13 on Linux x86-64 and was verified in the build environment; it is not a universal or manylinux wheel. SHA256SUMS contains checksums. These GitHub assets are not a PyPI publication.

Known limitations

ISR is process-local. A synchronous handler already executing can continue after a 504 timeout. WebSockets, streaming, distributed ISR, React/RSC, OpenTelemetry and standalone packaging are not implemented. This release is not a production security boundary.

Islands, hydration and lazy activation are not included in this version.

Request-body admission issue: In v0.1.0–v0.5.0, slow request bodies can occupy all native execution slots and cause 503 responses. v0.6.0a1 adds a bounded body-read pool and deadline. Header timeouts and total connection limits still require separate controls. Running synchronous handlers can still continue after a 504. These releases remain experimental and should not be exposed directly to the public internet.