reqit v1.2 — Performance & Security Release
Performance
- Async disk I/O: env vars merge & cookie saves off the hot path (goroutine)
- Goja VM pool: reuse JS runtimes instead of creating 2 per request
- Fast-path var resolution:
strings.Contains("{{")skips regex for most fields - Response body freed immediately after string conversion — halves peak memory
- Load test: lock-free channel collector, shared
strings.Replacer, fast-path checks - Runner: no wasted per-goroutine env alloc, result write outside mutex
- Debounced collection saves (200ms) with per-collection RWMutex
- Lazy-load request bodies (GetAllSummary instead of full payloads)
Security
- SSRF validation wired into request execution path
- DNS-rebinding gap closed (resolves all IPs before checking)
- Vault API tokens redacted from IPC bridge (no longer sent to frontend)
- SanitizeExecArg hardened (blocks short-flag injection)
Storage
- Per-collection JSON files + index.json (was single collections.json)
- Request ID index for O(1) lookups
- Generic mutateColl/mutateReq helpers cut boilerplate
UX
- Assistant bot is now draggable (click-hold to reposition)
- Live idle animation + green pulse indicator on bot
- Auto-complete dropdown closes on select / outside click
- Bulk edit modal responsive layout
- Sidebar responsive spacing (260px→280px)
- New collections appear at top
- Real browser preview button in URL bar
- Release popup with version info
Templates & Workspaces
- Demo workspace with live WebSocket, GraphQL, HTTPBin templates
- Workspace data isolation (reloads collections/history/envs on switch)
- GraphQL requests open in dedicated GraphQL view
- Real GraphQL queries in templates (no placeholders)