Skip to content

Suprnova v0.7.0

Choose a tag to compare

View all tags
@eas4ai eas4ai released this 27 Jul 03:16
· 234 commits to main since this release
v0.7.0
c3ba532

Security

  • Upgraded ammonia to 4.1.4 (RUSTSEC-2026-0213). Versions through 4.1.3
    allow XSS via SVG animate and set animation tags. ammonia is the
    sanitizer at the end of Suprnova's markdown pipeline
    (comrak → syntect → ammonia), so any app rendering user-supplied
    Markdown through content was exposed. The advisory was published
    2026-07-21 — after v0.6.5 shipped — so every release up to and including
    v0.6.5 is affected    . Upgrading the framework is the fix; no application
    code changes are required.

Added

  • Queue routing. Jobs can be dispatched to a specific queue and connection,
    and workers can be dedicated to specific queues — the Laravel 13
    Queue::route(...) surface, typed. A job states its own home with
    Job::queue() / Job::connection(); an operator overrides it centrally with
    Queue::route::<SendInvoice>(Some("redis"), Some("billing")) in
    bootstrap::register(), without editing the job. Resolution is route, then
    job, then global default, and a None field in a route defers rather than
    clearing. queue:work --queue=billing,default drains only those queues.
    Unrouted jobs belong to default, so they are never stranded. Chained jobs
    resolve routes by name, since a chain link stores its job erased.
  • QueueDriver::pop_from. Filtering pop, with a default implementation that
    rejects a filter it cannot honor rather than silently draining every
    queue — a worker told to drain billing that quietly drains everything is
    indistinguishable from a working deployment until the wrong pool eats the
    wrong jobs. The memory and database drivers filter natively. Custom drivers
    keep compiling and inherit the loud default.
  • Documented the jobs table schema. manual/queues.md now carries the DDL
    DatabaseQueueDriver actually expects, which was previously only discoverable
    by reading the driver's SQL.
  • Documented Inertia's serverHead option. Server-driven <head> elements
    (Inertia 3.5.0) need no framework support: the client reads them from an
    ordinary prop, so any handler can already supply them. See
    manual/frontend-inertia-responses.md.

Changed

  • Envelope gained a queue: Option<String> field. It is serde(default) and
    skipped when absent, so an unrouted envelope serializes byte-identically to
    what previous versions wrote — the frozen wire-format test passes unchanged,
    there is no schema_version bump, and mixed-version fleets interoperate
    during a rolling upgrade.
  • WorkerConfig gained a queues: Vec<String> field (empty = drain everything,
    the previous behaviour).
  • Removed ROADMAP.md. Its design principles live in manual/introduction.md,
    the working agreement in manual/contributions.md, and the deployment and
    scale-out material in manual/deployment.md; the shipped/planned checklists
    had gone stale. README.md's pointer to it for "the relationship to upstream"
    was already dangling — that attribution lives in LICENSE.
  • Scaffold frontends now pin @inertiajs/{svelte,react,vue3} at ^3.6.1
    (from ^3.4.0). The 3.4.0 → 3.6.1 range is client-side only — audited against
    the upstream changelog and the Page contract in packages/core/src/types.ts,
    every X-Inertia-* header the 3.6.1 client sends was already handled.
  • scripts/release.sh now publishes the GitHub release itself, with notes taken
    from the version's CHANGELOG.md section. Previously this was a manual
    "next step" that got skipped, which is why v0.5.10 and v0.6.1–v0.6.3 are
    tag-only and the Releases page sat on a stale version. Preflight runs before
    the gate so a missing gh or changelog section fails in seconds, and
    publishing is skipped automatically unless origin is GitHub.

Upgrading

Existing jobs tables on the database queue driver must add the new
column — push names it in its INSERT whether or not the job is routed, so
an un-migrated table fails every push. Migrate first, then roll binaries
(older binaries list their columns explicitly and ignore the new one, so that
order is safe):

ALTER TABLE jobs ADD COLUMN queue TEXT NULL;
CREATE INDEX idx_jobs_queue ON jobs(queue);

(Corrected in 0.7.1 — this note originally claimed unfiltered deployments
needed no migration.)

Assets 2
Loading