v0.2.0

Changelog

• 66cb873: ci: bump actions/checkout from 4 to 7 (#104) (@dependabot[bot])
• a1d0ee3: ci: bump actions/setup-go from 5 to 6 (#100) (@dependabot[bot])
• 530c0ca: ci: bump docker/build-push-action from 6 to 7 (#102) (@dependabot[bot])
• ebc3b78: ci: bump docker/login-action from 3 to 4 (#103) (@dependabot[bot])
• 2e09450: ci: bump docker/setup-buildx-action from 3 to 4 (#101) (@dependabot[bot])
• e28e82d: ci: bump goreleaser/goreleaser-action from 6 to 7 (#106) (@dependabot[bot])
• 8d3f513: docs(bench): httpload header — document -n and -verify integrity mode (#93) (@vt128)
• 3f52336: docs(changelog): date v0.2.0 for release (#118) (@vt128)
• d632f49: docs(changelog): record the review fix wave (MQLITE-58/60/61/62/63/64) (#116) (@vt128)
• 681134e: docs(concepts): complete the message-lifecycle state machine (MQLITE-52) (#105) (@vt128)
• bf97cae: docs+test(engine): pin deferred-message head-of-line as an invariant (MQLITE-48) (#86) (@vt128)
• 96aa800: feat(engine): cap message TTL at the queue default + surface expires_at on peek (#80) (@vt128)
• 8f4d0d6: feat(engine): reclaim free pages in the background via incremental_vacuum (MQLITE-53) (#89) (@vt128)
• 6dfeae6: feat(metrics): lifetime completed-message counter (MQLITE-54) (#97) (@vt128)
• ea93eec: feat(serve): colourised broker logging (charmbracelet/log) + per-request access log (#76) (@vt128)
• 5dea4a3: feat(serve): millisecond precision in the broker log timestamp (#78) (@vt128)
• e7672b6: feat(server): CORS so a browser console on another origin can reach the broker (#72) (@vt128)
• 2cc0eb2: feat(server): ListSubscriptions + TestFilter endpoints (console support) (#71) (@vt128)
• a3eedf7: feat(server): desensitized Status endpoint (runtime snapshot for an ops view) (#74) (@vt128)
• 7043628: feat(server): embed the admin console at /ui with MQLITE_UI off-switch (#84) (@vt128)
• 131bbe7: feat(server): enrich access log with per-request context + demote idle Receives (MQLITE-49) (#87) (@vt128)
• 64684c2: feat(server): per-RPC latency histogram in /metrics (observability) (#96) (@vt128)
• c850853: fix(ci): run the Go 1.21 macOS leg on macos-14 (macOS 15 dyld rejects 1.21 binaries) (#73) (@vt128)
• c8be425: fix(engine): FIFO holds across lock expiry — expired locks keep blocking their group (MQLITE-56) (#107) (@vt128)
• b9f6b88: fix(engine): TTL dead-letter branch covers 'scheduled' like the discard branch (MQLITE-61) (#110) (@vt128)
• 1bb6436: fix(engine): crash recovery dead-letters over-max locks instead of redelivering (MQLITE-58) (#113) (@vt128)
• 42bc2f1: fix(engine): drive incremental_vacuum to completion so the file actually shrinks (MQLITE-53) (#91) (@vt128)
• 9438098: fix(engine): key the single-writer lock on the canonical DB path (MQLITE-60) (#112) (@vt128)
• 56b9f7f: fix(engine): queue/subscription/topic names are one disjoint namespace (MQLITE-57) (#108) (@vt128)
• e7f2ff8: fix(engine): randToken crashes loudly on CSPRNG failure instead of issuing zero tokens (MQLITE-63) (#111) (@vt128)
• c663993: fix(image): add tzdata to the release image (alongside ca-certificates) (#70) (@vt128)
• ac7cc78: fix(server): a publish that matches no subscription is a no-op, not a 409 (#82) (@vt128)
• a2e67a2: fix(server): only registered routes get RPC-latency labels (MQLITE-62) (#114) (@vt128)
• cdd3abf: fix(server,engine): hardening bundle — body cap, timeouts, const-time auth, exact /ui, schema golden test, batch reset (MQLITE-64) (#115) (@vt128)
• 1949ac1: perf(engine): checkpoint after reclaim so freed space returns to the OS (MQLITE-53) (#90) (@vt128)
• 5e7744c: perf(engine): claim a Receive batch in one transaction, not N (MQLITE-50) (#88) (@vt128)
• 71a4d41: test(bench): add -verify integrity mode (+ -n) to httpload (#92) (@vt128)
• 8417fcf: test(bench): add httpload — HTTP load harness for a running broker (#85) (@vt128)
• d519f0f: test(engine): concurrent-drain benchmark + janitor query-plan guards (perf detection) (#95) (@vt128)
• 36cbfbe: test(engine): pin background-loop query plans to their indexes (#94) (@vt128)
• 6f98e17: test(mcp): guard schema ↔ forward ↔ wire consistency (#75) (@vt128)

v0.1.1

Changelog

• 5d3c18f: ci: publish multi-arch image to GHCR on release tags (#45) (@vt128)
• 9e603a1: docs(readme): discovery endpoint, DLQ retention, benchmarks & integrity (MQLITE-28, MQLITE-46) (#50) (@vt128)
• 1f89b82: feat(api): CompleteBatch — settle a received batch in one round-trip (MQLITE-45) (#58) (@vt128)
• fd8e11e: feat(bench): remote-backend (Turso) support for the load generator (MQLITE-41) (#67) (@vt128)
• 77e0a94: feat(engine): DLQ retention byte cap — MQLITE_DLQ_MAX_BYTES, drop-oldest (MQLITE-28) (#52) (@vt128)
• e1166bb: feat(engine): body_text / body_json subscription filter fields (MQLITE-47) (#63) (@vt128)
• b8eba9d: feat(engine): default DLQ retention — drop-oldest past age + count (MQLITE-28) (#47) (@vt128)
• f4d5e58: feat(engine): expr subscription filters — Filter{Expr} predicate (MQLITE-17) (#62) (@vt128)
• 65bcc07: feat(engine): per-queue DLQ retention overrides (MQLITE-29, schema v2) (#64) (@vt128)
• 09e56f0: feat(mcp): mqlite-mcp — MCP server exposing the broker as agent tools (MQLITE-18) (#56) (@vt128)
• 51d410c: feat(server): open "/" discovery endpoint — JSON name/version/status, no auth (MQLITE-46) (#49) (@vt128)
• 11552b8: feat(server): secure-by-default broker auth — auto-generate a token when unset (#68) (@vt128)
• fdbdb86: test(bench): comprehensive resource suite + local/cloud report (MQLITE-41) (#46) (@vt128)
• d81158e: test(engine): integrity sweep (no-loss + content hash) + embedded benchmarks (MQLITE-44) (#48) (@vt128)
• 9762bad: test(turso): calibrate TestTursoConcurrent for real-remote latency (#61) (@vt128)

mqlite v0.1.0 — first release

A small, SQLite/Turso-backed message queue with Azure Service Bus–style
semantics, in a single pure-Go binary (no CGO). Embed it in your Go process like
goqite, or run it as an HTTP broker — the same engine.

Highlights

• Peek-Lock delivery with four-way settle (Complete / Abandon / Reject /
  Defer), Renew, fencing tokens, and delivery_count → dead-letter queue.
• Dedup (idempotent send), idempotent receive/settle (attempt-id), and
  scheduled / deferred messages.
• Ordering modes: standard (per-GroupID FIFO with cross-group parallelism),
  group_fifo, and strict_fifo.
• Topics + subscriptions with subject-prefix filters; DLQ redrive /
  purge.
• One engine, two front-ends: run it embedded (in-process, with same-DB
  transactional enqueue) or as a broker (JSON-over-HTTP + Bearer auth). Storage
  is local SQLite or remote Turso/libSQL, selected by a connection string.

Quality

Verified on this release's runtime (commit d0d89da; the tag adds only
documentation on top):

• CI green: test matrix on macOS / Linux / Windows × Go 1.21.x + stable, -race,
  golangci-lint (0 issues), per-package coverage gate (~72%), Docker build +
  /healthz smoke.
• Black-box E2E (curl + Python + Go SDK): 108 / 108.
• Real Turso/libSQL nightly: green — TestTursoIntegration,
  TestTursoExtended, TestTursoConcurrent (concurrent dedup + exclusive claim).
• Release build environment golang:1.25-alpine (Go 1.25.11): govulncheck
  reports 0 vulnerabilities affecting the code.

Install / run

go get github.com/mqlitehq/mqlite          # embed the SDK (requires Go >= 1.21)

# or run the broker:
docker build --platform linux/amd64 --pull -t mqlite:0.1.0 .
docker run  --platform linux/amd64 -p 8080:8080 -e MQLITE_TOKENS=mqk_dev mqlite:0.1.0

Compatibility

The library requires Go 1.21+ to import (maximum embedding compatibility).
Release binaries are compiled with Go 1.25.11, carrying the latest Go standard-
library security fixes.

Honest notes

• Delivery is at-least-once, not exactly-once — handlers must be idempotent.
• Under synchronous=NORMAL (the default) a sudden power loss can drop the last few
  not-yet-checkpointed messages; choose FULL if that window is unacceptable.
• Embedded mode is single-process, single-writer; for multiple processes or
  hosts, run the broker (or point it at Turso).

Scope

This release is the core library + broker (mqlitehq/mqlite). The public
documentation site is maintained separately and is not part of this tag.