v1.4.0

1.4.0 (2026-07-06)

Features

• api: PeerCustomSource entity + PeerStore CRUD + REST API (#146) (42662c5)
• server: fetch and advertise per-peer user URL sources (#147) (#149) (0bb045a)

Bug Fixes

• api: /api/me always returns peers array, disambiguate by ?asn= (#23) (335d67f)
• api: cap request body size — defend against OOM DoS (#171) (85963b6)
• api: make ManagementApi.Dispose() idempotent (#141) (7f862fe)
• api: stop leaking raw exception messages in 500 responses (#172) (bf0b204)
• protocol: correct AGGREGATOR (6B) and AS4_AGGREGATOR (8B) lengths — regression of #31 (#169) (4519d13)
• providers: block IPv4-embedding IPv6 forms + restrict ports in SSRF defense (#173) (96656bd)
• providers: connect SSRF-validated hosts IPv4-first, fall through on failure (#151) (#153) (6d98aed)
• providers: reject /0 + /33+ and mask host bits in PrefixListParser (#162) (873d339)
• providers: RIPEstat resilience — stale-on-failure, per-ASN gate, bounded cache (#163, #164, #165) (6a5a6ea)
• providers: send per-source headers/timeout per-request, not via client mutation (#155) (#170) (ef71e3c)
• server: cancel _advertisedPrefixesLock + add SendTimeout backstop (#175) (255e51d)
• server: honor CancellationToken in StopAsync and NotifyCeaseAsync (#161) (a46c07f)
• server: make ConfigCommunityResolver._parsed thread-safe (#159) (#174) (c987ea2)
• server: serialize IpAcceptThrottle dict mutations with a coarse lock (#133) (b8fa475)

Performance Improvements

• api: suppress MultipleCollectionIncludeWarning (#138) (6d8a704)
• providers: URL-keyed TTL cache for per-peer user-source fetches (#150) (#152) (7a3d742)
• remaining hot-path allocation reductions (#85) (a20b470)
• routing: replace GroupBy with manual partition in ExactUnionPrefixAggregator (#82) (0c7e0cf)