v2.5.0

Tako 2.5 replaces tungstenite with a WebSocket engine shared by Tokio and Compio. Requires Rust 1.95+.

Breaking changes

• Replace TakoWs with WebSocketUpgrade and import message and error types from tako::ws. On Compio, replace the compio-ws feature with compio and ws.
• send() buffers frames until the handler waits, the write buffer fills, or flush() is called. Use flush() when a write must finish before continuing. Sends from another task still write immediately.
• Deprecated serving functions, Router::state, set_state, and other legacy APIs are removed. Use the server builders and Router::with_state.
• Raw multipart access returns MultipartFields and MultipartError instead of multer's types. Part-count and content-type limits now apply when reading fields directly.

See the migration guide for the full list of removed APIs and replacement examples.

Fixes

• WebSockets send a close frame when a handler returns with no socket handles left, panics, or reaches its lifetime limit. Subprotocol negotiation handles repeated header fields.
• Multipart uploads enforce configured limits and timeouts, preserve returned temporary files, and remove abandoned uploads.
• Cookie extraction reads repeated headers; response cookie jars emit only changed cookies. Accept negotiation respects q=0. ETag matching handles repeated headers and commas inside quoted tags.
• HMAC verification uses the configured timestamp header. CSRF exclusions respect path boundaries. IP filters reject unknown clients when configured to deny by default.
• SSE timers work on Compio without a Tokio runtime. Filtered signal subscriptions continue after a lag error.

All 247 selected Autobahn cases pass on Tokio and Compio; performance and compression groups are excluded.

Full Changelog: v2.4.2...v2.5.0