v2.6.0

Tako 2.6 adds supervised queues, optional queue limits, HTTP/3 qlog, and built-in gRPC health and reflection. Requires Rust 1.95+.

New features

• Queue::spawn() returns a cloneable QueueHandle for shutdown and completion on Tokio and Compio. Repeated starts share workers; cancellation preserves unfinished jobs as dead letters, subject to retention limits.
• QueueLimits optionally caps outstanding jobs, serialized payload bytes, and dead-letter retention. try_push, try_push_delayed, and try_push_dedup return typed capacity errors. Queues remain unbounded by default.
• http3-qlog records per-connection QUIC traces for HTTP/3 and WebTransport on Tokio and Compio. Configure .h3_qlog_dir(...) on the server builder to enable output.
• gRPC health serves Check, Watch, and List through HealthRegistry::register. ReflectionRegistry::register serves v1 and v1alpha reflection, with descriptor imports and dependency lookup. Built-in schemas need no consumer protoc step.

Upgrade notes

• Custom SessionStore implementations must use atomic create, update, rotation, and removal with session generations. Stale requests can no longer restore revoked sessions or remove their replacements.
• Idempotency requires a trusted IdempotencyIdentity by default; keyed requests without one return 401. Public endpoints must opt into .anonymous(). Authentication and authorization must run before cache lookup.
• Unary gRPC, typed multipart, and GraphQL POST bodies now obey the router's 2 MiB default BodyLimit. Existing protocol limits still apply. Exhaustive error matches need GrpcError::BodyTooLarge and TypedMultipartError::BodyTooLarge.
• Unary gRPC requires exactly one message with no trailing data. Native extractors accept application/grpc and application/grpc+proto; use GrpcClientStream for streaming and the gRPC-Web adapter for web framing.
• Direct jwt-simple dependencies used with Tako's JWT types must move to 0.13. http_method_to_vespera now returns Option<HttpMethod>; unsupported methods are omitted from generated OpenAPI documents.
• Queue shutdown now waits for workers and cleanup until its deadline, then requests cancellation. Dropping the last explicit QueueHandle cancels workers; keep it alive while work is needed. Stopped queues cannot restart.

See the 2.6 migration guide for API changes, configuration, and replacement examples.

Fixes and performance

• HTTP/2 uses smaller service futures, and HTTP/2 and HTTP/3 reduce shared router reference-count traffic. Contiguous gRPC frames decode without an intermediate copy; GraphQL JSON parsing avoids a second body buffer.
• Compression preserves trailers and body errors. HTTP/2 and HTTP/3 remove connection-specific response headers, and HTTP/2 settings apply consistently across runtimes.
• HTTP/1 header deadlines start after the previous response flushes, and gRPC preserves the first extracted deadline. Compio retains connection permits through upgrades. HTTP/3 resets responses when body streaming fails.
• WebTransport owns its associated HTTP/3 request futures, and raw QUIC reaps completed connection tasks while accepting new connections.
• Host and tenant lookup validate HTTP authorities and quoted forwarding parameters. PROXY v2 validates commands and address blocks while preserving UNSPEC metadata and checksums.
• Unix socket startup preserves live sockets with full backlogs and serializes competing processes. Global state initializes outside map locks.
• Route macros support catch-all paths. QueryMulti form-decodes values before CSV splitting, GraphQL accepts raw UTF-8 queries, and WebSockets reject invalid payload-length encodings.
• Router merges retain signal subscribers, dropped subscriptions are reclaimed, and request signal hooks obey router deadlines. Cron logs dropped enqueue failures; queue retries and observer failures preserve job outcomes.
• Runtime, QUIC, compression, and cryptographic dependencies include security updates.

Full diff