v2.6.0

Breaking and behaviour changes

• Errors now answer as JSON instead of plain text (#228)
• total_protein_count on the functional endpoints now reports matched proteins, not all proteins of the taxon (#245)
• Rank parameters match exactly except in filters, where they stay case-insensitive (#200); a rank may be spelled with a space or an underscore (#202)
• A boolean parameter with an empty or unrecognised value is refused instead of read as false (#170)
• serde_qs 1.1: a duplicate query key stays an error (#169)
• Every endpoint answers in a fixed order — functional endpoints, taxa2tree branches, taxonomy descendants, pept2ec, protein lookups, and the paged filters (#207, #208, #209, #210, #212, #213, #219)
• The root taxon is no longer reported as a descendant (#227)
• A filter window whose end is below its start answers 400 (#191, #197)
• pept2taxa names each taxon once in the compact shape (#192)

New

• taxa2rank endpoint (#97)
• /health probe that reports the database separately (#258)
• The binary reports its version, and logs it at startup (#257)

Fixes

• Malformed datastore rows and malformed requests are refused instead of panicking (#143, #144, #147, #229)
• Multipart parts are encoded correctly into the query string they rebuild (#172)
• The CORS layer now wraps the timeout and the body limit, so a refused request keeps its headers (#190)
• pept2ec pairs each result with its own repeat count, at each input position (#189, #219)
• The protein browser serves its last page, and sorts the listing (#242)
• A taxon's rank is read through one name, not three (#194, #198)

Performance

• The k-mer table is used when the index ships one (#111)
• Each distinct peptide is searched once, across every endpoint (#220, #221, #222, #223, #224)
• The LCA reduces over distinct taxa and reads lineages by reference (#174, #241, #246)
• A filter page is taken without ordering the whole table (#215)
• The annotation decode buffer is reused, and search results are borrowed (#105, #107)

Operations

• A tag makes the release: three storage-backend binaries plus checksums, built from the tagged commit (#270)
• Deploy scripts: install a release, roll back to the last one, and roll out one server at a time (#271, #273)
• The systemd unit lives in the repository (#269)
• Requests are logged with route, status, latency and id; every print goes through tracing and reaches the journal (#259, #260, #261, #265)
• A passing health check is kept out of the request log (#277)
• Requests in flight finish before the server stops (#268)
• One mail per server, not one per state change (#278)
• No OpenSSL is linked into the released binary (#272)

Build, CI and tests

• Ported to the unipept-index production index (#106)
• Edition 2024 and resolver 3; MSRV 1.88 declared and gated; toolchain pinned and formatting gated (#134, #135, #137)
• One workspace version, and no crate can be published by accident (#199, #256)
• All nine storage-backend combinations are checked, and all three released ones are executed, in CI (#109, #244)
• One CI workflow, Dependabot, and a cargo audit gate (#115, #116, #133)
• A shared fixture corpus with a generated taxonomy; every endpoint, the datastore, the database and the index are tested, over GET and POST (#141, #142, #145, #146, #156, #157, #158, #159, #179, #193)
• Deploy container suites run when a deploy script changes (#275, #276)

Dependencies

• axum 0.8, serde_qs 1.1, reqwest 0.13, thiserror 2, askama 0.16, httpmock 0.8, tower/tower-http, tokio, itertools, criterion
• rustls 0.23.45 for RUSTSEC-2026-0285; pastey replaces the unmaintained paste; transitive advisory bumps (#132, #185, #205, #206, #266)

Docs

• CONTRIBUTING.md with the local checks (#280)
• Storage backend selection documented; README endpoint lists replaced with links; /api/v1 recorded as an alias for /api/v2 (#110, #187, #281)