Orbit v1.5.1: Docker Build Fixes

Packaging-only release. No library code changed. Upgrade only if you build the Docker image or use the drafted vcpkg port — every other integration path was unaffected in v1.5.0.

Fixed

docker build . could not complete

The builder stage never installed a libcurl development package, while CMakeLists.txt calls find_package(CURL REQUIRED):

CMake Error: Could NOT find CURL (missing: CURL_LIBRARY CURL_INCLUDE_DIR)
Call Stack: CMakeLists.txt:45 (find_package)

With that fixed the build reached the runtime stage and failed again:

Step 17/25 : COPY --from=builder /usr/lib/libnghttp3* /usr/lib/
COPY failed: no source files were specified

nghttp3 and ngtcp2 install with CMAKE_INSTALL_PREFIX=/usr, and GNUInstallDirs places libraries in the multiarch directory on Debian-derived distributions — /usr/lib/x86_64-linux-gnu, not /usr/lib. The corrected paths also pick up libngtcp2_crypto_quictls, needed at runtime and missed by the old globs too.

Failure came after ten minutes of compiling quictls from source, which made it an expensive way to discover a missing apt package.

Docker build context was 3.1 GB

.dockerignore covered four directories and missed vcpkg/, vcpkg_installed/, build_cov/ and the other build trees — all uploaded and baked into an image layer. Rewritten by category to match .gitignore, with an explicit block for credentials so key material cannot be captured in an image.

Context is now 6.9 MB.

vcpkg port

The drafted port's SHA512 referred to the v1.4.0 archive while its manifest declared a newer version, so it could not have verified its download.

Changed

• The image no longer builds the test suite — it fetched GoogleTest over the network at configure time and compiled 18 translation units nothing in the runtime stage uses.
• Removed the obsolete version key from docker-compose.yml, which Compose V2 warns about.

Verified

The image builds, runs, and answers HTTP on port 8080. ldd inside the container resolves libngtcp2, libngtcp2_crypto_quictls and libnghttp3 with no unresolved libraries. Final image is 276 MB.

docker build -t orbit-app .
docker run -p 8080:8080 -p 8443:8443 -p 8443:8443/udp orbit-app

Or with PostgreSQL and Redis alongside:

docker compose up --build

Full changelog: https://github.com/varuns2903/orbit-framework/blob/main/CHANGELOG.md

Orbit v1.5.0: Correctness & Integration Fixes

Upgrade strongly recommended

v1.4.0 and earlier contain a defect that corrupts the stack of every application linking Orbit. If you are using Orbit in any project, upgrade.

Fixed

Consuming applications corrupted their own stack

App.hpp declares two members under #ifdef ORBIT_ENABLE_HTTP3, but the macro was set with CMake's directory-scoped add_compile_definitions(), so it never reached anything linking Orbit. Consumers compiled App 16 bytes smaller than the constructor in libserver_core.a was built to fill, and the constructor wrote past the end of the caller's object:

*** stack smashing detected ***: terminated

ERROR: AddressSanitizer: stack-buffer-overflow
WRITE of size 8 ... in std::unique_ptr<network::TlsContext>::unique_ptr()
    server::App::App(config::ServerConfig const&) src/server/App.cpp:34
[560, 1080) 'app' <== Memory access at offset 1080 overflows this variable

This affected every integration path — FetchContent, find_package, vcpkg and Conan. Feature macros are now PUBLIC on the target and propagate correctly.

HTTP/2 response headers were a use-after-free

Each nghttp2_nv name borrowed a pointer into a std::string scoped to the loop that built it, so every name dangled by the time nghttp2 read the list. It rarely crashed — the freed block is immediately recycled — so header names went out empty or garbage instead.

HTTP/1.0 clients hung until timeout

RFC 9112 §9.3 makes HTTP/1.0 close by default and persist only on an explicit keep-alive. Orbit applied the HTTP/1.1 rule to both and held the socket open, hanging health checks, older proxies and load balancers. The Connection header is now parsed as the comma-separated list of case-insensitive tokens it is, so Connection: Close and Connection: TE, close are honoured too.

Also fixed

• Public headers resolved <nlohmann/json.hpp> to the copy bundled in inja (3.10.5) instead of the 3.11.3 copy Orbit vendors — same include guard, so translation units could disagree on nlohmann::json.
• find_package(OrbitFramework) failed where MariaDB, MongoDB or hiredis came from the system rather than vcpkg, and demanded dependencies for disabled subsystems.
• The installed CMake package exported pantor::inja, which no consumer could resolve.
• find_package and FetchContent exported different target names. Both now give OrbitFramework::core, with OrbitFramework::server_core as a compatibility alias.
• Examples were built unconditionally and failed to link when a subsystem was disabled.
• CI broke once upstream vcpkg moved past the pinned builtin-baseline.
• conanfile.py reported version 0.1.0 and exported no sources.

Added

• CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, issue forms, PR template
• THIRD_PARTY_NOTICES.md covering bundled, fetched and linked dependencies
• docs/coverage.md and a Code Coverage workflow — currently 27.1% lines across 109 tests
• An API Stability section: 1.x is pre-stable and minor releases may break source compatibility
• A full Installation section covering the installer, CLI, FetchContent, find_package, vcpkg, Conan, Docker, source builds and CPack
• 45 new tests — WebSocket frame decoding, HTTP/2 header encoding and method parsing, Connection option parsing. Suite grows 64 → 109

Changed

• Test sources are globbed with CONFIGURE_DEPENDS; two test files had never been compiled at all
• Roadmap entries claiming vcpkg/Conan publication, penetration testing and 85-90% coverage are unticked and now describe what actually works
• Performance claims are measured: median 61,419 req/s plaintext, with methodology and limits in docs/benchmarks.md
• GitHub Actions moved off the deprecated Node 20 runtime

Install

include(FetchContent)
FetchContent_Declare(
  OrbitFramework
  GIT_REPOSITORY https://github.com/varuns2903/orbit-framework.git
  GIT_TAG        v1.5.0
)
FetchContent_MakeAvailable(OrbitFramework)
target_link_libraries(my_app PRIVATE OrbitFramework::core)

Every other route is documented in the Installation section.

Full changelog: https://github.com/varuns2903/orbit-framework/blob/main/CHANGELOG.md

Orbit v1.4.0: Magic Returns, ORM, & Native Tests

Orbit v1.4.0 Release Notes

We are thrilled to announce Orbit v1.4.0, a massive update that dramatically enhances developer experience, adds powerful new protocol support, overhauls the build/packaging system, and establishes a robust native C++ test suite!

🚀 Key Features

• Magic Return Values (FastAPI-style): Route handlers can now directly return native types (like nlohmann::json, std::string, structs) and Orbit will automatically serialize them and construct the HTTP response!
• Socket.IO-style WebSocket EventRouter: We introduced a strongly-typed, intuitive EventRouter for WebSockets. It fully supports custom events, data payloads, rooms, and sessions.
• Unified DBAL & ORM: A brand new Expression Template-based ORM Query DSL. Write SQL safely and efficiently in native C++. Also includes new MongoDB ORM integration alongside PostgreSQL.
• GraphQL & gRPC Adapters: Added a new GraphQL middleware adapter and an optional gRPC server wrapper to extend Orbit beyond traditional REST.
• Orbit CLI: A brand new command-line tool orbit to effortlessly scaffold and manage new Orbit projects.

📦 Build & Packaging Enhancements

• Modular CMake & Build Options: Control exactly what gets built with new ORBIT_ENABLE_xxx flags (e.g. toggle gRPC, QUIC/HTTP3).
• Cross-Platform & CI: Added comprehensive Windows support to GitHub Actions.
• Package Managers: Full support for vcpkg, Conan, and CMake FetchContent.
• Distribution: Added CPack support for generating installable release packages and support for BUILD_SHARED_LIBS.

🧪 Testing & Reliability

• Pure Native C++ Test Suite: Migrated our entire testing infrastructure from Python scripts to a high-performance native C++ suite using GoogleTest.
• Comprehensive Code Coverage: Integrated gcovr with a new fully functional C++ E2E HTTP integration runner and unit test suite.
• Bug Fixes:
  • Fixed a critical thread deadlock vulnerability in ConnectionPool.
  • Fixed HandlerWrapper deduction failures for Coroutine tasks modifying the ResponseWriter.
  • Addressed various target linkage and export issues for consumers.

Thanks to all contributors for pushing Orbit forward!

Orbit Framework v1.3.0: Swagger, Auth & Connection Pooling

🚀 What's New in v1.3.0

This is a massive release that brings Orbit Framework significantly closer to enterprise parity with major frameworks, focusing on developer ergonomics, security, and documentation.

🌟 Major Features

• OpenAPI / Swagger Auto-Generation: Orbit now automatically generates a Swagger UI dashboard for your API via app.enable_openapi(). The router now uses a Builder Pattern to attach .summary(), .req_body(), and .res_body() directly to routes!
• Doxygen API Documentation: Full Doxygen integration has been added to automatically generate an HTML API reference hosted on GitHub Pages.
• Database Connection Pooling: Added a highly concurrent, lock-free ConnectionPool<T> template for robust Postgres/MySQL/Redis connection management.
• New Database Drivers: Asynchronous abstraction layers added for MongoDB (MongoClient) and MySQL (MysqlClient).

🛡️ Security & Middlewares

• OAuth2 Middleware: Seamlessly integrate third-party OAuth2 login flows using the new libcurl-backed middleware.
• CSRF Protection: Added Cross-Site Request Forgery (CSRF) token generation and validation middleware.
• Native Cookie API: Fluent HttpResponse::set_cookie() API and automatic request cookie parsing.

🐛 Bug Fixes & CI

• Fixed Ubuntu and macOS CI pipelines (added libcurl and mariadb-connector-c).
• Fixed Epoll and io_uring concurrency data races on connection state under massive load (100k+ req/s).
• Cleaned up public API headers by moving them to include/orbit/ for better <orbit/server/App.hpp> #include paths.

Release v1.2.1

Full Changelog: v1.2.0...v1.2.1

v1.2.0: Observability & Zero-Downtime Reloads

Phase 5 Completed

• Added Prometheus metrics registry and /metrics endpoint.
• Tracking active TCP and QUIC connections.
• Tracking HTTP request counts per method.
• Implemented zero-downtime hot reloading via SIGUSR2 and SO_REUSEPORT.
• Implemented graceful EventLoop shutdown for active connection draining.

v1.1.1: Core Security Patches & io_uring Sendfile Fallback

This patch release focuses on resolving critical security vulnerabilities and addressing edge-case bugs in the high-performance io_uring reactor engine. All users running v1.0.0 or v1.1.0 in
production are strongly encouraged to upgrade.

### 🛡️ Security Fixes                                                                                                                                                                            
* **Path Traversal Vulnerability Patched (`StaticFiles.cpp`)**: Resolved a critical security flaw where string-prefix path validation could be tricked (e.g., bypassing `/var/www/public` by     

requesting /var/www/public_secrets). The framework now strictly mandates a trailing slash boundary or an exact directory match before serving static assets.

### 🐛 Bug Fixes                                                                                                                                                                                 
* **Keep-Alive Connection Hangs Resolved (`Connection.cpp`)**: Fixed an issue where the HTTP Keep-Alive pipelining state machine would fail to re-arm the `Proactor` read triggers               

(trigger_read()) after completing a request. Browsers loading pages with multiple assets (HTML, CSS, JS) will no longer experience 10-second idle-timeout hangs.
* RFC-Compliant HTTP Header Parsing (HttpParser.cpp): Replaced the case-sensitive std::unordered_map with a custom CaseInsensitiveHash and CaseInsensitiveEqual implementation. HTTP
headers are now parsed completely case-insensitively across the framework. Furthermore, Connection::check_request_state() now uses case-insensitive boundary searches for Content-Length.
* io_uring sendfile EINVAL Resolution (IoUringProactor.cpp): Addressed an issue where io_uring_prep_splice would fail with -EINVAL when attempting to zero-copy from a static file
to a TCP socket without a kernel pipe buffer. The IoUringProactor now gracefully falls back to non-blocking sendfile(2), wrapped inside an io_uring_prep_poll_add (POLLOUT) operation to
strictly preserve 100% asynchronous, non-blocking execution semantics.

### ⚙️ Upgrade Instructions                                                                                                                                                                      
If you are using CMake, simply pull the latest `v1.1.1` tag and rebuild the `server_core` library:                                                                                               
```bash                                                                                                                                                                                          
git fetch --tags                                                                                                                                                                                 
git checkout v1.1.1                                                                                                                                                                              
cd build && make -j4 && sudo make install

v1.1.0: Enterprise Gateway Features, WebSockets & Open-Source Packaging

This massive feature release officially transitions the Orbit HTTP Server from an asynchronous web server into a fully-fledged, production-ready backend framework and enterprise reverse proxy.

### 🚀 Major Features                                                                                                                                                                            
                                                                                                                                                                                                 
**1. Enterprise Reverse Proxy & TLS Tunneling**                                                                                                                                                  
* **Upstream TLS/HTTPS Tunneling**: The `middleware::ProxyRequest` system now features a fully asynchronous OpenSSL `BIO`/`SSL` state machine, allowing the framework to securely proxy traffic  

to https:// upstream targets.
* Gateway Header Injection: The proxy automatically injects standard tracking headers (X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host) into proxied requests.
* Raw Stream Upgrades (WebSocket Proxying): Implemented upgrade_to_raw_stream() into the ResponseWriter and Connection core. The proxy now intelligently intercepts 101 Switching Protocols handshakes and converts the connection into a zero-allocation, bi-directional raw byte stream to flawlessly proxy WebSockets.

**2. Core Developer Ergonomics**
* **Native JSON APIs**: Integrated `nlohmann/json` directly into `HttpRequest` and `HttpResponse`. Access JSON payloads instantly via `req.json()` or send JSON responses effortlessly using     

res.json({{"key", "value"}}).
* Zero-Copy Multipart Form Parsing: Built a hyper-efficient MultipartForm parser for handling multipart/form-data payloads (file uploads) without allocating unnecessary memory buffers.

**3. Open-Source Distribution & Examples**
* **CMake `find_package` Integration**: Added comprehensive CMake installation targets (`HttpServerConfig.cmake`). You can now seamlessly integrate the framework into your own apps using       

find_package(HttpServer REQUIRED).
* Doxygen API Documentation: Integrated Doxygen support. Simply run make docs to generate a beautiful, navigable HTML documentation site for the C++ framework API.
* Showcase Examples: Shipped two highly robust example applications inside the /examples directory:
* rest_api.cpp: A mock database showcasing our new JSON routing features.
* chat_server.cpp: A real-time, thread-safe, multi-client chat room demonstrating our app.ws() WebSocket routing capabilities.

### ⚙️ Quick Start Example
Explore the new WebSocket routing capabilities:
```cpp
#include "server/App.hpp"
#include <iostream>

int main() {
    config::ServerConfig cfg;
    cfg.port = 8081;
    server::App app(cfg);

    app.ws("/chat", [](http::websocket::WebSocketConnection& ws) {
        ws.send("Welcome to Orbit WebSockets!");
        ws.on_message([&ws](const std::string& msg) {
            ws.send("Echo: " + msg);
        });
    });

    std::cout << "Starting Server on ws://localhost:8081/chat\n";
    app.listen();
}

Orbit v1.0.0 🚀

🚀 Orbit v1.0.0: The Genesis Release

This is the very first official release of Orbit, a blazing fast, asynchronous, and middleware-driven C++20 HTTP/WebSocket web framework powered by io_uring and epoll.

✨ Key Features in v1.0

• Asynchronous Core: Pluggable event loop engine supporting both modern io_uring and legacy epoll for maximum throughput and kernel-level asynchronous I/O.
• Express-style Routing: Dynamic routing, URL parameter extraction, and nested route groupings.
• WebSocket Support: Full RFC-compliant WebSocket integration built right in.
• TLS/SSL Encryption: Built-in OpenSSL-based HTTPS proxying and secure traffic handling.
• Robust Middlewares: Composable middleware stack including:
  • Global Rate Limiting
  • Redis-backed Distributed Session Management
  • CORS Headers Support
  • Static File Serving (with zero-copy sendfile)
• Multi-threaded Worker Pool: Efficiently utilizes CPU cores to process requests concurrently without blocking the event loop.
• E2E Testing & Benchmarking: Fully validated with a Python E2E integration testing suite and Apache Benchmark metrics.

We're incredibly excited to finally push v1.0 into the wild!