v4.3.0

Bug-fix and hardening release. Contains a few breaking changes that affect only edge/undocumented usage — see below.

⚠️ Breaking Changes

• Ill-formed rate lists now raise ValueError at construction instead of being silently mis-enforced (must be ordered by increasing interval, with increasing limits and non-increasing density). (#239)
• binary_search removed from the public API (undocumented internal helper, now stdlib bisect). (#290)
• PgQueries SQL templates use bound %s parameters instead of {offset}/{timestamp}. (#233)

🔒 Security

• SQLite & Postgres no longer build SQL via string interpolation — the user-supplied item name (SQLite) and table name (Postgres) are bound/quoted, closing a SQL-injection vector and fixing crashes on names with quotes. (#233, #244)

Fixed

• Blocking try_acquire no longer busy-spins or spuriously times out with buffer_ms=0 (waiting() now clears the inclusive window boundary). (#289)
• try_acquire_async(timeout=0) succeeds when capacity is available instead of always returning False. (#289)
• SQLite leak() no longer crashes on a closed connection during teardown. (#244)
• Rates are consistently sorted by interval across all backends, fixing a latent leak() bug with unsorted rates on Redis/SQLite/Postgres. (#239)

Changed

• Replaced custom binary_search with stdlib bisect. (#290)

Docs

• Fixed stale v4 README examples and documented custom/distributed clocks in v4. (#261)

Full changelog: https://github.com/vutran1710/PyrateLimiter/blob/master/CHANGELOG.md