release: v0.6.0 by ZhuchkaTriplesix · Pull Request #200 · QueryaHub/OxyRoute

ZhuchkaTriplesix · 2026-09-12T09:03:59Z

OxyRoute v0.6.0 Release

Highlights

Native Rate Limiting: In-memory sharded Token Bucket rate limiter in Rust with configurable strategies (ip, header:<name>, global) on route decorators and routers (@app.get(..., rate_limit="100/minute")).
DAG Dependency Resolution: Graph-based dependency resolution with topological sorting and cycle detection at registration time.
Adaptive Concurrency Limiting: Adaptive load shedding (AdaptiveConcurrencyLimiter) to protect against memory exhaustion and tail latency degradation.
PEP 590 Vectorcall: Zero-dict kwargs allocation on the Python handler hot path.
Packed 64B RouteEntry & Contiguous State: L1 cacheline aligned route entries and consolidated state snapshots.
OpenAPI 3.1.0: Pydantic v2 JSON Schema alignment, automatic 401/422 responses, and query/header parameter schema declarations.
Native WebSockets: Serialized concurrent frame sending and graceful shutdown notifications (1001 Going Away).
PEP 561 Type Stubs: Complete py.typed and _oxyroute.pyi stubs.
Security & Hardening: StaticFiles directory traversal / symlink escape protections, DBQuery SQL injection guarantees, and panic = "abort" FFI safety.

Closes #144

fix(security): prevent path traversal and symlink escape in StaticFiles

…g mode

ci: add native Rust cargo tests and automated security audit workflow

Closes #150

fix(typing): add PEP 561 py.typed marker and _oxyroute.pyi type stubs

…ed numeric casting Closes #142

fix(params): schema-aware path parameter coercion to prevent unintended numeric casting

…winding Closes #156

fix(build): set panic = "abort" in Cargo.toml to prevent FFI stack unwinding

…er names Closes #151 Closes #152

feat(dx): auto-infer Pydantic body_model and support flexible parameter names

…rgs allocation Closes #159

…-path metadata Closes #147

perf(call): adopt PEP 590 Vectorcall protocol to eliminate PyDict kwargs allocation

…pection

perf(cache): pack RouteEntry layout into single 64B cacheline for hot-path metadata

…atch

…ed signature

fix(dispatch): restore abi3-py310 compliant call0 and kwargs calling

perf(memory): implement thread-local buffer pool for request bodies (#160)

chore(deps): upgrade oxyjwt to >=0.7.0 and drop pyjwt / cryptography

…<FrozenState> (#149)

…bjects

perf(cache): consolidate HotSnapshot atomic refcounts into single Arc<FrozenState> (#149)

…ptions via try-finally

fix(observability): ensure access_log_hook executes on unhandled exceptions via try-finally

… JSON Schema compatibility

feat(openapi): align default OpenAPI version to 3.1.0 for Pydantic v2 JSON Schema compatibility

…r responses

feat(openapi): auto-document 401 Unauthorized and 422 Validation Error responses

…-params feat(openapi): support query and header parameter schema declarations

… formatting on hot path (#184)

…prevent OOM and tail latency spikes (#185)

…ention guarantees (#186)

…e interleaving (#187)

…Away during graceful shutdown (#188)

…istration (#189) * feat(di): DAG dependency resolution with cycle detection at route registration (#141) * perf(bench): add DI/DX overhead comparison benchmark

…route decorators (#162) (#192)

… (#193)

…son (#163) (#194)

#195)

…ract::<&PyTuple>() (#196)

…lib.rs (#198)

)

ZhuchkaTriplesix and others added 30 commits August 26, 2026 20:29

fix(security): prevent path traversal and symlink escape in StaticFiles

fd88f8d

Closes #144

Merge pull request #165 from QueryaHub/issue-144-static-traversal

cc3390d

fix(security): prevent path traversal and symlink escape in StaticFiles

ci: add native Rust cargo tests and automated security audit workflow

8786c09

ci: update security-audit to run cargo audit in non-blocking reportin…

c8425e2

…g mode

style: fix Ruff B904 in static.py with raise from None

44d44f9

Merge branch 'dev' into feat-ci-enhancements

5f7319b

style: apply ruff formatting across tests and docs

a1b581c

Merge branch 'dev' into feat-ci-enhancements

50beb73

Merge pull request #166 from QueryaHub/feat-ci-enhancements

3cae5f9

ci: add native Rust cargo tests and automated security audit workflow

fix(typing): add PEP 561 py.typed marker and _oxyroute.pyi type stubs

d1d7150

Closes #150

style: fix isort import formatting in test_typing.py

f4f78f6

Merge pull request #167 from QueryaHub/issue-150-py-typed-stubs

4b754de

fix(typing): add PEP 561 py.typed marker and _oxyroute.pyi type stubs

fix(params): schema-aware path parameter coercion to prevent unintend…

47559d5

…ed numeric casting Closes #142

style: cargo fmt in params.rs

d0a0dbc

Merge pull request #168 from QueryaHub/issue-142-path-param-coercion

e1df38f

fix(params): schema-aware path parameter coercion to prevent unintended numeric casting

fix(build): set panic = "abort" in Cargo.toml to prevent FFI stack un…

4c5f3c8

…winding Closes #156

Merge pull request #169 from QueryaHub/issue-156-panic-abort

3597ae4

fix(build): set panic = "abort" in Cargo.toml to prevent FFI stack unwinding

feat(dx): auto-infer Pydantic body_model and support flexible paramet…

47c86b1

…er names Closes #151 Closes #152

Merge pull request #170 from QueryaHub/issue-151-152-pydantic-dx

a7ecd53

feat(dx): auto-infer Pydantic body_model and support flexible parameter names

perf(call): adopt PEP 590 Vectorcall protocol to eliminate PyDict kwa…

edd1c26

…rgs allocation Closes #159

perf(cache): pack RouteEntry layout into single 64B cacheline for hot…

41d4cdd

…-path metadata Closes #147

Merge pull request #171 from QueryaHub/issue-159-vectorcall

97f859b

perf(call): adopt PEP 590 Vectorcall protocol to eliminate PyDict kwargs allocation

fix(app): use callable() instead of hasattr(__call__) for handler ins…

ee95ef8

…pection

Merge pull request #172 from QueryaHub/issue-147-pack-route-entry

b305b3d

perf(cache): pack RouteEntry layout into single 64B cacheline for hot-path metadata

fix(dispatch): restore abi3-py310 compliant call0 and kwargs calling

f28e18c

fix(dispatch): fix db query execution and pool reference in RSGI disp…

0fe8cc6

…atch

fix(dispatch): filter kwargs passed to dependency factories by declar…

b2cd52a

…ed signature

fix(dispatch): correct route entry destructure and kw filtering

a1d5350

fix(clippy): use is_none_or instead of map_or(true, ...)

0395bb0

Merge pull request #173 from QueryaHub/fix-abi3-vectorcall

6995ba0

fix(dispatch): restore abi3-py310 compliant call0 and kwargs calling

ZhuchkaTriplesix and others added 29 commits August 27, 2026 12:17

Merge pull request #177 from QueryaHub/perf-buffer-pool-160

ac7452a

perf(memory): implement thread-local buffer pool for request bodies (#160)

Merge pull request #178 from QueryaHub/chore-upgrade-oxyjwt-0-7

d9823fd

chore(deps): upgrade oxyjwt to >=0.7.0 and drop pyjwt / cryptography

perf(cache): consolidate HotSnapshot atomic refcounts into single Arc…

708281d

…<FrozenState> (#149)

fix(state): ensure GIL is held when rebuilding snapshot with Python o…

7962011

…bjects

Merge pull request #179 from QueryaHub/perf-consolidate-snapshot-149

7af51f7

perf(cache): consolidate HotSnapshot atomic refcounts into single Arc<FrozenState> (#149)

fix(observability): ensure access_log_hook executes on unhandled exce…

bf0eea7

…ptions via try-finally

Merge pull request #180 from QueryaHub/issue-157-access-log-try-finally

747272e

fix(observability): ensure access_log_hook executes on unhandled exceptions via try-finally

feat(openapi): align default OpenAPI version to 3.1.0 for Pydantic v2…

858b8a5

… JSON Schema compatibility

Merge pull request #181 from QueryaHub/issue-154-openapi-3-1-0

87e4cbc

feat(openapi): align default OpenAPI version to 3.1.0 for Pydantic v2 JSON Schema compatibility

feat(openapi): auto-document 401 Unauthorized and 422 Validation Erro…

98e377d

…r responses

Merge pull request #182 from QueryaHub/issue-153-openapi-error-responses

e934927

feat(openapi): auto-document 401 Unauthorized and 422 Validation Error responses

feat(openapi): support query and header parameter schema declarations

72b71d5

Merge pull request #183 from QueryaHub/issue-155-openapi-query-header…

c9e12e7

…-params feat(openapi): support query and header parameter schema declarations

perf(response): pre-baked static response headers to eliminate string…

7dfd311

… formatting on hot path (#184)

feat(resilience): adaptive concurrency limiting and load shedding to …

08d6370

…prevent OOM and tail latency spikes (#185)

docs(security): document DBQuery parameter binding and injection prev…

a792615

…ention guarantees (#186)

feat(websocket): serialize concurrent send operations to prevent fram…

31e593d

…e interleaving (#187)

feat(websocket): notify active WebSocket connections with 1001 Going …

f7d6865

…Away during graceful shutdown (#188)

feat(di): DAG dependency resolution with cycle detection at route reg…

4b0d644

…istration (#189) * feat(di): DAG dependency resolution with cycle detection at route registration (#141) * perf(bench): add DI/DX overhead comparison benchmark

style: ruff format oxyroute tests examples (#190)

d85c46e

style: cargo fmt src/lib.rs (#191)

3bd5e1f

feat(rate-limit): native Rust in-memory token bucket rate limiter on …

afe64f9

…route decorators (#162) (#192)

perf(db): streaming and chunked row decoding for DBQuery results (#143)…

1c9ad47

… (#193)

perf(json): evaluate SIMD-accelerated JSON deserialization via simd-j…

fa17bd2

…son (#163) (#194)

fix(rate-limit): import pyo3 prelude for PyAnyMethods in rate_limit.rs (

d70b029

#195)

fix(rate-limit): extract client IP via Bound::get_item instead of ext…

7738ce0

…ract::<&PyTuple>() (#196)

test(rate-limit): remove unused Any import in test_rate_limit.py (#197)

a7fca81

fix(clippy): replace redundant closure with PyValueError::new_err in …

673f91d

…lib.rs (#198)

chore(release): bump version to 0.6.0, update CHANGELOG and README (#199

ec58faf

)

ZhuchkaTriplesix merged commit 5c3cf55 into main Sep 12, 2026
34 checks passed

Navigation Menu

release: v0.6.0 - #200

release: v0.6.0#200
ZhuchkaTriplesix merged 73 commits into
mainfrom
dev

ZhuchkaTriplesix commented Sep 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ZhuchkaTriplesix commented Sep 12, 2026

OxyRoute v0.6.0 Release

Highlights

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant