Repository navigation

4.0.0 release prep - #17

Merged

taplin merged 33 commits into

mainfrom

release-prep

Oct 14, 2026

Merged

4.0.0 release prep#17
taplin merged 33 commits into
mainfrom
release-prep

Commits on Oct 14, 2026
- Pin released dependencies: MySQL 4, PostgreSQL 5, Redis 4, SQLite 6, MongoDB 4.0.3
  
  taplin
  and
  claude
  committed
  093b751
- Tests: live suites skip visibly, fail when unreachable or required
  
  taplin
  and
  claude
  committed
  8787954
- Don't crash saving session data JSON can't hold
  
  taplin
  and
  claude
  committed
  4ba8656
- CORS: a wildcard origin must match both sides of the *
  
  taplin
  and
  claude
  committed
  df32683
- Redis sessions: namespaced keys, no resurrection, TTL from the session
  
  taplin
  and
  claude
  committed
  763cd22
- Memory sessions: save() no longer recreates a destroyed session
  
  taplin
  and
  claude
  committed
  9a5a892
- Don't trap on a huge session idle time
  
  taplin
  and
  claude
  committed
  c7b53ae
- MySQL/PostgreSQL sessions: 64-bit times, overflow-safe clean()
  
  taplin
  and
  claude
  committed
  7b1394f
- PostgreSQL: percent-encode connection URI parts fully
  
  taplin
  and
  claude
  committed
  4e258f2
- Every driver's resume() refuses an expired session; optional absolute timeout
  
  taplin
  and
  claude
  committed
  61d59f4
- Generate session and CSRF tokens with SystemRandomNumberGenerator
  
  taplin
  and
  claude
  committed
  ac62cf7
- Add SessionDriver.regenerate() against session fixation
  
  taplin
  and
  claude
  committed
  0428231
- Add SessionCookie: Set-Cookie values from SessionConfig's cookie settings
  
  taplin
  and
  claude
  committed
  89b5120
- Tests: injection probes for the SQL and MongoDB backends
  
  taplin
  and
  claude
  committed
  fc8424e
- Concurrency tests; checks take explicit config so tests don't race
  
  taplin
  and
  claude
  committed
  5d54233
- Drop @unchecked from the stateless SQL drivers' Sendable
  
  taplin
  and
  claude
  committed
  86ec917
- MySQL: don't trap on an out-of-range port
  
  taplin
  and
  claude
  committed
  0245653
- CI: Swift 6.2/6.4 x debug/release, warnings as errors, live tests required
  
  taplin
  and
  claude
  committed
  7202fb9
- README: 4.0.0 install, security notes, Perfect-NIO example, migration
  
  taplin
  and
  claude
  committed
  d5364ed
- AuthFilter: segment matching, case-folding, fail closed; requiresAuthentication
  
  taplin
  and
  claude
  committed
  44f2fdd
- A value JSON can't hold drops only its own key, never the CSRF token
  
  taplin
  and
  claude
  committed
  7640239
- Every driver's save() renews the idle time
  
  taplin
  and
  claude
  committed
  1847a2c
- regenerate() keeps the session's creation time
  
  taplin
  and
  claude
  committed
  3c29930
- Log a SHA-256 prefix of the session token, never the token
  
  taplin
  and
  claude
  committed
  dc3112d
- Deprecate the config knobs nothing reads; add CSRFSecurity.tokenMatches
  
  taplin
  and
  claude
  committed
  271ceeb
- Redis: clamp the TTL so a huge idle doesn't make save() fail
  
  taplin
  and
  claude
  committed
  4f3f42d
- Redis: commandTimeout defaults to 5 seconds
  
  taplin
  and
  claude
  committed
  a19e616
- SessionCookie: recognize __Host-/__Secure- prefixes in any case
  
  taplin
  and
  claude
  committed
  10a030f
- CSRFSecurity.isValid: compare scheme, default ports and case
  
  taplin
  and
  claude
  committed
  ede3dab
- clean(), the MongoDB TTL index and Redis TTLs honour absoluteTimeout
  
  taplin
  and
  claude
  committed
  d0c267e
- README and docs: review fixes, CSRF and auth middleware example
  
  taplin
  and
  claude
  committed
  8073d21
- README.zh_CN: CSRF, AuthFilter, save renewal, Redis 5 s timeout
  
  taplin
  and
  claude
  committed
  5371df5
- Tests: skip exit tests under ThreadSanitizer; save() renews updated
  
  taplin
  and
  claude
  committed
  8c6e5a0

Navigation Menu

Repository navigation

4.0.0 release prep - #17

4.0.0 release prep#17
taplin merged 33 commits into
mainfrom
release-prep

Commits on Oct 14, 2026

Pin released dependencies: MySQL 4, PostgreSQL 5, Redis 4, SQLite 6, MongoDB 4.0.3

Tests: live suites skip visibly, fail when unreachable or required

Don't crash saving session data JSON can't hold

CORS: a wildcard origin must match both sides of the *

Redis sessions: namespaced keys, no resurrection, TTL from the session

Memory sessions: save() no longer recreates a destroyed session

Don't trap on a huge session idle time

MySQL/PostgreSQL sessions: 64-bit times, overflow-safe clean()

PostgreSQL: percent-encode connection URI parts fully

Every driver's resume() refuses an expired session; optional absolute timeout

Generate session and CSRF tokens with SystemRandomNumberGenerator

Add SessionDriver.regenerate() against session fixation

Add SessionCookie: Set-Cookie values from SessionConfig's cookie settings

Tests: injection probes for the SQL and MongoDB backends

Concurrency tests; checks take explicit config so tests don't race

Drop @unchecked from the stateless SQL drivers' Sendable

MySQL: don't trap on an out-of-range port

CI: Swift 6.2/6.4 x debug/release, warnings as errors, live tests required

README: 4.0.0 install, security notes, Perfect-NIO example, migration

AuthFilter: segment matching, case-folding, fail closed; requiresAuthentication

A value JSON can't hold drops only its own key, never the CSRF token

Every driver's save() renews the idle time

regenerate() keeps the session's creation time

Log a SHA-256 prefix of the session token, never the token

Deprecate the config knobs nothing reads; add CSRFSecurity.tokenMatches

Redis: clamp the TTL so a huge idle doesn't make save() fail

Redis: commandTimeout defaults to 5 seconds

SessionCookie: recognize Host-/Secure- prefixes in any case

CSRFSecurity.isValid: compare scheme, default ports and case

clean(), the MongoDB TTL index and Redis TTLs honour absoluteTimeout

README and docs: review fixes, CSRF and auth middleware example

README.zh_CN: CSRF, AuthFilter, save renewal, Redis 5 s timeout

Tests: skip exit tests under ThreadSanitizer; save() renews updated