From 279d102867b734c05ab8f6f974d83ff3f1e4b7ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kasper=20Overg=C3=A5rd=20Nielsen?= Date: Tue, 25 Aug 2026 13:35:24 +0200 Subject: [PATCH] chore: Bump version to 2.0.0-rc.1 and update CHANGELOG.md --- CHANGELOG.md | 22 ++++++++++++++++++++++ packages/benchmark/pubspec.yaml | 2 +- packages/examples/pubspec.yaml | 2 +- packages/relic/pubspec.yaml | 6 +++--- packages/relic_core/pubspec.yaml | 2 +- packages/relic_io/pubspec.yaml | 4 ++-- 6 files changed, 30 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c7a873a..bb8549ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,25 @@ +## 2.0.0-rc.1 +- refactor!: Drop `NormalizedPath` interning ([#375](https://github.com/serverpod/relic/pull/375)) - fixes [#118](https://github.com/serverpod/relic/issues/118), [#342](https://github.com/serverpod/relic/issues/342), closes [#344](https://github.com/serverpod/relic/issues/344) + - BREAKING: `NormalizedPath.interned` is removed. Construction no longer caches, so there is no per-isolate cache to size, and no input that can thrash it + - Add `Router.lookupUri(method, url)`, the entry point for request routing: it derives the path with `NormalizedPath.fromUri` and looks it up with `lookupPath` + - Routing recovers most of the lost throughput by pre-computing repeated work and by undoing parameter bindings in place while backtracking, instead of copying the parameter map at every level +- fix!: Address security audit findings ([#369](https://github.com/serverpod/relic/pull/369)) + - BREAKING: Cross-origin WebSocket upgrades are rejected with 403 by default; pass `WebSocketUpgrade(..., allowAnyOrigin: true)` to accept them. Only the host is compared, since a TLS-terminating proxy changes scheme and port + - BREAKING: Header names and values are validated on assignment. CR, LF, NUL, and invalid names now throw where every header write funnels, rather than reaching the wire + - BREAKING: Malformed auth headers and non-token MIME type parts are rejected where they were previously tolerated + - The request path is split into segments before percent-decoding, so an encoded separator (`%2F`) can no longer introduce a path boundary that no upstream proxy saw; `NormalizedPath.fromUri` names the safe conversion + - The path is normalized before the routing host is prepended, so a path resolving upwards can no longer pop the host and select another virtual host + - Auth headers are parsed with the linear header scanner: one pass with no quadratic backtracking on a long value, and text between auth-params is rejected instead of skipped + - `Content-Disposition` parameter values and `AuthenticationHeader` challenge parts are escaped and validated, so a quote in a filename or realm can no longer end the value and graft on another parameter or challenge + - The token grammar is enforced on MIME type parts, which `io.ContentType` took separately and thus bypassed the CR/LF check applied to ordinary header values + - Multi-range responses are streamed lazily and the range count is capped, so a short request can no longer ask for many times the file size + - Multipart boundaries are drawn from a cryptographic generator instead of ~20 bits from `Random` + - The adapter dispatch is awaited, so a response that fails to write yields a 500 instead of leaving the connection open and the client waiting + - Detached (hijacked and upgraded) connections are tracked by the adapter: counted by `connectionsInfo()`, drained and sent a 1001 close on graceful shutdown, and destroyed on `close(force: true)` + - `use()` on a catch-all route now applies to the prefix itself, so `/api` no longer bypasses the middleware that `/api/keys` runs + - Add `Token68` for the RFC 9110 `token68` form, used when validating a single-token `WWW-Authenticate` challenge + - docs: The static file handler never filtered hidden files; the documentation no longer claims it does. Every file in the served directory is served, dot files included + ## 2.0.0-beta.1 - feat: Add `CacheControlHeader.parseStrict` for validating own values ([#370](https://github.com/serverpod/relic/pull/370)) - Throws a `FormatException` for an unrecognized directive or a malformed delta-seconds value instead of ignoring it diff --git a/packages/benchmark/pubspec.yaml b/packages/benchmark/pubspec.yaml index ad638102..17b546b8 100644 --- a/packages/benchmark/pubspec.yaml +++ b/packages/benchmark/pubspec.yaml @@ -13,6 +13,6 @@ dependencies: config: ^0.8.3 git: ^2.2.1 path: ^1.8.4 - relic: ^2.0.0-beta.1 + relic: ^2.0.0-rc.1 routingkit: ^5.1.2 spanner: ^1.0.5 diff --git a/packages/examples/pubspec.yaml b/packages/examples/pubspec.yaml index 02c34748..57432aad 100644 --- a/packages/examples/pubspec.yaml +++ b/packages/examples/pubspec.yaml @@ -8,4 +8,4 @@ environment: resolution: workspace dependencies: - relic: ^2.0.0-beta.1 + relic: ^2.0.0-rc.1 diff --git a/packages/relic/pubspec.yaml b/packages/relic/pubspec.yaml index 712d2251..091b1e27 100644 --- a/packages/relic/pubspec.yaml +++ b/packages/relic/pubspec.yaml @@ -1,6 +1,6 @@ name: relic description: A lightweight and flexible web server inspired by Shelf for building APIs and backend services. -version: 2.0.0-beta.1 +version: 2.0.0-rc.1 repository: https://github.com/serverpod/relic homepage: https://docs.dartrelic.dev/ topics: @@ -15,8 +15,8 @@ environment: resolution: workspace dependencies: - relic_core: ^2.0.0-beta.1 - relic_io: ^2.0.0-beta.1 + relic_core: ^2.0.0-rc.1 + relic_io: ^2.0.0-rc.1 dev_dependencies: async: ^2.13.0 diff --git a/packages/relic_core/pubspec.yaml b/packages/relic_core/pubspec.yaml index 0a604c82..eac24e94 100644 --- a/packages/relic_core/pubspec.yaml +++ b/packages/relic_core/pubspec.yaml @@ -1,6 +1,6 @@ name: relic_core description: Core framework for Relic web server (platform-agnostic). -version: 2.0.0-beta.1 +version: 2.0.0-rc.1 repository: https://github.com/serverpod/relic homepage: https://docs.dartrelic.dev/ topics: diff --git a/packages/relic_io/pubspec.yaml b/packages/relic_io/pubspec.yaml index 5c2e7246..c6141a68 100644 --- a/packages/relic_io/pubspec.yaml +++ b/packages/relic_io/pubspec.yaml @@ -1,6 +1,6 @@ name: relic_io description: dart:io adapter for Relic web server. -version: 2.0.0-beta.1 +version: 2.0.0-rc.1 repository: https://github.com/serverpod/relic homepage: https://docs.dartrelic.dev/ topics: @@ -18,7 +18,7 @@ dependencies: crypto: ^3.0.0 mime: ^2.0.0 path: ^1.8.3 - relic_core: ^2.0.0-beta.1 + relic_core: ^2.0.0-rc.1 stack_trace: ^1.10.0 stream_channel: ^2.1.1 web_socket: ^1.0.1