amberframework/amber v1.5.0

v1.5.0 — Crystal 1.21 support

on GitHub

Amber 1.5.0 — Crystal 1.21 support

Crystal 1.21 enables multithreading by default, which made Process.fork a compile-time error — and broke compilation of every Amber app on Crystal 1.21.0+ (Error: Process fork is unsupported with multithreaded mode). This release restores compatibility and ships the security and performance work that had been waiting in review.

Compatibility

• Amber::Cluster.fork no longer uses Process.fork (#1399) — cluster workers are spawned with Process.new (same mechanism as v2). process_count / master-worker semantics unchanged. Verified: framework specs, amber new → build → serve, and cluster mode with 2 workers, on Crystal 1.20.3 and 1.21.0.
• ameba pinned to 1.7.0-dev in framework dev-dependencies and the generated app template (#1399, supersedes #1394 — thanks @botantony). ameba ≤ 1.6.4 fails to build on Crystal 1.21, which broke shards install for new apps.
• New COMPATIBILITY.md documents which Crystal versions build which Amber releases.
• Declared Crystal requirement is now >= 1.20.0, < 2.0 (previously >= 1.0.0, which overstated reality).

Security (thanks @renich)

• XSS: exception messages are HTML-escaped in the default error response (#1385).
• Command injection: amber encrypt no longer passes the editor command through a shell (#1388).
• DoS hardening: MessageVerifier / MessageEncryptor reject malformed payloads with typed exceptions instead of raising IndexError (#1386).
• SecureHeaders pipe (#1390): new apps get X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy out of the box, plugged above the Error pipe so 404/403 responses keep their headers; HSTS is opt-in (SecureHeaders.new(hsts: true)).

Performance

• Router content-extension matching uses string ops + set lookup instead of regex alternation (#1387, #1391, thanks @renich).

CI / contributor experience

• CircleCI (broken at the project level) replaced with GitHub Actions: spec matrix on Crystal 1.20.3 + latest, Linux + macOS.
• Contributor review rubric, PR template, and local dev hooks (#1393).

Upgrade notes

• If your app pins amber to 1.4.1 exactly (the default for apps generated by older CLIs), change it to ~> 1.5.0 in shard.yml to build on Crystal 1.21.
• Existing apps do not get SecureHeaders automatically — it's wired in the new-app template. Add plug Amber::Pipe::SecureHeaders.new above plug Amber::Pipe::Error.new in your config/routes.cr to adopt it.