Community
Mercure 1.0 is here in its first public preview. This is the biggest release in Mercure's history. It rebuilds authorization on standard OAuth 2.0, replaces the old topic selectors with a matcher system built on the WHATWG URL Pattern standard, ships a brand-new debugger, and lands a wave of security hardening, all backed by a fresh, IETF Internet-Draft submitted for RFC consideration. Your existing 0.x apps keep working unchanged through compatibility mode.
First proposed back in 2021 (#588), 1.0 grew up through nine drafts of the specification (draft-dunglas-mercure-08) and, since the last 0.x release in June, 94 commits across 25 pull requests and three alphas.
⚠️ This is a pre-release for testing. Do not run it in production yet. APIs may still change before the final 1.0.0.
🎯 A real matcher system, built on a standard
Topic matching is no longer a bag of ad-hoc selectors. 1.0 defines exactly two matcher types, and every hub supports both:
exact: case-sensitive, byte-for-byte topic comparison.urlpattern: the WHATWG URL Pattern standard, the same syntax browsers ship natively. Writehttps://example.com/books/:id, not a bespoke template.
It runs under a linear-time guard, so a crafted pattern can't hang the hub. This is a real standard your tools already understand, not a Mercure-only hack anymore as URI Pattern hijacking was in 0.x versions.
🔑 OAuth 2.0 authorization, simpler and more secure
The bespoke mercure JWT claim is gone. The hub is now an OAuth 2.0 protected resource, and tokens are standard RFC 9068 access tokens (typ: at+jwt) carrying iss, aud, and an RFC 9396 authorization_details claim.
- Self-issued tokens stay a first-class citizen. Sign tokens in your app with a key, exactly as before, just in a standard shape.
caddy mercure-tokenmints them from the CLI. - OAuth 2.0 authorization servers are now supported too. Point the hub at a
jwks_uri, advertise your authorization server in RFC 9728 metadata, and let it issue tokens for Mercure. - Less to configure. The hub derives its public URL and its token audience from each request, so a hub reachable on several domains needs no extra setup.
- Keys are bound per issuer, so a token is only ever verified with the key that belongs to its
iss.
🔍 A brand-new debugger
The built-in UI has been rebuilt and split in two:
- The debugger at
/.well-known/mercure/debug/is now safe to run in production. Open live streams and publish updates with a token you provide. - The playground is a dev-only mode that mints an all-access token and opens the hub up so you can experiment in seconds. Enable it with
MERCURE_EXTRA_DIRECTIVES=playground.
Try it right now on the demo hub: demo.mercure.rocks.
🛡️ Security hardening across the board
- Signing algorithms come from an explicit allowlist. The hub never trusts the algorithm in the token header.
- PEM keys can no longer be paired with
HS*, closing the classic RS-to-HS algorithm-confusion attack. - Access tokens no longer travel in the URL (RFC 9700). In the browser they ride a
__Secure--prefixed cookie. - Auth errors follow RFC 6750:
401 invalid_token,403 insufficient_scope,400 invalid_request. - An unknown Caddyfile directive in the
mercureblock is now a hard error, so a typo can't silently disable a security setting.
📜 A new spec and an updated hub
The protocol has been rewritten IETF-style and published as an Internet-Draft on track for RFC publication, with proposed IANA registries, so anyone can add new matcher types and actions. The hub itself is still a custom Caddy build, so TLS, HTTP/3, compression, and Prometheus metrics come built in. Two protocol features worth (re)discovering:
- Presence: know who is connected in real time, without a separate service.
- Canonical and alternate topics: publish a single update under several topics at once.
Plus a reconciliation cursor on the rel="mercure" Link header and an optional QUERY method for subscriptions too large to fit in a URL.
📚 Docs rebuilt around modern use cases
The documentation has been fully revamped and reorganized around what people build today, with dedicated guides for streaming LLM tokens to the browser and reporting AI agent progress in real time. Both run over plain Server-Sent Events with native EventSource and no client SDK.
🔄 100% compatible with the old protocol
Migrating a large codebase takes time, so 1.0 keeps a foot in both worlds. Turn on compatibility mode and every 0.x client and token keeps working:
protocol_version_compatibility 8It is off by default because it relaxes token validation, so treat it as a bridge while you migrate, not a destination. Full details in the upgrade guide.
🎤 See it live at API Platform Con
The opening keynote at API Platform Con is all about Mercure 1.0. Join us in Lille, France, or online on September 17 and 18, 2026 for the deep dive, the demos, and the roadmap. Grab your ticket!
Enterprise
The Mercure Cloud / Enterprise 1.0 alpha hub is available as an opt-in prerelease (image v1.0.0-alpha.3) with full 0.x compatibility mode. Not for production. The demo hub at demo.mercure.rocks runs it today.
Full Changelog: v0.24.2...v1.0.0-alpha.3