dunglas/mercure v1.0.0-beta.1

on GitHub

Community

Mercure 1.0 beta 1. The 1.0 protocol is settling. Since alpha 3 the subscription endpoint now enforces the HTTP semantics the spec mandates, the hub moves to Go 1.27 with strict authorization-claim decoding, and every subscription SSE frame got 19.5% smaller. Your existing 0.x apps keep working unchanged through compatibility mode.

⚠️ This is a pre-release for testing. Do not run it in production yet. APIs may still change before the final 1.0.0.

✨ New Features

• Accept-Query response header (RFC 10008 §3), sent on every subscription answer including refusals, so a client told 415 learns what it should have sent. CORS-exposed. by @dunglas in #1385
• Incremental: ?1 response header (RFC 10036), the standardized counterpart of the X-Accel-Buffering: no the hub already sends. by @dunglas in #1385

⚠️ Behavior Changes

The subscription endpoint is stricter than in the alphas. Every change enforces what the spec already mandated, and the pre-1.0-final window is the time to take them.

• A QUERY subscription body is only accepted as application/x-www-form-urlencoded (RFC 10008 §2.3): a missing or unparsable Content-Type gets 400, anything else gets 415. A fetch() QUERY with a body and no explicit Content-Type defaults to text/plain;charset=UTF-8 and is now rejected.
• An Accept header that refuses text/event-stream (q=0, or a list without it) now gets 406 instead of being ignored (RFC 9110). The most specific matching media range decides; an absent or unreadable Accept states no preference.
• Authorization claims are decoded strictly: a duplicate object member or invalid UTF-8 rejects the token instead of resolving to one reading the authorization server may not have validated.
• Subscription documents are serialized compactly — no indentation, no HTML escaping of <, > and &. Any conforming JSON parser is unaffected. Details in the upgrade guide.

🐛 Bug Fixes

• Expose Mercure-Last-Event-Id to cross-origin subscribers. Without it a fetch-based cross-origin subscriber cannot read the resumption cursor, so it cannot detect data loss when reconnecting. by @dunglas in #1385

⚡ Performance and Internal Improvements

• 19.5% smaller subscription SSE frames. Subscription documents now serialize with encoding/json/v2 without indentation: every JSON newline used to cost a further data: prefix on the wire. by @dunglas in #1378
• Go 1.27, with the standard library uuid package replacing github.com/gofrs/uuid, and atomic.Bool for the subscriber ready and disconnected flags. by @dunglas in #1378
• Fix golangci-lint v2.13 findings. by @pseidemann in #1366

📖 Documentation

• New update payloads page, with ActivityStreams 2.0 examples. by @dunglas in #1357
• Document the goroutineleak pprof profile. by @dunglas in #1378
• Hosted-service vulnerability reports now point at the Mercure Cloud policy. by @dunglas in #1383
• README fixes. by @TomKeur in #1369

🎤 See it live at API Platform Con

The opening keynote at API Platform Con is all about Mercure 1.0. Join us in Lille, France, or online on September 17 and 18, 2026. Grab your ticket!

Enterprise

The Mercure Cloud / Enterprise 1.0 beta hub is available as an opt-in prerelease (image v1.0.0-beta.1) with full 0.x compatibility mode. Not for production. The demo hub at demo.mercure.rocks runs it today.

💖 New Contributors

• @pseidemann made their first contribution in #1366
• @TomKeur made their first contribution in #1369

Full Changelog: v1.0.0-alpha.3...v1.0.0-beta.1