melosso/portway v0.7.0-preview.2

on GitHub

Headline

Your gateway is now observable from the tools you already run. Pick a telemetry provider with one configuration key: push traces and metrics to any OTLP collector, or let Prometheus scrape the gateway directly at /metrics. Request metrics are tagged per endpoint, so slow or failing endpoints show up by name in your dashboards.

New in v0.7.0

• .NET 11: runtime retargeted to net11.0 (preview).
• OpenAPI 3.2: QUERY is documented as a native query operation (a safe, cacheable read whose query travels in the JSON body per RFC 10008; combined with method translation it enables cached, read-only GraphQL proxying with "AllowedMethods": ["QUERY"]), namespaces become a tag hierarchy, endpoints can be marked deprecated, authors can provide example payloads, file uploads document their multipart encoding, and all errors share one response schema. Note that the Scalar UI does not render QUERY operations yet; the generated document is correct and other tooling reads it fine.
• OData $expand (#43): declare a to-one relationship in entity.json and Portway joins the related record in, on Table and View endpoints, under the target's own allowlist.
• OData 8 query engine: the SQL query stack moved to Microsoft.OData 8 and SqlKata 4, through the Melosso.DynamicODataToSQL fork.
• PostgreSQL and MySQL parity (#29): SQL endpoints behave identically across SQL Server, PostgreSQL, and MySQL/MariaDB.
• Direct table write mode (#42): SQL endpoints can write straight to a table with validation and full CRUD, no stored procedure required.
• Telemetry providers (#33): Telemetry:Provider selects Otlp (push) or Prometheus (native scrape endpoint, unauthenticated and rate-limit exempt like /health). Old Enabled/OtlpEndpoint configs keep working, and the Web UI settings page shows the active provider.
• Per-endpoint metrics (#33): request duration histograms carry a portway.endpoint tag, next to cache hit/miss counters.
• Response transforms (#34, #41): declarative transforms on proxy, composite, and SQL endpoint responses.
• Per-token rate limiting: individual tokens can carry their own limits, with better diagnostics.
• Namespaced File and Webhook endpoints: both types support namespaces.
• Integration reference: new documentation for AFAS Profit, Odoo, SAP Business One, NocoDB, Teable, and Pimcore.

Fixes

• Fix: saving a config file unchanged still added a backup, pushing real versions out of the ten kept per file.
• Fix: two config saves in the same millisecond collided on the backup filename and one was lost.
• Fix: the .backups folder is now hidden on Windows, like .core.
• Fix: file watcher and SQL pool shutdown swallowed errors, and disposing either twice could throw.
• Fix: a failing database maintenance service could stop the whole host; maintenance errors now log and retry.
• Fix: startup exceptions were invisible in console output; the log template now includes exception details.
• Fix: proxy requests with a charset in the Content-Type (most HTTP clients) returned 500; the forwarded Content-Type is now parsed instead of rejected.
• Fix: XML and SOAP bodies to proxy endpoints returned 415; content validation now gates by endpoint type instead of guessing from the URL text.
• Fix: path segments appended after a query string baked into an endpoint Url produced invalid upstream URLs.
• Fix: clients could override credentials baked into an endpoint Url by sending a query parameter with the same name; colliding client parameters are now dropped.
• Fix: webhook tag descriptions were tied to a removed root configuration.
• Fix: file endpoint namespace handling and error responses.
• Fix: the telemetry pipeline only started when an OTLP collector was configured; metrics now work with either provider independently.
• Fix: the Prometheus scrape endpoint was blocked by token authentication and rate limiting; it is now exempt like /health.
• Fix: MCP chat streamed nothing; the chat delta record carried an enum converter it could not serialize with, so every event failed.
• Fix: MCP page asset paths, script loading, and the health endpoint in the Web UI.
• Fix: token creation and validation in the Web UI ran blocking checks; both are async now.
• Fix: monospace font was applied to Web UI chrome (page subtitles, badges, tags, buttons); it is now reserved for code and data, with tabular numerals for metrics.
• Fix: the monitoring guide suggested scraping /health/details as Prometheus metrics, which never worked; it now points at the real /metrics endpoint.
• Fix: documentation site deployment (brand assets, dead links, GitHub Pages URLs).

Breaking changes

1. .NET 11 runtime: building from source needs the .NET 11 SDK (preview).
2. License (#19): relicensed from AGPL-3.0 to EUPL-1.2.
3. Webhook routing: the root POST /api/{env}/webhook/{id} route is replaced by namespaced webhooks (POST /api/{env}/{namespace}/{name}/{id}); the default configuration migrated to Integrations/Inbound.

Upgrade notes

• Telemetry configs from earlier releases keep working: "Enabled": true selects the OTLP provider and a flat OtlpEndpoint is honored. Migrating to Telemetry:Provider is recommended.
• The Prometheus scrape endpoint only exists when you select the Prometheus provider; with any other provider the route is not mapped at all. When enabled it is served without authentication by design, so restrict it at your firewall or reverse proxy if the gateway is reachable from untrusted networks.

Full Changelog: v0.7.0-preview.1...v0.7.0-preview.2