What's Changed
- fix(oapi): release the METADATA_REGISTRY read guard before recursing by @ya3rub in #1714
- Fix shutdown, streamed body completion and middleware state by @chrislearn in #1716
- Fix tus upload completion and metadata replacement by @chrislearn in #1715
- Isolate optional middleware features by @chrislearn in #1717
- Fix route rollback, conditional file ranges and OpenAPI paths by @chrislearn in #1718
- Bound CSRF validation and honor OIDC verification policy by @chrislearn in #1719
- Generate Allow headers from safely inferred route methods by @chrislearn in #1720
- chore(oapi): update Swagger UI to v5.34.0 by @chrislearn in #1721
- Fix middleware boundaries and multipart upload handling by @chrislearn in #1722
- Fix upload file lifetimes, range compression and OpenAPI inheritance by @chrislearn in #1723
- Preserve existing Vary headers when applying CORS by @chrislearn in #1726
- Use weak ETags for dynamically compressed responses by @chrislearn in #1727
- Prevent SSE field contents from changing event framing by @chrislearn in #1724
- Read request bodies required by flattened extractors by @chrislearn in #1728
- Preserve ordinary OPTIONS responses in CORS middleware by @chrislearn in #1729
- Honor If-Match precedence when serving files by @chrislearn in #1730
- Apply configured SSE interval to the first heartbeat by @chrislearn in #1731
- Propagate request body errors from derived extractors by @chrislearn in #1725
- Clear stale representation headers when rendering status errors by @chrislearn in #1733
- Normalize multipart size limit failures to HTTP 413 by @chrislearn in #1734
- Surface session backend failures with configurable policy by @chrislearn in #1736
- Select a TLS provider for standalone extra middleware tests by @chrislearn in #1737
- Discover allowed methods in one traversal for independent route filters by @chrislearn in #1738
- Avoid quadratic cleanup when growing the TUS lock map by @chrislearn in #1739
- Run error catchers after rejecting response media types by @chrislearn in #1735
- Audit current dependency resolutions and require patched TLS releases by @chrislearn in #1740
- Isolate TUS payloads from upload metadata by @chrislearn in #1732
- Keep trailing-slash redirects on the original origin by @chrislearn in #1741
- Honor If-Range validators for streamed and embedded responses by @chrislearn in #1743
- Honor If-Match precedence in ReadSeeker by @chrislearn in #1744
- Vary identity responses when encoding negotiation is enabled by @chrislearn in #1746
- Record OpenTelemetry metrics and spans after response finalization by @chrislearn in #1747
- Keep TUS uploads recoverable when finalization metadata fails by @chrislearn in #1742
- Ignore Range when serving HEAD representations by @chrislearn in #1745
- Validate CSRF tokens for all unsafe HTTP methods by @chrislearn in #1748
- Enforce If-Match preconditions for embedded assets by @chrislearn in #1749
- Omit query strings from empty-response warnings by @chrislearn in #1750
- Log response status after Service finalization by @chrislearn in #1751
- Refresh parsed request caches after Tower rewrites by @chrislearn in #1752
- Bound multipart part and file counts by @chrislearn in #1753
- Preserve Salvo context across Tower short circuits and cancellation by @chrislearn in #1754
- Match Accept-Encoding codings and the q parameter case-insensitively by @wleeaf in #1756
- Add MCP Streamable HTTP integration example by @chrislearn in #1771
- Raise minimum supported Rust version to 1.95 by @chrislearn in #1772
- Redact URL secrets from proxy failure logs by @chrislearn in #1763
- Validate OIDC discovery identity and JWK purposes by @chrislearn in #1767
- Keep static directory redirects on the request origin by @chrislearn in #1768
- Preserve request extensions across direct Tower service calls by @chrislearn in #1758
- Keep HTTP/3 request tasks owned by their connection by @chrislearn in #1764
- Preserve origin preconditions for conditional cache requests by @chrislearn in #1765
- Apply request method semantics to ReadSeeker responses by @chrislearn in #1766
- Reject unsupported querystring derives and preserve numeric constraints by @chrislearn in #1769
- Fail dependency audits on unsound advisories by @chrislearn in #1762
- Gate publication on dependency audits and document the JWT blocker by @chrislearn in #1761
- Expose client certificates and TLS metadata on requests by @chrislearn in #1759
- Use the connection scheme for HTTPS enforcement by @chrislearn in #1777
- Cancel queued compression work when responses are dropped by @chrislearn in #1773
- Preserve leading whitespace in server-sent event fields by @chrislearn in #1774
- Reject unsupported TUS concatenation capabilities by @chrislearn in #1776
- Preserve completed uploads after TUS upload expiration by @chrislearn in #1775
- Preserve binary tus metadata in memory and storage by @chrislearn in #1779
- Honor TUS method overrides during endpoint selection by @chrislearn in #1778
- Support 128-bit integers in request deserialization by @chrislearn in #1780
- Honor no-transform directives in compression middleware by @chrislearn in #1781
- Preserve tus upload identities after payload finalization by @chrislearn in #1782
- Decode escaped JSON keys in request extractors by @chrislearn in #1783
- Respect wildcard quality in compression negotiation by @chrislearn in #1784
- Advertise content codings for embedded compressed assets by @chrislearn in #1785
- Replace stale JWT authentication results on each attempt by @chrislearn in #1786
- Align the default JWT header finder with its constructor by @chrislearn in #1787
- Parse cache directives without losing opaque or quoted values by @chrislearn in #1788
- Stop CSRF token issuance when persistence fails by @chrislearn in #1789
- Refresh session CSRF proofs after cipher changes by @chrislearn in #1790
- Preserve bracketed query list token boundaries by @chrislearn in #1791
- Preserve typeless and composite schemas on deserialization by @chrislearn in #1792
- Preserve repeated headers from tus completion hooks by @chrislearn in #1793
- Enforce armed write-stall deadlines before accepting progress by @chrislearn in #1794
- Accept upstream protocol selections from Upgrade offers by @chrislearn in #1795
- Keep proxy credentials out of default Basic authentication by @chrislearn in #1796
- Require GET for WebSocket upgrade handshakes by @chrislearn in #1797
- Retain temporary uploads in owned file extractors by @chrislearn in #1798
- Preserve trusted proxy boundaries across forwarded fields by @chrislearn in #1799
- Preserve multipart failures in file extractors by @chrislearn in #1800
- Respect HTTP range unit semantics in static responses by @chrislearn in #1801
- Resolve ordinary HTTP/3 request headers independently by @chrislearn in #1802
- Restore built-in ACME certificate issuance by @chrislearn in #1803
- Apply flash minimum levels when reading messages by @chrislearn in #1804
- Accept case-insensitive tus upload media types by @chrislearn in #1805
- Keep file content codings off generated error pages by @chrislearn in #1806
- Preserve fields alongside OpenAPI schema references by @chrislearn in #1807
- Deserialize explicit empty flat request lists by @chrislearn in #1808
- Own connections for the lifetime of the serving future by @chrislearn in #1809
- Compress boxed and channel response body streams by @chrislearn in #1810
- Parse OIDC JWKS cache directives with quoted boundaries by @chrislearn in #1811
- Make CORS vary configuration inferable by @chrislearn in #1812
- Preserve path extensions when merging API documents by @chrislearn in #1813
- Combine repeated Accept-Encoding fields before negotiation by @chrislearn in #1814
- Accept OIDC signing keys without optional algorithm metadata by @chrislearn in #1815
- Preserve HTTP/3 request trailers in body frames by @chrislearn in #1816
- Account for upstream Age in OIDC JWKS freshness by @chrislearn in #1817
- Preserve three-decimal quality values in encoding negotiation by @chrislearn in #1818
- Generate buffered ETags from ordered response bytes by @chrislearn in #1819
- Remove unused dotenv and refresh dependency audit status by @chrislearn in #1821
- Check all features on MSRV and retain performance baselines by @chrislearn in #1822
- Stop HTTP/3 response sending after stream or body errors by @chrislearn in #1820
- Accept extension HTTP methods in default JWT finders by @chrislearn in #1826
- Preserve OpenAPI parameter representation constraints when merging by @chrislearn in #1824
- Honor every OIDC JWKS Cache-Control field by @chrislearn in #1825
- Support references in OpenAPI parameter lists by @chrislearn in #1823
- Decode symmetric OIDC JWK keys as base64url by @chrislearn in #1827
- Preserve explicit empty OpenAPI operation security by @chrislearn in #1828
- Support boolean OpenAPI schemas by @chrislearn in #1829
- Support references in OpenAPI security scheme components by @chrislearn in #1830
- Apply request method semantics to static file responses by @chrislearn in #1831
- Honor every embedded If-None-Match field by @chrislearn in #1832
- Preserve repeated values in aggregate header extraction by @chrislearn in #1833
- Accept OpenAPI documents without optional paths by @chrislearn in #1834
- build(deps): update parking_lot requirement from 0.12 to 0.13 by @dependabot[bot] in #1757
- Fix StaticDir dot-file access through resolved path aliases by @chrislearn in #1835
- Make dependency audits advisory in CI by @chrislearn in #1836
New Contributors
Full Changelog: v1.0.1...v1.1.0