release: v0.7.0

CHANGELOG.md

@@ -7,6 +7,45 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-10-18
+
+### Performance
+
+- **Zero-Tokio WebSocket Transport**: Direct Python coroutine execution for WebSocket `receive`/`send`/`accept` eliminating Tokio task hops and future bridge overhead per frame ([#257](https://github.com/QueryaHub/OxyRoute/issues/257), [#264](https://github.com/QueryaHub/OxyRoute/pull/264)).
+- **Lock-Free Concurrency Checks**: Move `in_flight` and `max_concurrency` atomics directly to `App` and snapshot `AppState` once per request, eliminating reader lock contention ([#256](https://github.com/QueryaHub/OxyRoute/issues/256), [#263](https://github.com/QueryaHub/OxyRoute/pull/263)).
+- **Direct Pydantic Validation & Zero-AST JSON**: Direct `model_validate_json` execution and direct streaming of JSON bytes into Python dicts bypassing intermediate AST copies ([#255](https://github.com/QueryaHub/OxyRoute/issues/255), [#262](https://github.com/QueryaHub/OxyRoute/pull/262)).
+- **Sync Short-Circuit for Path Parameters**: Extended zero-Tokio sync short-circuit path to handle sync routes with path parameters ([#254](https://github.com/QueryaHub/OxyRoute/issues/254), [#261](https://github.com/QueryaHub/OxyRoute/pull/261)).
+- **Zero-Allocation Routing Attributes**: Extract string slices `&str` instead of heap-allocated `String` during preliminary dispatch ([#253](https://github.com/QueryaHub/OxyRoute/issues/253), [#260](https://github.com/QueryaHub/OxyRoute/pull/260)).
+- **Zero-Allocation Rate Limiting**: Zero-alloc key lookup in `RateLimiter::check` reusing byte buffers ([#252](https://github.com/QueryaHub/OxyRoute/issues/252), [#259](https://github.com/QueryaHub/OxyRoute/pull/259)).
+- **Cached Protocol Calls**: Replaced runtime `getattr` calls on protocol objects with direct method calls ([#251](https://github.com/QueryaHub/OxyRoute/issues/251), [#258](https://github.com/QueryaHub/OxyRoute/pull/258)).
+- **Native Compiled CORS & Security Headers**: Compiled CORS and security header policies executed directly in Rust without Python interop on short-circuited paths ([#218](https://github.com/QueryaHub/OxyRoute/issues/218), [#250](https://github.com/QueryaHub/OxyRoute/pull/250)).
+- **Zero-Copy Request Body**: Zero-copy request body handling via `PyBackedBytes` avoiding double memory copying ([#219](https://github.com/QueryaHub/OxyRoute/issues/219), [#249](https://github.com/QueryaHub/OxyRoute/pull/249)).
+- **Optimized Header Scanning**: Single-pass case-insensitive ASCII scan in `header_get_lax` with short-circuit lookup ([#220](https://github.com/QueryaHub/OxyRoute/issues/220), [#248](https://github.com/QueryaHub/OxyRoute/pull/248)).
+- **Native Fast JSON Serialization**: Fast-path native JSON serializer for dict and list responses ([#217](https://github.com/QueryaHub/OxyRoute/issues/217), [#247](https://github.com/QueryaHub/OxyRoute/pull/247)).
+
+### Security & Hardening
+
+- **CSWSH Protection**: Validate `Origin` header during WebSocket handshake with `allowed_origins` parameter ([#225](https://github.com/QueryaHub/OxyRoute/issues/225), [#239](https://github.com/QueryaHub/OxyRoute/pull/239)).
+- **Content-Length Guard**: Reject oversized request bodies using `Content-Length` before allocating buffer memory ([#206](https://github.com/QueryaHub/OxyRoute/issues/206), [#228](https://github.com/QueryaHub/OxyRoute/pull/228)).
+- **Rate Limiting Security**: Disallow trusting `X-Forwarded-For` / `X-Real-IP` by default unless explicitly configured ([#207](https://github.com/QueryaHub/OxyRoute/issues/207), [#229](https://github.com/QueryaHub/OxyRoute/pull/229)).
+- **Bounded Rate Limiter Memory**: Bound shard memory with LRU-style eviction preventing memory exhaustion from arbitrary IP/key floods ([#208](https://github.com/QueryaHub/OxyRoute/issues/208), [#230](https://github.com/QueryaHub/OxyRoute/pull/230)).
+- **SSE Field Sanitization**: Prevent CRLF injection by rejecting newlines in SSE `event` and `id` fields ([#221](https://github.com/QueryaHub/OxyRoute/issues/221), [#243](https://github.com/QueryaHub/OxyRoute/pull/243)).
+- **JSON & Multipart Error Safety**: Build error bodies safely with `serde_json::json!` avoiding format string injection ([#222](https://github.com/QueryaHub/OxyRoute/issues/222), [#242](https://github.com/QueryaHub/OxyRoute/pull/242)).
+- **Case-Insensitive Bearer Auth**: Match `Bearer` scheme case-insensitively per RFC 6750 ([#224](https://github.com/QueryaHub/OxyRoute/issues/224), [#240](https://github.com/QueryaHub/OxyRoute/pull/240)).
+- **Robust Cookie Parsing**: Ignore malformed cookie segments instead of aborting search ([#223](https://github.com/QueryaHub/OxyRoute/issues/223), [#241](https://github.com/QueryaHub/OxyRoute/pull/241)).
+- **Docs UI Security**: Pin CDN asset versions and add SRI integrity hashes for Scalar / Swagger UI ([#226](https://github.com/QueryaHub/OxyRoute/issues/226), [#238](https://github.com/QueryaHub/OxyRoute/pull/238)).
+
+### Bug Fixes
+
+- **Deadlock Prevention**: Acquire Python GIL before taking `AppState` write lock to eliminate AB-BA deadlocks with background worker threads ([#205](https://github.com/QueryaHub/OxyRoute/issues/205), [#227](https://github.com/QueryaHub/OxyRoute/pull/227)).
+- **Middleware Stacking**: `apply_cors()` and `apply_csrf()` now compose properly onto existing middleware chains rather than overwriting them ([#209](https://github.com/QueryaHub/OxyRoute/issues/209), [#231](https://github.com/QueryaHub/OxyRoute/pull/231)).
+- **Wildcard Path Parameters**: Wildcard `*path` parameters preserve string type and bypass numeric/float schema-lite coercion ([#212](https://github.com/QueryaHub/OxyRoute/issues/212), [#234](https://github.com/QueryaHub/OxyRoute/pull/234)).
+- **Handler Return Types**: Correctly handle dict/list returns and prevent status code misinterpretation ([#211](https://github.com/QueryaHub/OxyRoute/issues/211), [#233](https://github.com/QueryaHub/OxyRoute/pull/233)).
+- **Database Query Decoding**: Robust decoding for Postgres UUID, Timestamp, and Decimal types without panicking ([#213](https://github.com/QueryaHub/OxyRoute/issues/213), [#237](https://github.com/QueryaHub/OxyRoute/pull/237)).
+- **Protocol Wrapper Proxy**: Forward all RSGI protocol methods (`__call__`, async iteration, WebSockets) through `_ProtocolWrapper` ([#216](https://github.com/QueryaHub/OxyRoute/issues/216), [#244](https://github.com/QueryaHub/OxyRoute/pull/244)).
+- **Adaptive Concurrency Limiter**: Fix unit mismatches and prevent self-throttling under normal operation ([#215](https://github.com/QueryaHub/OxyRoute/issues/215), [#245](https://github.com/QueryaHub/OxyRoute/pull/245)).
+- **Cleanup**: Remove deprecated `/test_db` debug prototype endpoint ([#210](https://github.com/QueryaHub/OxyRoute/issues/210), [#232](https://github.com/QueryaHub/OxyRoute/pull/232)).
+
 ## [0.6.0] - 2026-09-12
 
 ### Added