v0.1.412

Full Changelog: v0.1.410...v0.1.412

v0.1.410

RustAPI v0.1.410 Release Notes

Release Date: March 9, 2026
Full Changelog: v0.1.397...v0.1.410

Benchmark Source of Truth: Current benchmark methodology and canonical performance claims live in docs/PERFORMANCE_BENCHMARKS.md. Historical release-specific benchmark notes should be treated as point-in-time snapshots unless they are linked from that document.

---

🎯 Highlights

v0.1.410 is the Production Baseline release. It delivers everything you need to go from prototype to production-ready service with a single builder call — health probes, session management, rate limiting, observability tooling, and a suite of real-world examples.

Feature	Crate	Impact
Production Defaults Preset	rustapi-core	One-call production setup: health probes + tracing + request IDs
Health Check System	rustapi-core	Built-in /health, /ready, /live with custom checks
Session Management	rustapi-extras	Cookie-backed sessions with pluggable stores
Rate Limiting Strategies	rustapi-extras	Fixed window, sliding window, and token bucket
CLI: bench & observability	cargo-rustapi	New bench and observability subcommands
Multipart Streaming	rustapi-core	Enhanced streaming multipart with progress tracking
4 New Examples	rustapi-rs	Auth, CRUD, Jobs, Streaming — ready to copy
10+ Cookbook Recipes	docs/cookbook	Migration guides, session auth, observability, error handling

---

🏭 Production Defaults Preset

Go production-ready with a single call:

use rustapi_rs::prelude::*;

#[tokio::main]
async fn main() {
    RustApi::new()
        .production_defaults("my-service")
        .run("0.0.0.0:3000")
        .await;
}

This enables:

• RequestIdLayer — unique ID on every request
• TracingLayer — structured logging with service metadata
• /health, /ready, /live — Kubernetes-compatible probes

Customizable via ProductionDefaultsConfig:

RustApi::new()
    .production_defaults_with_config(
        ProductionDefaultsConfig::new("my-service")
            .version("1.2.3")
            .tracing_level(tracing::Level::DEBUG)
            .request_id(true)
            .health_endpoints(true)
    )
    .run("0.0.0.0:3000")
    .await;

---

🏥 Health Check System

Full health check module with builder API, custom checks, and OpenAPI integration:

use rustapi_rs::prelude::*;

let health = HealthCheckBuilder::new(true)
    .add_check("database", || async {
        // Check database connectivity
        HealthStatus::healthy()
    })
    .add_check("redis", || async {
        HealthStatus::degraded("high latency".into())
    })
    .version("1.0.0")
    .build();

RustApi::new()
    .with_health_check(health)
    .health_endpoints()
    .run("0.0.0.0:3000")
    .await;

• /health — aggregated status of all checks (200 or 503)
• /ready — dependency readiness (200 or 503)
• /live — lightweight liveness probe (always 200)
• Configurable paths via HealthEndpointConfig
• HealthStatus variants: Healthy, Unhealthy { reason }, Degraded { reason }

---

🔐 Session Management

Cookie-backed session management with pluggable storage backends:

use rustapi_rs::prelude::*;
use rustapi_rs::extras::session::*;

let store = MemorySessionStore::new();

RustApi::new()
    .layer(SessionLayer::new(
        store,
        SessionConfig::default()
            .cookie_name("my_session")
            .ttl(Duration::from_secs(3600))
            .secure(true)
            .http_only(true)
            .same_site(SameSite::Lax)
    ))
    .run("0.0.0.0:3000")
    .await;

Handler-side usage:

#[post("/login")]
async fn login(session: Session, body: Json<LoginRequest>) -> Result<Json<Value>> {
    session.insert("user_id", &body.user_id).await?;
    session.cycle_id().await; // CSRF protection
    Ok(Json(json!({"status": "ok"})))
}

• Session extractor with get, insert, contains, destroy, cycle_id
• MemorySessionStore built-in; SessionStore trait for custom backends
• Rolling sessions (refresh TTL on each access) by default
• Secure defaults: HttpOnly, Secure, SameSite=Lax

---

🚦 Rate Limiting Strategies

Three strategies for different use cases:

use rustapi_rs::extras::rate_limit::*;

// Fixed window: 100 requests per 60 seconds
RustApi::new()
    .layer(RateLimitLayer::new(100, Duration::from_secs(60))
        .strategy(RateLimitStrategy::FixedWindow))

// Sliding window: smoother distribution
    .layer(RateLimitLayer::new(100, Duration::from_secs(60))
        .strategy(RateLimitStrategy::SlidingWindow))

// Token bucket: allows bursts
    .layer(RateLimitLayer::new(100, Duration::from_secs(60))
        .strategy(RateLimitStrategy::TokenBucket))

• Per-IP tracking with DashMap
• Response headers: X-RateLimit-Remaining, Retry-After
• Returns 429 Too Many Requests when limit exceeded

---

🔨 New CLI Commands

cargo rustapi bench

Run the performance benchmark workflow:

cargo rustapi bench --warmup 5 --iterations 1000

cargo rustapi observability

Surface observability assets and check production readiness:

cargo rustapi observability --check

Checks for production baseline docs, observability cookbook, benchmark script, and quality gate.

cargo rustapi doctor (enhanced)

Expanded environment health checks with --strict mode that fails on warnings.

---

📄 Enhanced Multipart Streaming

StreamingMultipart and StreamingMultipartField now support:

• .bytes_read() — progress tracking
• .save_to(path) — stream directly to disk
• .save_as(path) — save with custom filename
• .into_uploaded_file() — convert to UploadedFile
• .field_count() — number of fields in the upload

---

📝 New Examples

Four production-ready examples added to crates/rustapi-rs/examples/:

Example	Description
auth_api.rs	Session-based authentication with login/logout/refresh
full_crud_api.rs	Complete CRUD API with Arc<RwLock<HashMap>> state
jobs_api.rs	Background job queue with InMemoryBackend
streaming_api.rs	Server-sent events (SSE) streaming

---

📖 New Cookbook Recipes

• Session Authentication — cookie-backed auth patterns
• Observability — monitoring and tracing setup
• Error Handling — structured error responses
• Custom Extractors — building your own extractors
• Middleware Debugging — layer inspection and troubleshooting
• Axum Migration — step-by-step migration guide from Axum
• Actix Migration — step-by-step migration guide from Actix-web
• OIDC/OAuth2 Production — production-grade OAuth2 setup
• Macro Attributes Reference — complete reference for all route macro attributes

---

📦 Facade Re-exports

New types available in rustapi_rs::prelude::*:

• ProductionDefaultsConfig, HealthCheck, HealthCheckBuilder, HealthCheckResult, HealthStatus, HealthEndpointConfig

New modules in rustapi_rs::extras:::

• session — Session, SessionLayer, SessionConfig, MemorySessionStore, SessionStore, SessionRecord
• rate_limit — RateLimitLayer, RateLimitStrategy

---

---

What's Changed

• Production baseline by @Tuntii in #152

Full Changelog: v0.1.397...v0.1.410

v0.1.397

[0.1.397] - 2026-02-26

Added

Compile-Time Extractor Safety (rustapi-macros)

• Body-consuming extractor ordering enforced at compile time: Json<T>, Body, ValidatedJson<T> must now be the last handler parameter — otherwise you get a clear compiler error instead of a silent runtime failure.
• Descriptive error messages: "Body-consuming extractors must be the last parameter".
• Detects multiple body-consuming extractors in the same handler.

Typed Error Responses — OpenAPI Integration (rustapi-macros, rustapi-core)

• New #[errors(404 = "Not found", 403 = "Forbidden")] attribute macro for route handlers.
• Error types are automatically reflected in the OpenAPI spec with ErrorSchema references.
• Route::error_response() builder method for programmatic error response registration.
• Swagger UI now displays all possible error responses per endpoint.

Pagination & HATEOAS Helpers (rustapi-core)

• Paginate extractor: ?page=2&per_page=20 with sensible defaults (page=1, per_page=20, max=100).
• Paginated<T> response wrapper: JSON body with items/meta/_links, RFC 8288 Link header, X-Total-Count & X-Total-Pages headers.
• CursorPaginate extractor: ?cursor=abc&limit=20 for cursor-based pagination.
• CursorPaginated<T> response wrapper: items + next_cursor + has_more.
• Helper methods: offset(), limit(), paginate(), after(), is_first_page().
• All types re-exported in the rustapi-rs prelude.

Built-in Caching Layer (rustapi-extras)

• Full rewrite of the caching system with production-grade features:
  • In-memory response cache with LRU eviction and configurable max_entries (default: 10,000).
  • ETag generation via FNV-1a hash + automatic If-None-Match → 304 Not Modified.
  • Cache-Control header awareness (no-cache, no-store).
  • Vary-by-header cache key strategy.
  • CacheHandle for programmatic invalidation (by path prefix, exact key, or clear all).
  • CacheBuilder for ergonomic middleware configuration.

Event System & Lifecycle Hooks (rustapi-core)

• EventBus: In-process pub/sub with sync and async handlers.
  • on() for sync handlers, on_async() for async handlers.
  • emit() (fire-and-forget) and emit_await() (wait for all handlers).
  • handler_count() and topics() introspection.
• Lifecycle hooks on RustApi builder:
  • .on_start(async { ... }) — runs before the server starts accepting connections.
  • .on_shutdown(async { ... }) — runs on graceful shutdown.
  • Integrated into both run() and run_with_shutdown().
• EventBus re-exported in the rustapi-rs prelude.

Native Hot Reload / Watch Mode (cargo-rustapi, rustapi-core)

• Complete rewrite of cargo rustapi watch using notify + notify-debouncer-mini — no more cargo-watch dependency.
  • 300ms debounce, configurable extension filter, smart ignore paths.
  • Build-before-restart: only restarts the server if cargo build succeeds.
  • Graceful process shutdown (kill + 5s timeout), crash detection with "watching for changes" recovery.
• .hot_reload(true) builder API on RustApi — prints a dev-mode banner with watcher hints.
• cargo rustapi run --watch / --reload / --hot delegates to the native watcher.

gRPC Support Published (rustapi-grpc)

• First crates.io release of rustapi-grpc v0.1.397.
• run_rustapi_and_grpc() for dual HTTP + gRPC server execution.
• Re-exports tonic and prost for ergonomic proto service integration.
• protocol-grpc feature flag in rustapi-rs.

What's Changed

• fix: address review feedback - validate pagination size and update doc status by @Copilot in #110
• docs: sync to v0.1.335, add pagination recipe, and improve learning path by @Tuntii in #109
• docs: enhance learning path and fix cookbook recipes by @Tuntii in #112
• Add optional rustapi-grpc crate (tonic/prost) by @Tuntii in #118
• docs: Add Background Jobs recipe and update Learning Path by @Tuntii in #120
• docs: Enterprise Learning Path & Testing Recipe by @Tuntii in #121
• core: stabilize facade API surface, feature taxonomy, and public-api CI gate by @Tuntii in #122
• docs: Add Phase 5 (Specialized Skills) and recipes for gRPC, SSR, and AI by @Tuntii in #123
• docs: Fix SSR recipe and update cookbook index by @Tuntii in #124
• docs: improve cookbook and learning path by @Tuntii in #125
• docs: Cookbook and Learning Path Improvements by @Tuntii in #126
• docs: continuous improvement and accuracy fixes by @Tuntii in #129
• docs: cookbook expansion and learning path improvements by @Tuntii in #132
• Fix review feedback: deduplication, pagination validation, lifecycle error handling, cache correctness by @Copilot in #140
• Add lifecycle hooks, pagination, and cache by @Tuntii in #139

Full Changelog: v0.1.335...v0.1.397

V0.1.335

RustAPI Release History

v0.1.333 - Quick Wins + Must-Have Completion (2026-02-08)

This release combines dependency surface cleanup, runtime completions, and documentation alignment in one focused quick-wins iteration.

Highlights

• True dual-stack runtime completed: RustApi::run_dual_stack now runs HTTP/1.1 (TCP) and HTTP/3 (QUIC/UDP) simultaneously.
• WebSocket permessage-deflate negotiation completed: real extension parsing and parameter negotiation added for Sec-WebSocket-Extensions.
• OpenAPI ref integrity coverage strengthened: component traversal validation now includes response/requestBody/header/callback paths with tests.
• Async validation context from app state: AsyncValidatedJson now uses state-provided ValidationContext behavior with verified coverage.
• Native OpenAPI + validation documentation alignment: architecture docs are synced to OpenAPI 3.1 and v2-native validation direction.
• Dependency footprint reduced (quick wins): unused/overly broad dependencies and feature sets were tightened, reducing lockfile surface.

Technical Details

• crates/rustapi-core/src/app.rs: run_dual_stack implementation
• crates/rustapi-core/src/server.rs: Server::from_shared for shared app state
• crates/rustapi-ws/src/upgrade.rs: permessage-deflate parsing/negotiation
• crates/rustapi-ws/src/compression.rs: negotiation test updates
• crates/rustapi-openapi/src/tests.rs: reference traversal coverage test
• docs/ARCHITECTURE.md, docs/cookbook/src/architecture/system_overview.md, crates/rustapi-openapi/README.md: architecture/docs alignment

Validation

• cargo test -p rustapi-openapi
• cargo test -p rustapi-ws
• cargo test -p rustapi-core test_async_validated_json_with_state_context
• cargo check -p rustapi-core --features http3

Commit References

• ca238ac chore(quick-wins): reduce dependency surface and align native OpenAPI docs
• dcb0e8b feat(core/ws/openapi): complete quick-wins must-haves

What's Changed

• Update documentation and workspace versions to 0.1.300 by @Tuntii in #103
• Extract validators from App State in AsyncValidatedJson by @Tuntii in #104
• ⚡ Optimize RegexRule compilation by @Tuntii in #102
• Validate references in all OpenAPI spec components by @Tuntii in #101
• ⚡ Optimize FileAuditStore::log_async to use spawn_blocking by @Tuntii in #100
• ⚡ Fix Head-of-Line Blocking in InMemory Job Backend by @Tuntii in #99
• Bump opentelemetry from 0.22.0 to 0.31.0 by @dependabot[bot] in #95
• Bump opentelemetry-semantic-conventions from 0.14.0 to 0.31.0 by @dependabot[bot] in #92
• docs: update versions to 0.1.300 and expand testing documentation by @Tuntii in #105
• Update Cookbook Documentation for v0.1.300 by @Tuntii in #106
• chore(quick-wins): reduce dependency surface and align native OpenAPI… by @Tuntii in #107
• feat(core/openapi/ws): dual-stack (H1+H3) runtime, async validation context, OpenAPI ref integrity, WS permessage-deflate negotiation, aligned docs by @Tuntii in #108

Full Changelog: v0.1.300...v0.1.335

v0.1.300

[v0.1.300] - 2026-02-06

Added

• Replay (Time-Travel Debugging): Complete time-travel debugging system for recording and replaying HTTP requests
  • rustapi-core: Pure types and traits (ReplayConfig, compute_diff, ReplayEntry, ReplayMeta, redaction, ReplayStore trait, truncation)
  • rustapi-extras: Production-ready implementation
    • ReplayLayer middleware for automatic request/response recording
    • InMemoryReplayStore and FileSystemReplayStore implementations
    • Admin HTTP routes for listing, replaying, and diffing entries
    • ReplayClient for programmatic replay testing
    • Authentication with bearer token
    • RetentionJob for automatic cleanup of expired entries
  • cargo-rustapi: CLI commands for replay management (requires replay feature)
    • Install with: cargo install cargo-rustapi --features replay
    • cargo rustapi replay list - List recorded entries
    • cargo rustapi replay show <id> - Show entry details
    • cargo rustapi replay run <id> --target <url> - Replay request
    • cargo rustapi replay diff <id> --target <url> - Compare responses
    • cargo rustapi replay delete <id> - Delete entry
  • Security features: disabled by default, admin token required, sensitive header/body redaction, configurable TTL
  • Cookbook recipe with comprehensive examples and security guidelines

Fixed

• Fixed broken intra-doc link to ReplayLayer in rustapi-core replay module documentation

Removed

• Removed unused check_diff.py script from repository root

What's Changed

• Update Documentation and Learning Path by @Tuntii in #85
• Update Cookbook docs: rename rustapi to rustapi-rs and add jobs learning path by @Tuntii in #86
• Bump simd-json from 0.14.3 to 0.17.0 by @dependabot[bot] in #87
• Bump thiserror from 2.0.17 to 2.0.18 by @dependabot[bot] in #89
• Add replay (time-travel debugging) feature by @Tuntii in #98
• docs: Update versions and add Resilience Patterns recipe by @Tuntii in #97

Full Changelog: v0.1.265...v0.1.300

Release Notes - v0.1.265

🐛 Bug Fixes

cargo-rustapi CLI

new Command - Positional Argument Fix

• Issue: The new command rejected project names passed as positional arguments (e.g., cargo rustapi new my-project)
• Error: unexpected argument 'my-project' found
• Fix: Changed name from a flag (-n/--name) to a positional argument
• Impact: 7 CLI tests were failing, now all pass

# Before (broken)
cargo-rustapi new my-project --template minimal  # ❌ Error

# After (fixed)
cargo-rustapi new my-project --template minimal  # ✅ Works

migrate create Command - CI Timeout Fix

• Issue: migrate create command was timing out in CI coverage tests (>60 seconds)
• Root Cause: The command unnecessarily checked for sqlx-cli installation (and tried to install it if missing), even though migrate create only creates local files
• Fix: Moved ensure_sqlx_installed() check to only run for commands that actually need it (run, revert, status, reset)
• Impact: test_migrate_create_generates_files test now completes in ~0.4 seconds instead of timing out

rustapi-rs

Doc Test Compilation Fix

• Issue: The Quick Start doc test failed to compile due to Schema derive macro path resolution issues in the doc test environment
• Error: failed to resolve: unresolved import for schema, SchemaRef, serde_json
• Fix: Changed doc test from no_run to ignore since it's meant as documentation, not a runnable test
• Note: The actual Schema derive macro functionality is tested in proper integration tests

v0.1.236

Release Notes - Native OpenAPI 3.1 Generator

Version 0.1.236 - 2026-01-30

🚀 Major Features

Native OpenAPI 3.1 Generator

• Replaced external dependency: Completely removed utoipa dependency and implemented a fully native OpenAPI 3.1 specification generator
• Deterministic output: Uses BTreeMap for consistent, ordered OpenAPI spec generation
• JSON Schema 2020-12 compliance: Full support for modern JSON Schema standards

Schema Generation System

• New RustApiSchema trait: Automatic schema derivation for structs, enums, and primitives
• #[derive(Schema)] macro: Seamless integration in rustapi-macros for type-safe OpenAPI documentation
• Runtime integration: All core extractors (Json, Query, Path) and response types (Created, ApiError) now automatically populate OpenAPI specs

Swagger UI Improvements

• Lightweight implementation: Replaced heavy utoipa-swagger-ui with simple HTML handler
• CDN-based loading: Swagger UI now loads from unpkg CDN, eliminating local asset bundling
• Reduced bundle size: Significant reduction in compiled binary size

🔧 Technical Changes

• Updated rustapi-openapi: Complete rewrite with native OpenAPI 3.1 structs (Spec, Operation, Schema, etc.)
• Enhanced rustapi-core: All extractors and response types implement RustApiSchema
• Clean dependency tree: Removed utoipa from all Cargo.toml files across the workspace

✅ Verification & Testing

• Unit tests added: Comprehensive test coverage for schema derivation and spec generation
• Backward compatibility: All existing rustapi-core tests pass with new implementation
• Deterministic output: Verified consistent spec structure across multiple runs

📊 Impact

• 14 commits merged
• 1,508 lines added, 3,254 lines removed
• 39 files changed
• Breaking change: External OpenAPI dependency completely replaced with native implementation

🔗 Links

• Pull Request #74
• OpenAPI 3.1 Specification
• JSON Schema 2020-12

v0.1.207

RustAPI Release History

v0.1.202 - Performance Revolution (2026-01-26)

🚀 Performance Improvements

This release delivers a 12x performance improvement, bringing RustAPI from ~8K req/s to ~92K req/s - now within striking distance of Actix-web.

Benchmark Results

Framework	Requests/sec	Latency (avg)
RustAPI	~92,000	~1.1ms
Actix-web 4	~105,000	~0.95ms
Axum	~100,000	~1.0ms

Tested with hey -n 100000 -c 100 on Windows 11, Ryzen 7 4800H

✨ Server Optimizations

• TCP_NODELAY: Disabled Nagle's algorithm for lower latency
• Pipeline Flush: Enabled HTTP/1.1 pipeline flushing for better throughput
• ConnectionService: Reduced Arc cloning overhead per connection
• HandleRequestFuture: Custom future implementation for request handling
• Ultra-Fast Path: New routing path that bypasses both middleware AND interceptors for maximum performance

📦 JSON Optimizations

• simd-json Serialization: Extended simd-json support from parsing-only to full serialization
• Added to_vec and to_vec_with_capacity using simd-json when feature is enabled

🔧 Build Profile Optimizations

[profile.release]
lto = "fat"
codegen-units = 1
opt-level = 3
panic = "abort"
strip = true

📚 Documentation

• Updated README.md with accurate benchmark numbers
• Removed inflated performance claims
• Added TechEmpower-based comparison data

🧹 Cleanup

• Removed unused static variables from bench_server
• Code formatted with cargo fmt --all

---

v0.1.201 - Previous Release

See CHANGELOG.md for historical releases

---

Performance Roadmap

For planned optimizations to reach and exceed Actix performance.

Target: 105-115K req/s through:

• Stack-allocated futures (remove Box::pin)
• Zero-copy path handling
• Pre-compiled middleware stack
• Response header pooling

v0.1.201

🚀 Release Notes: RustAPI v0.1.200

"Visualizing Health: The Status Page Update"

We are thrilled to announce RustAPI v0.1.200! This milestone release focuses on developer experience and observability, introducing a powerful new way to monitor your API just by upgrading.

✨ New Feature: Built-in Status Page

You can now instantly generate a professional Status Page for your API. No external services, no complex configuration files—just one line of code.

It provides a real-time view of:

• System Uptime & Global Stats
• Per-Endpoint Success Rates (instantly spot failing routes)
• Average Latency (identify bottlenecks)

How to use it:

use rustapi_rs::prelude::*;

#[rustapi::main]
async fn main() -> Result<()> {
    RustApi::auto()
        .status_page() // 🚀 Instant observability
        .run("127.0.0.1:8080")
        .await
}

Visit /status on your running server to see it in action.

📚 Documentation

• New Cookbook Recipe: [Automatic Status Page](https://tuntii.github.io/RustAPI/cookbook/recipes/status_page.html)
• New Example: examples/status_demo.rs

📦 Improvements

• Enhanced RustApi builder with seamless integration for status monitoring middleware.
• Added chrono dependency for precise timestamp tracking.

v0.1.191

What's Changed

• Add unified validation system with async support by @Tuntii in #56

Full Changelog: v0.1.15...v0.1.191