Changes for version 1.4.0 - 2026-08-24

  • SECURITY FIXES
    • Fix silent dropping of object-based middleware in to_app() (CWE-306, CWE-352). Object middleware (implementing 'wrap' or 'call', such as CSRF and Basic Auth) registered via 'add_middleware' or 'enable_csrf' were ignored when deployed using to_app(), bypassing authentication and forgery protection. Unified to_app() and to_pagi() execution pipelines. Reported by CPANSec.
      • TESTING
        • Add t/34-security_cwe_306_object_middleware_execution.t to verify object middleware pipeline execution in to_app().

Documentation

Modules

Asynchronous, Type-Safe Micro-Framework with Dependency Injection and OpenAPI & Swagger UI
Base Interface for PAGI::FastAPI Bot Protection
Stateless Proof-of-Work Bot Mitigation Engine
Request and Response Lifecycle Context for PAGI::FastAPI
Request Cookie Parsing Helper for PAGI::FastAPI
Dependency Injection Wrapper for PAGI::FastAPI
Asynchronous Proof-of-Work Bot Protection Middleware for PAGI::FastAPI
Typed Exception-to-Handler Dispatch for PAGI::FastAPI
Async Rate Limiting Middleware for PAGI::FastAPI
Pluggable Async Message Queue Facade for PAGI::FastAPI
Abstract Base Class for Message Queue Storage Drivers
Default In-Memory Storage Driver for PAGI::FastAPI::Queue
Abstract Base Class for Rate Limiting Storage Drivers
Default In-Memory Storage Driver for Rate Limiting
Base HTTP Response Class for PAGI::FastAPI
File Download Response for PAGI::FastAPI
HTML Response Class for PAGI::FastAPI
HTTP Redirect Response for PAGI::FastAPI
Server-Sent Events (SSE) Streaming Response for PAGI::FastAPI
Response Shape Validation and Filtering for PAGI::FastAPI
Path Parameter Validation for PAGI::FastAPI