Changes for version 1.4.0 - 2026-08-24
- SECURITY FIXES
- Fix silent dropping of object-based middleware in to_app() (CWE-306, CWE-352). Object middleware (implementing 'wrap' or 'call', such as CSRF and Basic Auth) registered via 'add_middleware' or 'enable_csrf' were ignored when deployed using to_app(), bypassing authentication and forgery protection. Unified to_app() and to_pagi() execution pipelines. Reported by CPANSec.
- TESTING
- Add t/34-security_cwe_306_object_middleware_execution.t to verify object middleware pipeline execution in to_app().
- TESTING
- Fix silent dropping of object-based middleware in to_app() (CWE-306, CWE-352). Object middleware (implementing 'wrap' or 'call', such as CSRF and Basic Auth) registered via 'add_middleware' or 'enable_csrf' were ignored when deployed using to_app(), bypassing authentication and forgery protection. Unified to_app() and to_pagi() execution pipelines. Reported by CPANSec.
Modules
Asynchronous, Type-Safe Micro-Framework with Dependency Injection and OpenAPI & Swagger UI
Base Interface for PAGI::FastAPI Bot Protection
Stateless Proof-of-Work Bot Mitigation Engine
Request and Response Lifecycle Context for PAGI::FastAPI
Request Cookie Parsing Helper for PAGI::FastAPI
Dependency Injection Wrapper for PAGI::FastAPI
Asynchronous Proof-of-Work Bot Protection Middleware for PAGI::FastAPI
Typed Exception-to-Handler Dispatch for PAGI::FastAPI
Async Rate Limiting Middleware for PAGI::FastAPI
Pluggable Async Message Queue Facade for PAGI::FastAPI
Abstract Base Class for Message Queue Storage Drivers
Default In-Memory Storage Driver for PAGI::FastAPI::Queue
Abstract Base Class for Rate Limiting Storage Drivers
Default In-Memory Storage Driver for Rate Limiting
Base HTTP Response Class for PAGI::FastAPI
File Download Response for PAGI::FastAPI
HTML Response Class for PAGI::FastAPI
HTTP Redirect Response for PAGI::FastAPI
Server-Sent Events (SSE) Streaming Response for PAGI::FastAPI
Response Shape Validation and Filtering for PAGI::FastAPI
Path Parameter Validation for PAGI::FastAPI
Examples
- eg/api_gateway.pl
- eg/app.pl
- eg/csrf_demo.pl
- eg/dbic_async_integration.pl
- eg/integration_demo.pl
- eg/lib/MyApp/Schema.pm
- eg/lib/MyApp/Schema/Result/User.pm
- eg/memory_queue_demo.pl
- eg/order_microservice.pl
- eg/rate_limit_demo.pl
- eg/sse_demo.pl
- eg/user_microservice.pl
- eg/webhook_demo.pl
- eg/websocket_app.pl