Changes for version 0.06 - 2026-08-13

  • Rate limiting and IP blocking over Hyperman's shared arena (requires Hyperman 0.18, ABI v3; fails open without it).
  • New `rate_limit` keyword: installs a before_dispatch that answers 429 (with Retry-After and the X-RateLimit-* headers) when a caller is over the limit. Key by client IP (default), a request header (by => 'header:X-Api-Key'), or a coderef; scope to a path prefix with `for`. Chainable for layered limits. The counters live in the shared arena, so a limit is exact across the worker pool rather than per worker.
  • New context methods: $c->block_ip([$ip [, $ttl]]) and $c->unblock_ip([$ip]) add or lift an IP on the edge denylist ($ip defaults to the request's REMOTE_ADDR), and $c->rate_hit for a raw counter check.

Modules

a MVC web framework
the per-application registry and boot compiler
cross-origin resource sharing
single-use CSRF tokens
the subcommands behind the punk tool
YAML configuration with secrets kept out of the file
the per-request object
base class for Punk controllers
an async result that runs on the loop, or blocks
scaffold a new Punk application
a level-based logger
the storage-agnostic model tier
the default DBI backend for Punk models
a non-blocking backend for Punk models
a directory of markdown as a documentation site
the api mount: spec-first operations
base class for Punk plugins
rate limiting and IP blocking over Hyperman's shared arena
a lazy wrapper over the PSGI environment
a response builder
the compiled-at-boot route tables (XS)
the handle an under returns
a Server-Sent Events stream
signed cookie sessions
serving files from a directory
the outbound HTTP agent on the context
an uploaded file from a multipart form
the Template::Stencil view engine
the pluggable view engine registry (XS)
a WebSocket connection
pub/sub groups of WebSocket connections