Changes for version 0.36 - 2026-08-30

  • ADDS: $c->stream($content_type, $cb) + Punk::Stream - a response body of unknown length on the SSE transports (Hyperman detach, psgi.streaming, blocking psgix.io), chunk-framed on the socket transports so a die is visible truncation, never a short success
  • Punk::Stream drain - a Punk::Future settled when the write buffer reaches the kernel; awaiting it after each write bounds memory to one chunk while the worker keeps serving other requests
  • Punk::Test declares psgi.streaming in every request env, so get_ok drives a streamed route instead of collecting its 501
  • ADDS: the `last_modified` route option - Punk::Plugin:: ConditionalGet's date validator, a coderef returning an epoch, answered 304 before the handler runs; If-None-Match wins, the date comparison is exact (the file path's convention), a future epoch is clamped to now
  • ADDS: Punk::Test `upload` - multipart/form-data requests: file parts from a path or a scalar ref, streamed through one read buffer however large, boundary verified absent from the content
  • t/0410-upload.t posts through the client, so the encoder and the streaming parser test each other
  • ADDS: `max_record` on Punk::Plugin::Idempotency - a response larger than it (default 1MB) is served with Idempotency-Recorded: false and not stored; the single-flight lock still covers the request
  • ADDS: `signed => 1` on $c->cookie, both directions - HMAC over name=value with the session's secret and verify, so a tampered, swapped or unsigned cookie reads as undef

Documentation

the Punk command line

Modules

a MVC web framework
the per-application registry and boot compiler
the authentication battery
password hashing
cross-origin resource sharing
single-use CSRF tokens
a pluggable cache with TTL
a cache store on disk, shared by the whole worker pool
an in process cache store, bounded by bytes
the punk command line: registry, dispatcher and commands
YAML configuration with secrets kept out of the file
the per-request object
base class for Punk controllers
the development error page
an async result that runs on the loop, or blocks
scaffold a new Punk application
security response headers
a level-based logger
the storage-agnostic model tier
the default DBI backend for Punk models
a non-blocking backend for Punk models
a directory of markdown as a documentation site
the api mount: spec-first operations
base class for Punk plugins
content addressed storage for uploads
Content-Security-Policy with a per request nonce
ETags, Last-Modified and 304s for dynamic responses
liveness and readiness probes that mean different things
translations and language negotiation
Idempotency on unsafe methods
a Prometheus endpoint whose labels cannot run away
give every request an id
sitemap.xml and robots.txt from the route table
rate limiting and IP blocking over Hyperman's shared arena
a lazy wrapper over the PSGI environment
a response builder
the compiled-at-boot route tables (XS)
the handle an under returns
a Server-Sent Events stream
the bounded body of a ranged send_file response
signed cookie sessions
server-side sessions, on any store
serving files from a directory
a streamed response for an ordinary route
an in-process test client for Punk applications
a pure-Perl RFC 6455 codec for testing WebSocket servers
the client side of one WebSocket connection
the transaction a < $c-txn >> block receives
the outbound HTTP agent on the context
an uploaded file from a multipart form
collecting request validation
the Template::Stencil view engine
the pluggable view engine registry (XS)
a WebSocket connection
pub/sub groups of WebSocket connections