Changes for version 0.48 - 2026-09-09

  • ADDS: websocket routes work over HTTP/2 through Extended CONNECT (RFC 8441). There is no 101, no Upgrade header and no Sec-WebSocket-Key on a multiplexed transport, so the handshake is new - but the RFC 6455 codec above it is the same one the HTTP/1.1 path uses. An Extended CONNECT is routed as the GET it stands in for, and the origin check still applies to it.
  • ADDS: sse routes and $c->stream work over HTTP/2 and over TLS. Both ran on Hyperman's detach, which hands over a file descriptor and so refuses an h2 stream and a TLS session; they now fall through to Hyperman's ABI v6 stream handle, which sends status, headers and body pieces through the server.
  • A stream reset by the peer, or a client that goes away, now reaches the handler: an sse stream's close callback fires and a $c->stream drain settles. HTTP/1 could only infer this from a dead connection, and a multiplexed transport cannot.
  • No Connection and no Transfer-Encoding on an HTTP/2 or HTTP/3 streamed response. Both are hop-by-hop and forbidden there.
  • A refused detach falls through to the next transport instead of answering 503.
  • A die mid-stream truncates on the stream handle too, through Hyperman's v7 stream_abort: RST_STREAM on HTTP/2, a connection reset on TLS. A streamed body has no declared length, so ending cleanly is the claim that it is whole.
  • Requires Hyperman 0.45.

Documentation

the Punk command line

Modules

a MVC web framework
the per-application registry and boot compiler
async and await in Punk apps, controllers and models
the authentication battery
password hashing
cross-origin resource sharing
single-use CSRF tokens
a pluggable cache with TTL
a cache store on disk, shared by the whole worker pool
an in process cache store, bounded by bytes
the punk command line: registry, dispatcher and commands
YAML configuration with secrets kept out of the file
the per-request object
base class for Punk controllers
the development error page
an async result that runs on the loop, or blocks
scaffold a new Punk application
security response headers
a level-based logger
the storage-agnostic model tier
the default DBI backend for Punk models
a non-blocking backend for Punk models
a directory of markdown as a documentation site
the api mount: spec-first operations
base class for Punk plugins
content addressed storage for uploads
Content-Security-Policy with a per request nonce
ETags, Last-Modified and 304s for dynamic responses
liveness and readiness probes that mean different things
translations and language negotiation
Idempotency on unsafe methods
a Prometheus endpoint whose labels cannot run away
give every request an id
sitemap.xml and robots.txt from the route table
rate limiting and IP blocking over Hyperman's shared arena
a lazy wrapper over the PSGI environment
a response builder
the compiled-at-boot route tables (XS)
the handle an under returns
a Server-Sent Events stream
the bounded body of a ranged send_file response
signed cookie sessions
server-side sessions, on any store
serving files from a directory
a streamed response for an ordinary route
an in-process test client for Punk applications
a pure-Perl RFC 6455 codec for testing WebSocket servers
the client side of one WebSocket connection
the transaction a < $c-txn >> block receives
the outbound HTTP agent on the context
an uploaded file from a multipart form
collecting request validation
the Template::Stencil view engine
the pluggable view engine registry (XS)
a WebSocket connection
pub/sub groups of WebSocket connections