/ 
Punk-0.60

Changes for version 0.60 - 2026-10-16

  • The compiled application is read into a C struct at `to_app`: the request path no longer looks the router, hooks, mounts and policies up by name, nor the matched route's fields, nor the context class's stash. A dynamic route costs about 0.5us over a bare PSGI app in-process, down from 0.9us.
  • A static mount of Punk's own is served without the SCRIPT_NAME and PATH_INFO rewrite or a Perl frame, and its ETag and Last-Modified are formatted once per stat, not per hit.
  • The session reads its cookie through the C parser; `rate_limit` keeps the resolved ABI pointer instead of scanning the environment per request (the `PUNK_NO_HM_ABI` switch is read before the first request); the CSP policy is frozen around the nonce; `headers` hands out its frozen list rather than copying it; metrics keep the start time in a context slot.
  • A WebSocket message in one frame is handed on from the read buffer; ping and pong payloads are built only for a listener; a room broadcast queues to each member in C; buffers that grew for a large message shrink back once empty.
  • SECURITY: `$f->get`, `$c->await` and the csrf check wrote to a stale stack after running Perl.
  • SECURITY: the OpenAPI mount validated a body it never read when the request carried no Content-Length, and reserved a declared length up front.
  • SECURITY: a middleware editing a static body in place edited the file cache, and every later hit served the edit.
  • SECURITY: one WebSocket client could keep a worker to itself.
  • SECURITY: a rate limit keyed on a header limited nothing when the header was absent; it counts against the address.
  • SECURITY: `database backend` and `$c->txn` loaded a class named in config without checking it was a class name.

Documentation

punk
the Punk command line

Modules

Punk
a MVC web framework
Punk::App
the per-application registry and boot compiler
Punk::AsyncAwait
async and await in Punk apps, controllers and models
Punk::Auth
the authentication battery
Punk::Auth::Password
password hashing
Punk::CORS
cross-origin resource sharing
Punk::CSRF
single-use CSRF tokens
Punk::Cache
a pluggable cache with TTL
Punk::Cache::File
a cache store on disk, shared by the whole worker pool
Punk::Cache::Memory
an in process cache store, bounded by bytes
Punk::Command
the punk command line: registry, dispatcher and commands
Punk::Config
YAML configuration with secrets kept out of the file
Punk::Context
the per-request object
Punk::Controller
base class for Punk controllers
Punk::DBI
the DBI subclass that makes every statement observable
Punk::DBI::db
the observed database handle
Punk::DBI::st
the observed statement handle
Punk::DevError
the development error page
Punk::Future
an async result that runs on the loop, or blocks
Punk::Generate
scaffold a new Punk application
Punk::Headers
security response headers
Punk::Logger
a level-based logger
Punk::Model
the storage-agnostic model tier
Punk::Model::DBI
the default DBI backend for Punk models
Punk::Model::DBIx::Loop
a non-blocking backend for Punk models
Punk::Mount::Markdown
a directory of markdown as a documentation site
Punk::Mount::OpenAPI
the api mount: spec-first operations
Punk::Plugin
base class for Punk plugins
Punk::Plugin::Blob
content addressed storage for uploads
Punk::Plugin::CSP
Content-Security-Policy with a per request nonce
Punk::Plugin::ConditionalGet
ETags, Last-Modified and 304s for dynamic responses
Punk::Plugin::Health
liveness and readiness probes that mean different things
Punk::Plugin::I18n
translations and language negotiation
Punk::Plugin::Idempotency
Idempotency on unsafe methods
Punk::Plugin::Metrics
a Prometheus endpoint whose labels cannot run away
Punk::Plugin::RequestId
give every request an id
Punk::Plugin::Sitemap
sitemap.xml and robots.txt from the route table
Punk::RateLimit
rate limiting and IP blocking over Hyperman's shared arena
Punk::Request
a lazy wrapper over the PSGI environment
Punk::Response
a response builder
Punk::Router
the compiled-at-boot route tables (XS)
Punk::Router::Scope
the handle an under returns
Punk::SSE
a Server-Sent Events stream
Punk::SendFile::Reader
the bounded body of a ranged send_file response
Punk::Session
signed cookie sessions
Punk::Session::Store
server-side sessions, on any store
Punk::Static
serving files from a directory
Punk::Stream
a streamed response for an ordinary route
Punk::Test
an in-process test client for Punk applications
Punk::Test::WS
a pure-Perl RFC 6455 codec for testing WebSocket servers
Punk::Test::WS::Conn
the client side of one WebSocket connection
Punk::Txn
the transaction a $c->txn block receives
Punk::UA
the outbound HTTP agent on the context
Punk::Upload
an uploaded file from a multipart form
Punk::Validate
collecting request validation
Punk::View::Stencil
the Template::Stencil view engine
Punk::Views
the pluggable view engine registry (XS)
Punk::WebSocket
a WebSocket connection
Punk::WebSocket::Room
pub/sub groups of WebSocket connections

Examples

Other files