Skip to content

Changelog

v0.3.0

Added

  • Added support for the HTTP QUERY method: @app.query() decorator, Method.QUERY, test client query() helper, and cacheable QUERY responses with body-aware cache keys.
  • Added a dedicated Uploads documentation page covering UploadFile, multipart streaming, mixed forms, validation, and testing.
  • Added a dedicated Testing documentation page covering TestClient, AsyncTestClient, ASGI/RSGI tests, headers, cookies, the QUERY method, lifespan events, and dependency overrides.
  • Added a dedicated API Versioning documentation page covering APIRouter(version="v1") for URL path versioning, APIVersion.from_header for X-API-Version header versioning, APIVersion.from_accept for Accept-header content negotiation, and DeprecationHeader for emitting Deprecation / Sunset headers on deprecated routes and routers.
  • Added RouteConflictError for duplicate route conflicts; it subclasses ValueError so existing catch blocks continue to work.
  • Added version=, deprecated=, and deprecation_description= to @router.websocket(...) and APIRouter.add_websocket_route.
  • Added optional GraphQL support via the graphql extra and velocipy.features.graphql.GraphQL. Supports HTTP queries/mutations, GraphiQL, context injection, multipart file uploads, and WebSocket subscriptions over graphql-transport-ws and legacy graphql-ws. See GraphQL for documentation and usage examples.

v0.2.0

Breaking changes

  • Removed velocipy.limiter.storage. Import MemoryStorage and RedisStorage from velocipy.storage instead.

Added

  • Added shared velocipy.storage package with Storage ABC, MemoryStorage, and RedisStorage.
  • Added server-side route response caching via Cache and CachePolicy.
  • Added cache argument to route decorators for attaching a cache policy.
  • Added examples/caching.py and documentation for route response caching.

Changed

  • Rate limiter now uses the shared velocipy.storage abstraction.
  • Rate-limit algorithm logic moved from storage backends to velocipy.limiter.algorithms.

v0.1.1

Security

  • HTML-escape openapi_url and title in Swagger UI to prevent reflected XSS.
  • Reject whitespace-only API key values as missing credentials.
  • Reject CORS allow_origins=["*"] combined with allow_credentials=True.
  • Enforce secure=True when session same_site="None".
  • Change client_ip() default to use_forwarded=False.
  • Add allowed_origins parameter to WebSocket routes for opt-in origin validation.

Added

  • Added HTTPBasic and HTTPBasicCredentials security helpers.

Changed

  • APIKeyQuery docstring now warns against query-string credentials.
  • VelociPy.__init__ docstring now warns against debug=True in production.
  • Replace runtime assert statements with explicit checks for python -O compatibility.

v0.1.0

  • Initial version.