Tags: ehsanmok/flare

flare v0.10.0

v0.8.1

Patch release on top of v0.8.0.

- fix(deps): recipe.yaml now pulls the json v0.2.1 source tag for Mojo
  1.0.0b2 compatibility (PR #4, thanks @bowyern).
- build: bump package version to 0.8.1 in pixi.toml + recipe.yaml.

No flare source/API changes; v0.8.0 consumers can move to v0.8.1
without code changes.

v0.8.0

Headline changes since v0.7.0:

Protocol surface:
- QUIC v1 sans-I/O codec layer (RFC 9000/9001): varint, long/short
  packet headers, transport frames, transport parameters, AEAD +
  header-protection FFI, connection-id table.
- HTTP/3 (RFC 9114) frame codec + sans-I/O H3Connection reader, QPACK
  static-table decoder (RFC 9204), Extended CONNECT dispatch.
- gRPC length-prefixed-message decoder and RFC 9111 Cache-Control
  directive parser.

Structure (v0.8 1 decomposition):
- Split oversized modules to hold a 1000-line bar enforced by
  tools/check_reactor_size.sh: server reactor into epoll + uring,
  unified-reactor dispatch, client parse/send, io_uring ABI codec,
  quic/http2 value types, extractor parsers.

Performance:
- One-pass exact-length response serialization; dropped per-header
  to_lowercase alloc; per-percentile sigma published. No regression
  vs Go net/http and nginx (single-worker) or hyper/axum/actix-web
  (multi-worker).

Mojo 1.0.0b2 migration:
- reflect[T] alias, non-nullable UnsafePointer, MutExternalOrigin ->
  MutUntrackedOrigin, StringSlice via CStringSlice; chunked-decoder
  chunk-size signed-overflow fix. Deps pinned to json v0.2.1 and
  mozz v0.1.4.

v0.7.0

Headline changes since v0.6.0:

Runtime / API:
- Router-Copyable via Arc-style refcounted boxed handlers; safe to
  pass to multi-worker srv.serve(router^, num_workers=N) without
  re-allocating per worker.
- HTTP/2 reactor wiring: one fd → one H2Connection, ALPN dispatch
  at the TLS-acceptor handoff, h2c upgrade mid-stream from h1 to h2
  (RFC 9113 §3.4, RFC 7540 §3.2). Unified reactor under
  flare.http._unified_reactor_impl.
- HTTP/1.1 trailer fields (RFC 7230 §4.1.2 / §4.4): Response.trailers,
  Trailer: header, smuggling guard, client-side parse off the chunked
  decoder.
- h1.1 client connection pool: HttpClient.with_pool(...), idle reuse,
  per-origin caps, stale-conn retry.
- WebSocket over h2 (RFC 8441): WsOverH2Stream + bootstrap_ws_over_h2;
  Http2ClientConnection.send_extended_connect.
- permessage-deflate (RFC 7692) with no_context_takeover on both
  sides + 16 MiB per-message decompressed cap.
- TLS session resumption (RFC 5077 / RFC 8446 §4.6.1) — server-side
  ticket cache + client-side reconnect.
- Per-stream Cancel propagation: peer RST_STREAM → handler
  cancel.cancelled(); GOAWAY / drain signal the matching cell.

Hardening:
- HPACK Huffman codec (scalar correct, H=1 wire-up, RFC 7541 §C.4
  fixtures; SIMD shim shipped as parity fallback).
- CONTINUATION-flood / RAPID-RESET (CVE-2023-44487) state-machine
  fuzz coverage.
- Bench harness stabilisation: 20s probes, cliff-fanout gates on
  p99.9 / p99.99, transient-blip retry, absolute-p99 growth gate,
  post-search validation pass with 8% back-off.
- Per-percentile σ over 5 runs surfaced in summary.md and the
  published numbers: σ is the honesty meter for the tail.

Mojo 1.0.0b1 bump:
- Migrate the few sites that depended on the looser Span-lifetime /
  destructor-ordering semantics (h2c client double-body fix, io_uring
  bufring staging-copy).
- json 0.1.6, mozz 0.1.3.

Published numbers (TFB plaintext, EPYC 7R32 dev-box):

  4-worker handler:    flare_mc        212k req/s, p99 2.61±0.02 ms,
                                       p99.99 3.25±0.10 ms
  4-worker fast path:  flare_mc_static 274k req/s
  1-worker handler:    flare           71k req/s, p99 3.01±0.18 ms

Co-authored-by: Cursor <cursoragent@cursor.com>

Release v0.4.0: composable HTTP — Handler, Router, App[S], State[T],

middleware, multicore

Composable request handling on top of the v0.3.0 reactor:

- Handler trait with blanket impl for def(Request) raises -> Response.
- Router with path params, method dispatch, auto 405/404.
- App[S] with typed State[T] view for middleware layers.
- Middleware composition via [Inner: Handler] struct wrapping.
- HttpServer.serve[H](handler, num_workers=N, pin_cores=True) unified
  entry point (single-thread at num_workers=1, multicore at >=2).
- HttpServer.serve_comptime[handler, config] with constrained[]
  config validation (misconfigured servers fail the build).

460 tests, 16 fuzz harnesses, 18 runnable examples.

Multicore bench on Linux AWS EPYC 7R32 (wrk -t8 -c256 -d30s,
5-run median, stdev <= 3%):

  flare_mc 4 workers pinned:  257,461 req/s  (p99 1.58 ms)
  nginx 1 worker:              70,592 req/s
  flare single-threaded:       58,731 req/s
  Go net/http (GOMAXPROCS=1):  36,617 req/s

4.38x linear scaling, 3.65x nginx-1w, 7.03x Go net/http.

Pinned to Mojo 0.26.3.0.dev2026042005 + json v0.1.3.

Install:
    [dependencies]
    flare = { git = "https://github.com/ehsanmok/flare.git", tag = "v0.4.0" }

v0.3.0: Stage 1 reactor-backed HTTP server

First tagged release with the single-threaded reactor. Plaintext
throughput is on par with single-worker nginx and about 2x Go
net/http on Linux AWS EPYC, ~1.10x Go net/http on Apple M-series
(TFB plaintext, GOMAXPROCS=1 / worker_processes 1).

Pinned to Mojo 0.26.3.0.dev2026041805 + json v0.1.2.