Revision history for Open-API

0.11	2026-08-20
        - FIX: change abi version checks from == to <=

0.10	2026-08-17
	- Update min version of deps
	- Remove PAX headers

0.09    2026-08-12
        - OpenAPI 3.0 documents are now accepted. A 3.1 Schema Object is
          JSON Schema 2020-12, which is what JSON::Schema::Fast validates;
          a 3.0 one is a different dialect, so a 3.0 document is rewritten
          into 3.1 shape once at load (include/oa_upconvert.h) before
          anything else sees it.
        - Because the conversion happens at document level rather than at
          schema-compile time, ->spec, the mock generator and the docs UI
          all see one dialect 

0.08    2026-08-09
        - Response synthesis: $api->synthesize
          builds a PSGI triplet for an operation from the document alone,
          which is what serves a mock. The body is the media type's
          example, a named or lexicographically first examples entry, the
          schema's default, then a value generated from the schema, and it
          validates against the schema it came from - t/27-synthesize.t
          asserts that as a property over whole specs.
        - Deterministic and bounded: nothing draws a random value, bodies
          are encoded canonically through the File::Raw::JSON ABI so they
          are byte-identical across processes, and generated strings,
          arrays and $ref cycles are capped so a pasted spec cannot ask a
          mock for a gigabyte of 'a'.
        - Open::API::UI->embed_html: the documentation page as a fragment,
          carrying the config block app.js reads, for a host page that
          already has a head of its own.
        - check_op_security($op_id, $env, \%checkers) exposes the compiled
          per-operation security guard to callers that do their own routing

0.07    2026-08-09
        - validate_responses gains a report mode, A mismatch calls the coderef and the 
	  response continues to the client untouched - status, headers and body byte for byte.

0.06    2026-08-08
        - Open::API::UI said `use 5.016`, which nothing in it needs. Every
          perl between this distribution's floor (5.008003) and 5.16 failed
          to compile the file, so t/23 and t/24 died and CPAN Testers
          graded 0.05 NA on 5.12.5. 
        - Open::API::UI now names the versions it needs at the point of use
          - Template::Stencil 0.02, Markdown::Simple 0.18.
        - t/23-ui.t and t/24-plack-ui.t check those versions, not just that
          the modules load, so an old Markdown::Simple skips the docs UI
          tests instead of failing them.
        - remove Open::API::Plack use of defined-or

0.05    2026-08-06
        - The PSGI app segfaulted on perl below 5.20. The closure capture
          pushed &PL_sv_undef for an absent csrf config, and perl before 5.20
          treats an array element that IS &PL_sv_undef as a deleted one, so
          av_fetch handed back NULL and the request path dereferenced it.
        - $client->$operationId sugar croaked on nothing below 5.16. Perl
          hands an XSUB AUTOLOAD its method name one of two ways: newer perls
          set $AUTOLOAD, older ones skip that and store the name in the CV's
          own PV slot. AUTOLOAD read only $AUTOLOAD, found it undef, and
          returned empty - so a typo'd method silently did nothing instead of
          dying. 
        - Build fix for perl below 5.26: hv_deletes is 5.25.6.

0.04    2026-08-05
        - Public C ABI: include/oa_abi.h,
        - Open::API is now a provider as well as a consumer: it installs
          oa_abi.h through ExtUtils::Depends
        - t/25-abi.t drives the whole table in C (api_of -> route -> op_id ->
          validate) and proves it agrees with match / validate_request. It
          treats _abi_ptr as a raw pointer rather than a positive IV, since
          Solaris x86-64 maps shared objects high enough to set the sign bit.
        - Build fix for perl below 5.26: hv_deletes is 5.25.6
        - SPAGAIN after every require in the ABI resolvers (File::Raw::JSON,
          Fetch, JSON::Schema::Fast at BOOT, and the Open::API::UI wrap).
          Each captured SP

0.03    2026-08-05
        - The PSGI app moved into its own module, Open::API::Plack, replacing
          $api->to_app(%opts). 
        - Open::API::UI: a self-contained Swagger UI clone for the compiled
          spec. 
        - Framework contract for other adapters: $ui->routes returns static
          GET routes as PSGI-shaped triplets for Open::API::Catalyst and a
          future Open::API::Mojo to mount; $ui->to_app is a standalone
          PSGI app.

0.02    2026-08-04
        - Security: components.securitySchemes are now enforced. to_app takes a
          security => { scheme => checker } map
        - Open::API::Client attaches credentials to match: security => { scheme
          => credential } sends apiKey / bearer / basic automatically, 
        - CSRF protection on to_app: an always-on Origin/Referer check on
          state-changing methods (GET/HEAD/OPTIONS/TRACE are exempt), plus an
          optional server-side single-use token via a check callback. The
          callback verifies against your own store, its return is stashed as
          $env->{'openapi.csrf'}, and returning a string rotates the token
          cookie for you.
        - Open::API::Client handles CSRF transparently with csrf => 1
        - Secure response headers on by default (X-Content-Type-Options,
          Content-Security-Policy, X-Frame-Options, Referrer-Policy)
        - CORS: the cors => {} option answers preflight OPTIONS and adds
          Access-Control-* headers to actual responses, with an origin
          allowlist, credentials, exposed headers and max-age. A wildcard
          origin with credentials is refused at to_app.
        - max_body_size => N rejects an over-large request body with 413.
        - Opt-in content negotiation (negotiate => 1): 415 for an undeclared
          request Content-Type, 406 when Accept admits no declared response
          type.
        - error_format => 'problem' emits RFC 7807 application/problem+json for
          the errors this layer generates.
        - examples/ - a runnable, login-based petstore showing authentication,
          CSRF and the transparent client together.

0.01    2026-08-04
        First version.