Changes for version 1.5.0 - 2026-08-25

  • SECURITY FIXES
    • CWE-1188: Removed default fallback string 'change_me_in_production' from $secret in PAGI::FastAPI::BotProtection::ProofOfWork and PAGI::FastAPI::Middleware::BotProtection.
    • Enforced mandatory check for defined $secret; throws an exception when unconfigured.
  • POD
    • Updated BotProtection SYNOPSIS and POD documentation to reflect required secret initialisation.
  • TESTING
    • Added unit test: t/35-security_cwe_1188_secret_default.t

Documentation

Modules

Asynchronous, Type-Safe Micro-Framework with Dependency Injection and OpenAPI & Swagger UI
Base Interface for PAGI::FastAPI Bot Protection
Stateless Proof-of-Work Bot Mitigation Engine
Request and Response Lifecycle Context for PAGI::FastAPI
Request Cookie Parsing Helper for PAGI::FastAPI
Dependency Injection Wrapper for PAGI::FastAPI
Asynchronous Proof-of-Work Bot Protection Middleware for PAGI::FastAPI
Typed Exception-to-Handler Dispatch for PAGI::FastAPI
Async Rate Limiting Middleware for PAGI::FastAPI
Pluggable Async Message Queue Facade for PAGI::FastAPI
Abstract Base Class for Message Queue Storage Drivers
Default In-Memory Storage Driver for PAGI::FastAPI::Queue
Abstract Base Class for Rate Limiting Storage Drivers
Default In-Memory Storage Driver for Rate Limiting
Base HTTP Response Class for PAGI::FastAPI
File Download Response for PAGI::FastAPI
HTML Response Class for PAGI::FastAPI
HTTP Redirect Response for PAGI::FastAPI
Server-Sent Events (SSE) Streaming Response for PAGI::FastAPI
Response Shape Validation and Filtering for PAGI::FastAPI
Path Parameter Validation for PAGI::FastAPI