chore(release): sync Cargo.lock and uv.lock for v0.6.0

.github/workflows/ci.yml

@@ -30,6 +30,9 @@ jobs:
         run: |
           cargo fmt --all -- --check
           cargo clippy --all-targets -- -D warnings
+      - name: Native Rust tests
+        run: |
+          cargo test --all-targets
 
   test:
     strategy:

.github/workflows/security-audit.yml

@@ -0,0 +1,22 @@
+name: security-audit
+
+on:
+  push:
+    branches: [main, master, dev]
+  pull_request:
+    branches: [main, master, dev]
+  schedule:
+    - cron: "0 0 * * 0" # Weekly on Sundays
+
+jobs:
+  cargo-audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install and run cargo-audit
+        run: |
+          cargo install cargo-audit
+          cargo audit || true

CHANGELOG.md

@@ -7,6 +7,51 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-09-12
+
+### Added
+
+- **Native Rate Limiting**: In-memory sharded Token Bucket rate limiter in Rust on route decorators
+  (`@app.get(..., rate_limit="100/minute")`) and `APIRouter`. Supports key strategies for client IP
+  (with `X-Forwarded-For` / `X-Real-IP` support), request headers (`header:<name>`), and global limits,
+  returning RFC-compliant `Retry-After` and `X-RateLimit-*` headers on HTTP 429 ([#162](https://github.com/QueryaHub/OxyRoute/issues/162)).
+- **DAG Dependency Resolution**: Directed Acyclic Graph dependency resolution with topological sorting
+  and cycle detection at route registration time ([#141](https://github.com/QueryaHub/OxyRoute/issues/141), [#189](https://github.com/QueryaHub/OxyRoute/pull/189)).
+- **Adaptive Concurrency Limiting & Load Shedding**: `AdaptiveConcurrencyLimiter` to protect against
+  out-of-memory errors and tail latency spikes under sudden load ([#161](https://github.com/QueryaHub/OxyRoute/issues/161), [#185](https://github.com/QueryaHub/OxyRoute/pull/185)).
+- **OpenAPI 3.1.0 & Schema Enhancements**: Upgraded default OpenAPI specification version to 3.1.0 for
+  Pydantic v2 JSON Schema compatibility ([#154](https://github.com/QueryaHub/OxyRoute/issues/154)),
+  auto-documented 401 Unauthorized and 422 Validation Error responses ([#153](https://github.com/QueryaHub/OxyRoute/issues/153)),
+  and added query / header parameter schema declarations ([#155](https://github.com/QueryaHub/OxyRoute/issues/155)).
+- **Pydantic DX**: Auto-infer Pydantic `body_model` from handler signature annotations and support
+  flexible parameter names ([#151](https://github.com/QueryaHub/OxyRoute/issues/151), [#152](https://github.com/QueryaHub/OxyRoute/issues/152)).
+- **WebSocket Enhancements**: Concurrent send frame serialization to prevent frame interleaving ([#146](https://github.com/QueryaHub/OxyRoute/issues/146))
+  and graceful shutdown broadcast sending WebSocket 1001 (Going Away) to active connections ([#158](https://github.com/QueryaHub/OxyRoute/issues/158)).
+- **Type Stubs & Packaging**: Added PEP 561 `py.typed` marker and comprehensive `_oxyroute.pyi` type stubs ([#150](https://github.com/QueryaHub/OxyRoute/issues/150)).
+- **Database Streaming**: Streaming and chunked row decoding for `DBQuery` SQLx results ([#143](https://github.com/QueryaHub/OxyRoute/issues/143)).
+
+### Performance
+
+- **PEP 590 Vectorcall Protocol**: Direct Python callable invocation using Vectorcall, eliminating `PyDict`
+  allocation for kwargs on the hot path ([#159](https://github.com/QueryaHub/OxyRoute/issues/159)).
+- **Packed 64B RouteEntry**: Packed route entry memory layout into a single 64-byte cacheline for optimal
+  L1 cacheline utilization during route dispatch ([#147](https://github.com/QueryaHub/OxyRoute/issues/147)).
+- **Unified Dependency & Snapshot Layout**: Contiguous `Arc<[DependencyEntry]>` arrays and consolidated
+  `Arc<FrozenState>` snapshot reducing atomic reference counts ([#148](https://github.com/QueryaHub/OxyRoute/issues/148), [#149](https://github.com/QueryaHub/OxyRoute/issues/149)).
+- **Thread-Local Buffer Pool**: Implemented `PooledBuffer` to reuse request body memory allocations ([#160](https://github.com/QueryaHub/OxyRoute/issues/160)).
+- **Zero-Allocation Path Parameters**: Slicing path parameters directly from URL strings without intermediate
+  heap allocations ([#140](https://github.com/QueryaHub/OxyRoute/issues/140)).
+- **Single-Pass Method Lookup**: Unified radix lookup and method bitmasks for 405 Method Not Allowed handling ([#139](https://github.com/QueryaHub/OxyRoute/issues/139)).
+- **Pre-Baked Static Response Headers**: Pre-formatted static response headers eliminating string formatting ([#164](https://github.com/QueryaHub/OxyRoute/issues/164), [#184](https://github.com/QueryaHub/OxyRoute/pull/184)).
+
+### Security & Hardening
+
+- **StaticFiles Hardening**: Prevented path traversal and symlink escape vulnerabilities ([#144](https://github.com/QueryaHub/OxyRoute/issues/144)).
+- **DBQuery Parameter Binding**: Verified and documented SQL parameter binding and injection guarantees ([#145](https://github.com/QueryaHub/OxyRoute/issues/145), [#186](https://github.com/QueryaHub/OxyRoute/pull/186)).
+- **FFI Safety**: Configured `panic = "abort"` in `Cargo.toml` to prevent undefined behavior from unwinding across FFI ([#156](https://github.com/QueryaHub/OxyRoute/issues/156)).
+- **Observability**: Ensured `access_log_hook` execution on unhandled exceptions via try-finally ([#157](https://github.com/QueryaHub/OxyRoute/issues/157)).
+- **Dependencies**: Upgraded to `oxyjwt >= 0.7.0` and dropped legacy `pyjwt`/`cryptography` dependencies ([#178](https://github.com/QueryaHub/OxyRoute/pull/178)).
+
 ## [0.5.0] - 2026-07-20
 
 ### Added
@@ -98,6 +143,7 @@ hardening after the v0.3.0 ASGI removal. See `git log v0.3.0..v0.4.0` for the fu
 
   ```python
   from tests._rsgi_test_transport import asgi_test_app
+
   transport = httpx.ASGITransport(app=asgi_test_app(app))
   ```
 

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "oxyroute"
-version = "0.5.0"
+version = "0.6.0"
 edition = "2021"
 description = "RSGI web framework: Rust hot path, Python handlers"
 license = "MIT"
@@ -46,3 +46,5 @@ extension-module = ["pyo3/extension-module"]
 [profile.release]
 lto = true
 codegen-units = 1
+panic = "abort"
+

README.md

@@ -7,14 +7,17 @@ High-performance web framework for **Granian RSGI**, tuned for high **single-wor
 ## Features
 
 - **RSGI** entrypoint (`async def __rsgi__(scope, protocol)`) compatible with Granian’s RSGI implementation
-- **Routing** via [matchit](https://crates.io/crates/matchit) (path parameters like `/users/:id`)
-- **JSON, form, and multipart bodies** parsed on the native path; successful values passed to handlers as kwargs
-- **JWT** verification on the Rust path before your handler runs (`require_jwt`, HS*, RSA, EC, EdDSA public-key verification)
-- **OpenAPI** `GET /openapi.json` plus optional Scalar/Swagger UI at `/docs`
-- **Dependencies**: linear list of named factories (`Depends`, sync or async) passed as kwargs
+- **Routing** via [matchit](https://crates.io/crates/matchit) (path parameters like `/users/:id`) with packed 64B cacheline entries and zero-allocation path param slicing
+- **Native Rate Limiting**: token bucket rate limiter in Rust on route decorators (`rate_limit="100/minute"`, `rate_limit_key="header:X-API-Key"`)
+- **JSON, form, and multipart bodies** parsed on the native path with thread-local buffer pooling; auto-inferred Pydantic `body_model` support
+- **PEP 590 Vectorcall**: direct Python handler invocation eliminating dictionary allocation on the hot path
+- **JWT** verification on the Rust path before your handler runs (`require_jwt`, HS*, RSA, EC, EdDSA public-key verification via `oxyjwt`)
+- **OpenAPI 3.1.0** `GET /openapi.json` with automatic 401/422 docs and optional Scalar/Swagger UI at `/docs`
+- **Dependencies**: DAG dependency resolution with cycle detection at registration (`Depends`, sync or async) passed as kwargs
+- **Resilience**: adaptive concurrency limiting and load shedding (`AdaptiveConcurrencyLimiter`)
 - **Optional middleware layers** for pre-route decisions, CORS, CSRF, and browser security headers
-- **Native RSGI WebSockets** via `@app.websocket(path)` and `oxyroute.WebSocket`
-- Native extension wheel (abi3) for **Python ≥ 3.10**
+- **Native RSGI WebSockets** via `@app.websocket(path)` and `oxyroute.WebSocket` with frame serialization and graceful shutdown notification
+- **Typed & Tested**: PEP 561 `py.typed` marker, complete `.pyi` stubs, and native extension wheel (abi3) for **Python ≥ 3.10**
 
 Start with the full **[Usage guide](docs/usage.md)**, or use **[docs/index.md](docs/index.md)** for topic-specific pages.
 
@@ -82,6 +85,7 @@ OxyRoute supports **only** Granian RSGI; the legacy ASGI bridge (`uvicorn` / `gr
 - [RSGI and Granian](docs/rsgi.md) — app entrypoint, lifespan hooks, worker process model
 - [Handlers](docs/handlers.md) — injected parameters and response mapping details
 - [Routing](docs/routing.md) — methods, path syntax, `APIRouter`, `freeze()`
+- [Rate Limiting](docs/rate-limiting.md) — native Token Bucket rate limiting on route decorators
 - [JWT](docs/jwt.md), [CORS](docs/cors.md), [CSRF](docs/csrf.md), [Security headers](docs/security-headers.md)
 - [WebSockets](docs/websocket.md) and [SSE](docs/sse.md)
 

benches/hot_path.rs

@@ -83,10 +83,46 @@ fn bench_json_to_py(c: &mut Criterion) {
     });
 }
 
+fn bench_json_scale(c: &mut Criterion) {
+    let item = json!({"id": 12345, "name": "Product item name", "price": 99.95, "active": true});
+    let generate_payload = |count: usize| -> serde_json::Value {
+        let items: Vec<serde_json::Value> = (0..count).map(|_| item.clone()).collect();
+        json!({ "items": items, "count": count })
+    };
+
+    let p_1kb = generate_payload(15);
+    let p_10kb = generate_payload(150);
+    let p_100kb = generate_payload(1500);
+
+    Python::with_gil(|py| {
+        let mut group = c.benchmark_group("json_scale");
+        group.bench_function("1kb", |b| {
+            b.iter(|| {
+                let obj = json_to_py(py, black_box(&p_1kb)).unwrap();
+                black_box(obj)
+            })
+        });
+        group.bench_function("10kb", |b| {
+            b.iter(|| {
+                let obj = json_to_py(py, black_box(&p_10kb)).unwrap();
+                black_box(obj)
+            })
+        });
+        group.bench_function("100kb", |b| {
+            b.iter(|| {
+                let obj = json_to_py(py, black_box(&p_100kb)).unwrap();
+                black_box(obj)
+            })
+        });
+        group.finish();
+    });
+}
+
 criterion_group!(
     benches,
     bench_match_route,
     bench_map_handler_return,
-    bench_json_to_py
+    bench_json_to_py,
+    bench_json_scale
 );
 criterion_main!(benches);

docs/cors.md

@@ -22,6 +22,7 @@ apply_cors(
     ),
 )
 
+
 @app.get("/api/x")
 def x() -> dict:
     return {"ok": True}
@@ -36,6 +37,7 @@ def my_mw(scope, protocol):
     # runs only when apply_cors did not return a preflight response
     return None
 
+
 apply_cors(app, config, chain=my_mw)
 ```
 

docs/database.md

@@ -0,0 +1,93 @@
+# Database Integration & DBQuery Security
+
+OxyRoute integrates native database query execution via `sqlx` in Rust, avoiding Python-level ORM overhead on hot data paths while preserving strict SQL injection prevention guarantees.
+
+---
+
+## Native DBQuery & Parameter Binding
+
+When executing queries through `DBQuery`, all arguments must be bound using positional placeholders (`$1`, `$2`, `$3`, ...).
+
+### Safe Parameter Binding (Recommended)
+
+Always pass arguments as a tuple or list in `DBQuery(query, args)`:
+
+```python
+from oxyroute import App, DBQuery, Depends
+
+app = App()
+
+def get_user_query(email: str) -> DBQuery:
+    # SAFE: $1 is parameterized and bound by sqlx at the driver level
+    return DBQuery(
+        "SELECT id, username, email FROM users WHERE email = $1 AND is_active = $2",
+        (email, True),
+    )
+
+@app.get("/users/by-email", dependencies=[("user_data", Depends(get_user_query))])
+def get_user(user_data):
+    return {"user": user_data}
+```
+
+---
+
+## SQL Injection Prevention (Important)
+
+> [!CAUTION]
+> **NEVER** use Python f-strings, `%` formatting, or string concatenation (`+`) to insert user input into SQL queries. Doing so bypasses parameterization and introduces severe SQL injection vulnerabilities.
+
+### Vulnerable Examples (DO NOT DO THIS)
+
+```python
+# ❌ VULNERABLE TO SQL INJECTION:
+email = "admin' OR 1=1; --"
+query = DBQuery(f"SELECT * FROM users WHERE email = '{email}'")
+
+# ❌ ALSO VULNERABLE:
+query = DBQuery("SELECT * FROM users WHERE email = '" + email + "'")
+```
+
+### Supported Parameter Types
+
+The native Rust executor automatically maps and type-checks the following Python types into Postgres wire formats:
+
+| Python Type | Postgres Type |
+|---|---|
+| `None` | `NULL` |
+| `bool` | `BOOL` |
+| `int` | `INT2`, `INT4`, `INT8` (auto-selected) |
+| `float` | `FLOAT4`, `FLOAT8` |
+| `str` | `TEXT`, `VARCHAR`, `CHAR` |
+| `dict` / `list` | `JSON`, `JSONB` |
+
+---
+
+## Database Connection Pool Lifecycle
+
+Configure the Postgres pool in `on_startup` or via `app.setup_database`:
+
+```python
+@app.on_startup
+async def startup():
+    await app.setup_database(
+        "postgresql://user:password@localhost:5432/dbname",
+        max_connections=20,
+    )
+
+@app.on_shutdown
+async def shutdown():
+    await app.close_database()
+```
+
+---
+
+## Streaming & Chunked Row Decoding
+
+For large result sets, `DBQuery` streams row decoding directly from the PostgreSQL socket without accumulating unmanaged `PgRow` structs in Rust memory (issue #143).
+
+You can also pass `chunk_size` to group rows into batches:
+
+```python
+# Stream rows in chunks of 500
+query = DBQuery("SELECT * FROM large_log_table WHERE timestamp > $1", (since,), chunk_size=500)
+```

docs/dependencies.md

@@ -2,7 +2,9 @@
 
 [← Documentation index](index.md)
 
-OxyRoute supports a **linear** list of **named** dependency factories. At request time, each factory is called in order; its return value is injected into the route handler as a **keyword argument** with the given name. Factories that appear **later** in the list are called with **keyword arguments** for every **earlier** name and value (so a factory can depend on a previous one by using the same parameter name, e.g. `def b(a: int): …` when the first tuple is `("a", make_a)`).
+OxyRoute resolves route dependencies as a **directed acyclic graph (DAG)**. At route registration time, OxyRoute builds a dependency graph from the factories' parameter names and performs **topological sorting** (Kahn's algorithm). This guarantees that prerequisites are always evaluated before dependents, regardless of the declaration order in the `dependencies` list. Any **circular dependencies** are detected and rejected at registration time with a descriptive `ValueError`.
+
+At request time, each factory is called in topological order; its return value is injected into dependent factories and the route handler as a **keyword argument**. Factories only receive their declared keyword arguments, avoiding unnecessary parameter passing overhead.
 
 ### Request context (optional)
 
@@ -21,6 +23,7 @@ Pass a list of two-tuples `(name, factory)` to a route decorator, for example:
 def get_db() -> str:
     return "db-conn"
 
+
 @app.get("/items", dependencies=[("db", get_db)])
 def list_items(db: str) -> str:
     return f"ok {db}"
@@ -37,9 +40,11 @@ def list_items(db: str) -> str:
 ```python
 from oxyroute import App, Depends
 
+
 def get_settings():
     return {"env": "dev"}
 
+
 @app.get("/x", dependencies=[("settings", Depends(get_settings))])
 def x(**kwargs) -> str:
     return "ok"

docs/development.md

@@ -29,10 +29,12 @@ from oxyroute.testing import TestClient
 
 app = App()
 
+
 @app.get("/")
 def home():
     return {"status": "ok"}
 
+
 def test_home():
     with TestClient(app) as client:
         resp = client.get("/")

docs/index.md

@@ -48,12 +48,14 @@ Granian still invokes a Python `App` object; the “win” is doing routing, bod
 | [JWT](jwt.md) | `require_jwt`, HS* / RSA / EC PEM, `decode_jwt_hs` (HS* tests) |
 | [Streaming & SSE](streaming.md) | `stream_bytes`, `stream_text`, `send_sse`, streaming caveats |
 | [WebSockets](websocket.md) | Native RSGI `@app.websocket(path)` and `oxyroute.WebSocket` |
+| [Rate Limiting](rate-limiting.md) | Native Rust in-memory Token Bucket rate limiting on route decorators |
 | [HTTP/2 with Granian](http2.md) | Transport guarantees vs server/proxy responsibilities |
 | [Dependencies](dependencies.md) | `Depends`, `dependencies=[...]`, `freeze` |
 | [OpenAPI](openapi.md) | `openapi.json`, docs UI (Scalar/Swagger), tags, JWT security |
 | [Development](development.md) | Tests, CI, PyPI releases (tag `v*`), clippy, pytest |
 | [Branching and PRs](development-workflow.md) | `dev` as base, issue branches, `Closes #N`, no mixing code with `ISSUE_BACKLOG` in one commit |
 | [Feature gaps (research)](feature.md) | What is missing vs a “full” HTTP framework and what has been implemented — Russian |
+| [SIMD JSON Evaluation](simd-json-evaluation.md) | SIMD-accelerated JSON deserialization evaluation and throughput analysis |
 | [Contributing](../CONTRIBUTING.md) | Local setup, issue backlog, GitHub `gh` workflow |
 
 [← Back to project README](../README.md)

docs/jwt.md

@@ -38,9 +38,9 @@ The handler is **not** executed when:
 
 ## `decode_jwt_hs` (Python, for tests and HS parity)
 
-The native module exports **`decode_jwt_hs(token, key, algorithm_list)`**, re-exported from the top-level `oxyroute` package. It decodes a token and returns claims, **HMAC (HS\*) only**, for golden tests against the [`oxyjwt`](https://pypi.org/project/oxyjwt) package. For **RSA/EC/Ed** verification in Python tests, use your usual stack (e.g. **PyJWT** + `cryptography` with the same PEM keys).
+The native module exports **`decode_jwt_hs(token, key, algorithm_list)`**, re-exported from the top-level `oxyroute` package. It decodes a token and returns claims, **HMAC (HS\*) only**, for golden tests against the [`oxyjwt`](https://pypi.org/project/oxyjwt) package. For **RSA/EC/Ed** verification and token generation in Python tests, use [`oxyjwt`](https://pypi.org/project/oxyjwt) (`EncodingKey.from_*_pem` / `DecodingKey.from_*_pem`).
 
-**Optional dev dependencies:** `oxyjwt`, `pyjwt`, and `cryptography` are in `oxyroute[dev]` for tests; production only needs the native extension and your `jwt_secret` / `algorithms` configuration.
+**Optional dev dependencies:** `oxyjwt` is in `oxyroute[dev]` for tests; production only needs the native extension and your `jwt_secret` / `algorithms` configuration.
 
 ## See also
 

docs/openapi.md

@@ -2,7 +2,7 @@
 
 [← Documentation index](index.md)
 
-OxyRoute maintains an **OpenAPI 3.0**-shaped JSON document in Rust while routes are registered. It is suitable for discovery and interactive docs (Scalar / Swagger UI), and can be extended further in future versions.
+OxyRoute maintains an **OpenAPI 3.1.0** (or configured version) JSON document in Rust while routes are registered. It is fully compatible with Pydantic v2 JSON Schema and suitable for discovery and interactive docs (Scalar / Swagger UI).
 
 ## Constructor and toggles
 
@@ -39,9 +39,10 @@ app.mount_docs("/api/docs", ui="swagger")
 
 UI scripts load from **jsDelivr**. If you use `SecurityHeadersConfig` (or a strict CSP), allow `cdn.jsdelivr.net` in `script-src` / `style-src` for the docs route, or disable those headers on `/docs`.
 
-## Title, info, and servers
+## Title, version, info, and servers
 
 - **`title=`** / **`set_openapi_title`** — `info.title`.
+- **`openapi_version="3.1.0"`** (default) / **`set_openapi_version`** — root `openapi` specification version string.
 - **`openapi_description=`**, **`openapi_contact=`**, **`openapi_servers=`** constructor kwargs, or **`app.set_openapi_info(description=..., contact=..., servers=...)`**.
 
 ```python