Daptin Files

Highlights

Faster hosted sites

• Enabled negotiated GZIP compression for hosted sites by default through the existing gzip.enable setting.
• Added reusable compressed sidecars for static assets and an in-memory compressed representation for cached index pages, avoiding per-request recompression.
• Switched static responses to single-open serving with correct byte-range handling, Vary: Accept-Encoding, and representation-specific ETags.
• Added a reproducible subsite benchmark and loopback load-test suite with recorded before/after results.

On the recorded Apple M1 Max loopback benchmark at concurrency 100:

• GZIP throughput increased from about 4.4k to 46k requests/second.
• GZIP p99 latency fell from about 132 ms to 5.6 ms.
• Uncompressed throughput increased from about 37k to 52k requests/second.
• GZIP benchmark allocations fell from about 852 KB to 4.3 KB per operation.

See loadtest/subsite/COMPARISON.md (github.com) for the methodology and detailed results.

Security and configuration

• Added a strict, configurable CORS policy with validated origins, methods, headers, credentials, preflight behavior, and normalized default ports.
• Fixed configurable cluster-wide rate limiting, including shared Olric counters, host-and-path subsite limits, query-independent route matching, and process-local fallback behavior.
• Hardened generated audit tables by removing unsafe guest permissions and sensitive or conflicting schema properties while preserving explicitly defined audit tables.
• Removed process command-line arguments from the statistics response to prevent accidental disclosure of secrets passed on the command line.
• Fixed storage of long configuration history values, including automatic widening of legacy PostgreSQL previousvalue columns.

Fixes and reliability

• Fixed SMTP allowed-host updates so mail-server configuration can be reloaded correctly, with improved certificate-chain handling and validation of duplicate listeners and missing hostnames.
• Fixed asset and media streaming when cloud stores use key-path prefixes; responses now stream from the file handle resolved by the asset cache and preserve range support.
• Fixed built-in schema merging so column extensions are retained without duplicating or incorrectly clearing schema definitions.
• Fixed JSON:API reads with an empty default order and expanded sorting/default-order regression coverage.
• Fixed HostSwitch routing for multi-segment API paths so they no longer fall back to dashboard HTML (#235, thanks @mvanhorn).
• Adjusted the websocket stress test to use an appropriate rate limit.

Documentation and testing

• Redesigned the README around clearer feature, architecture, and automation visuals.
• Expanded production mail delivery, CORS/configuration, auditing, actions, CRUD, permissions, signup propagation, cloud storage, and subsite documentation.
• Added PostgreSQL row-authorization scaling benchmarks and substantial regression coverage for CORS, rate limiting, audit schemas, configuration updates, HostSwitch routing, asset streaming, and compressed site serving.

Upgrade notes

• gzip.enable now controls API, dashboard, and hosted-site compression and defaults to true. Restart Daptin after changing it because site routers are created at startup.
• Deployments with custom browser clients should review the stricter CORS configuration and explicitly allow their production origins, methods, and headers.
• Compressed site artifacts are stored under .daptin-compressed inside the local site cache and are not uploaded back to cloud storage.

This release includes all changes since the last published release, v0.12.31; the intervening v0.12.32, v0.12.33, and v0.12.34 releases remained drafts.

Full changelog: https://github.com/daptin/daptin/compare/v0.12.31...v0.12.35