Matthew Meszaros 42ddb78e60 feat: make the realtime service survive a client that spams channel joins, and stop both clients from being that client: ws_join is now spent per phx_join in a shared RealtimeWeb.ChannelGuard that every channel runs BEFORE its Auth lookup (it was only ever spent on the socket handshake, so an established socket could issue unlimited joins and each one cost a Postgres query), handshakes move to their own ws_connect bucket so a reconnect storm cannot eat the budget a client needs to rejoin with, the retry_after_ms hint now points at the next window instead of shrinking as overage grew, every channel's join rejection carries the numeric code the API reference already promised (plus 4005 for a malformed topic), BulkChannel only pushes an event to the user who owns the operation instead of to anyone who guesses the id, and the web and admin clients treat a rate_limited join as transient (wait out the hint, keep the socket) while backing off per-channel rejoins on a decaying schedule rather than reconnecting on the 120ms floor forever; adds an ExUnit suite for realtime and a vitest suite for admin, both wired into CI

2026-08-26 21:14:34 -07:00

..

actions/setup-pnpm

feat: give warmblyctl an API-key half so agents and scripts can operate any Warmbly instance, ship in-repo agent skills that teach it, and cut the README quick start and self-hosting sections down to commands plus docs links (#135)

2026-08-19 20:59:40 -07:00

scripts

feat: fix the release notes so What's Changed renders as grouped sections instead of one crammed paragraph: the changelog step encoded newlines as %0A for the set-output command GitHub disabled in 2022, so all 50 commits collapsed into a single run-on line with literal %0A separators, and generate_release_notes:true alongside a hand-written body made GitHub append a second duplicate What's Changed section (44KB body on v0.2.1); a new .github/scripts/release-notes.sh now walks --first-parent so each PR is one entry, takes the PR title from the merge commit body, groups by conventional-commit type into Features/Fixes/Performance/Security/Documentation/Maintenance/Other, trims this repo's deliberately long subjects at a clause boundary, links the PR (or the commit for direct pushes), picks the previous tag via git tag --sort=-v:refname --merged so stable releases skip prereleases and still list what an rc covered, states truncation instead of silently cutting at 50, and the workflow passes the assembled body via body_path so no escaping layer remains

2026-08-24 20:23:41 -07:00

workflows

feat: make the realtime service survive a client that spams channel joins, and stop both clients from being that client: ws_join is now spent per phx_join in a shared RealtimeWeb.ChannelGuard that every channel runs BEFORE its Auth lookup (it was only ever spent on the socket handshake, so an established socket could issue unlimited joins and each one cost a Postgres query), handshakes move to their own ws_connect bucket so a reconnect storm cannot eat the budget a client needs to rejoin with, the retry_after_ms hint now points at the next window instead of shrinking as overage grew, every channel's join rejection carries the numeric code the API reference already promised (plus 4005 for a malformed topic), BulkChannel only pushes an event to the user who owns the operation instead of to anyone who guesses the id, and the web and admin clients treat a rate_limited join as transient (wait out the hint, keep the socket) while backing off per-channel rejoins on a decaying schedule rather than reconnecting on the 120ms floor forever; adds an ExUnit suite for realtime and a vitest suite for admin, both wired into CI

2026-08-26 21:14:34 -07:00