Releases

Autumn release notes and key framework milestones.

See how Autumn evolves from release to release — from core improvements to new capabilities.

v0.1.8
August 17, 2026

Changes in this release

  • HTTPException now returns a cleaner error payload with code, details, request_id, and timestamp
  • Validation failures now return structured fields with source, field, input, and error for body and query errors
  • Domain errors can override the default HTTP status code name with a custom code, such as INVALID_OR_EXPIRED_CHALLENGE
  • Unexpected internal exceptions now print full tracebacks to the console, while expected HTTPException responses stay silent
  • Controllers and services now support dependency injection through class attributes, allowing constructor-free classes with annotated dependencies
  • Attribute injection supports the same dependency resolution rules as constructor injection, including union dependencies and @only environments
  • Autumn now returns 405 Method Not Allowed with an Allow header when a route path exists but the requested HTTP method is not registered
v0.1.7
August 16, 2026

Changes in this release

  • ApplicationConfiguration.environment is now the single source of truth for the application environment; the environment argument was removed from Autumn(...)
  • The default environment is now Environment.LOCAL, making local development work without manual environment wiring
  • WebUIConfiguration.allowed_on now includes LOCAL and DEVELOPMENT by default, so the built-in documentation remains available locally
  • @serializable now generates __init__ for classes without a custom constructor using class-level annotations
  • Generated @serializable constructors support required fields, default values, Public[...], and Private[...]
  • OpenAPI schemas for @serializable no longer mark fields with default values as required
v0.1.6
August 15, 2026

Changes in this release

  • Added autumn.resources.Resources as a singleton resource root for static files, JSON/YAML data, and safe rooted file responses
  • Added ResourceType and the unified Resources(...).read(..., ResourceType.TEXT | ResourceType.BYTES | ResourceType.DATA) API
  • Added request-scoped localization with I18n, Locale, and LocalizationConfiguration; locales are resolved from Accept-Language and loaded from .json, .yaml, or .yml resource files
  • Added I18n.plural(...) with default one/many behavior and custom plural rules through LocalizationConfiguration.plural_rules
  • Added key fallback and console warnings for missing locale files, keeping applications usable while exposing configuration mistakes during development
  • Added environment-aware union dependencies for @only: dependencies such as MockGateway | LiveGateway now resolve to the provider allowed in the current environment
  • Autumn now rejects union dependencies whose allowed environments overlap, preventing ambiguous dependency selection at startup
  • Added cross-environment @only dependency graph warnings for components that can start in one environment but fail in another
  • Improved HTTPException with request_id, meta, and custom body support
  • HTTP responses now include X-Request-ID, using X-Request-ID, X-Correlation-ID, or an automatically generated value
v0.1.5
August 12, 2026

Changes in this release

  • Added the autumn.security module with Principal, SecurityConfiguration, APIKey and JWTBearer schemes, plus @authenticated, @public, @roles, @permissions, @requires, and @policy decorators
  • Integrated authorization with DI: Principal is available in controllers and policies, while access rules can use request, path, and query parameters together with application services
  • Added explicit module and package discovery through Autumn(discover = ...); listed packages load all Python modules and nested packages inside them
  • Added a 1 MiB default request body limit configurable through ApplicationConfiguration.max_request_body_bytes, with 413 Payload Too Large for oversized requests
  • Added FileResponse.from_root(...) to keep user-selected files inside an allowed directory, including protection against traversal and symbolic-link escapes
  • Added strict response header validation and the public InvalidHeaderError exception to prevent malformed headers and response splitting
  • Replaced executable annotation evaluation in @serializable with a restricted AST allowlist
  • Production applications now return a generic Internal Server Error response instead of disclosing unhandled exception details
  • Compiled route execution plans and cached middleware composition per route and method; immutable response metadata and body bytes are now encoded once
  • Improved dynamic routing with static-prefix indexes
  • Added pip-audit to development and CI dependency checks and raised the minimum secure click version to 8.3.3
v0.1.4
June 5, 2026

Changes in this release

  • Added WebUIConfiguration for configuring Web UI availability, themes, leaf animations, and allowed environments
  • Added Environment and Theme enums for type-safe application configuration
  • Introduced the @only decorator for restricting controllers, services, dependencies, middleware, and hooks to specific environments
  • Components unavailable in the current environment are now automatically excluded from the DI container, routing, and OpenAPI documentation
  • Added dependency graph validation during application startup to detect dependencies on disabled providers before serving requests
  • Improved OpenAPI schema generation for Pydantic models and classes marked with @serializable
  • Added return value analysis for JSONResponse, custom models, dict, and list when generating OpenAPI documentation
  • Added automatic HTTP error documentation based on raise HTTPException(...) statements
  • Added support for multiple response variants via OpenAPI oneOf and improved compatibility with custom Response classes
  • Updated the documentation UI: fixed leaf rendering, added transparency and blur effects, and improved handling of long sidebar item names
v0.1.1
April 17, 2026

Changes in this release

  • Reduced overhead on the HTTP request hot path
  • The dependency container now uses caching more aggressively and performs less repeated work
  • Controller handler execution and the internal runtime pipeline are now faster
  • Routing and middleware selection have been improved on the hot path
  • JSON responses and request body handling are now faster
  • dict and list can now be returned directly from handlers with automatic JSON wrapping
  • Added @serializable for explicit serialization of custom classes
  • Public[T] and Private[T] are now available to separate public and internal fields of a serializable class
  • OpenAPI now describes responses for custom serializable objects more accurately
  • Added in-controller middleware methods: @middleware, @middleware.before, and @middleware.after
v0.1.0
April 14, 2026

Changes in this release

  • Basic routing and controller support
  • Dependency Injection Container
  • Declarative configuration
  • Auto-generated OpenAPI documentation and dependency graph
  • ASGI integration with Uvicorn