Skip to content
Atlas

Atlas 0.5.2

Released 2026-10-28 · v0.5.2 on GitHub · install with "atlas": "github:AndreyDAraya/atlas#v0.5.2"

Security hardening at the query cursor, shape, Atlas-Await and Express boundaries.

Added

Section titled “Added”
  • Bounded records: t.record(of, { max?, key? }). max limits the number of entries (maxProperties in JSON Schema); key validates each property name against a string/enum shape (propertyNames in JSON Schema) and rejects reserved keys (__proto__, constructor, prototype) both before and after any key normalization. satisfies and ATLAS028 check record max and key bounds.
  • Express: bodyLimit and allowAwait: 'views' / predicate. atlasRouter(runtime, { bodyLimit }) passes a custom size limit to express.json({ limit }). allowAwait: 'views' honors view awaits (views or a view list) for identified callers while ignoring 'all' cascade awaits; allowAwait: (actor, wait, req) => boolean gates awaits per request; and repeated view names in Atlas-Await are deduplicated.

Fixed

Section titled “Fixed”
  • Typed keyset cursors. decodeCursor(cursor, spec, order) validates the cursor length and checks that each element matches the scalar type of its order or key column (text, safe-integer bigint, finite double, boolean), so a forged cursor with mismatched element types is rejected with 400 invalid-input before reaching Postgres instead of triggering a 22P02 cast failure (503 store-failed).
  • Atlas-Await polling. caughtUp and cascadeDone skip empty roots/consumers and remember (consumer, id) pairs that already passed, avoiding redundant store.passed queries on every 15 ms poll tick while waiting on slower consumers.

From CHANGELOG.md. All versions: Releases.