Starstruk Logo MarkStarstruk

axum-extra-v0.12.6

scottschiller/SoundManager2axum-extra-v0.12.6Apr 14, 2026by yanns

AI Summary

This update includes a security fix for potential header injection in file attachments and enforces a new syntax for the `vpath!` macro, rejecting the old 107 format.

Key Highlights

  • Security fix: Escape backslashes and quotes in `Content-Disposition`
  • Enforced new `{var}` syntax in `vpath!` macro
  • Fixed multipart body limit error messages

Breaking Changes

  • `vpath!` macro now rejects old `:var` and `*var` syntax, requiring `{var}`

New Features

  • Enhanced header security for file downloads
  • Updated path variable syntax enforcement

Full Release Notes

- **fixed:** Escape backslashes and double quotes in `Content-Disposition` filenames to prevent header parameter injection in `Attachment` and `FileStream` ([#3664])
- `vpath!` macro now stops the compilation if your path is using deprecated path variables in the old `107` format, such as `:var` and `*var`. the only allowed way now is `{var}`. ([#3618])
- **fixed:** Return specific error message when multipart body limit is exceeded ([#3611])

[#3664]: https://github.com/tokio-rs/axum/pull/3664
[#3618]: https://github.com/tokio-rs/axum/pull/3618
[#3611]: https://github.com/tokio-rs/axum/pull/3611