angel3_framework

Releases

1. ▸▾9.2.05 Oct 2026

   feat: Services, hooked services and @Middleware lookups now work without reflection; annotations are ignored when no reflector is configured instead o

   • feat: Services, hooked services and @Middleware lookups now work without reflection; annotations are ignored when no reflector is configured instead of throwing an errror. This enabled support for dart compile exe to be used to build applications without reflection.
   • feat: Added Controller(expose: ...) to set the mount path without using reflection through @Expose annotation
   • feat: Added ioc(..., injection: InjectionRequest) for dependency injection without using reflection
   • feat: Added session timeout (default 20 minutes), idle HTTP/2 sessions are now discarded instead of being kept forever
   • feat: Added max size to the content body and rejects larger body with 413 error. The default limit is 10 MB
   • feat: Finalizers now run at most once per response
   • feat: Added max route cache size (default 1024); the production route cache now evicts least recently used entries.
   • feat: Added ResponseContext.attachmentDisposition() and Driver.closeServer()
   • fix: An empty JSON array ([]) in the POST request body no longer causing a 500 errer
   • fix: _http is now nullable and only closed if it was created.
   • fix: The default error handler now HTML-escapes the exception message and errors (XSS)
   • fix: res.redirect() now escapes the URL in the HTML fallback page and no longer emits javascript:, vbscript: or data: (XSS)
   • fix: HookedService.afterAllStream() now emits after-events instead of before-events
   • fix: A missing @CookieValue now uses its defaultValue or returns 400, instead of a 500 error
   • fix: DELETE / on a service now requests "remove all" (id 'null'), subject to allowRemoveAll; services with non-String ids return 405 instead of a 500 error
   • fix: An HTTP/2 request with a malformed header value (e.g. a bare %) no longer crashes the server process
   • fix: HTTP/2 header values are no longer percent-decoded or split on commas
   • fix: req.hostname over HTTP/2 now comes from the :authority header instead of always being localhost
   • fix: HTTP/2 sessions are now reused across multiple requests via the DARTSESSID cookie. Unknown session ids get a new session instead of being adopted
   • fix: Errors raised while creating a request context, or on an HTTP/2 connection, are now logged instead of terminating the server
   • fix: HostnameRouter now passes route parameters (e.g. :id) to the sub-app's handlers
   • fix: HostnameRouter creates each lazily-built app once, even when several requests arrive before creation finishes
   • fix: res.streamFile() with a response encoder (e.g. gzip) no longer sends the uncompressed Content-Length, which crashed the server process
   • fix: Unbuffered responses with several write() calls are now compressed as one gzip/deflate stream instead of one per write
   • fix: Response encoders now skip encodings the client marks q=0 in Accept-Encoding
   • fix: HTTP/2 server pushes are no longer compressed without a content-encoding header
   • fix: A failure while closing an HTTP/1.1 response is now logged instead of terminating the server
   • fix: responseFinalizers now run on unbuffered responses, just before headers are sent, so they can set headers, status and cookies. They still run after the handler, with the full body, on buffered responses. Behaviour change: finalizers that read res.buffer should check res.isBuffered
   • fix: An invalid response header (e.g. a non-ASCII value) now fails with 500 error, thrown where the header is set
   • fix: The HTTP/2 DARTSESSID session cookie is now Secure and HttpOnly
   • fix: The future returned by handleRequest/handleRawRequest now completes after the error response is sent when a handler throws an error, instead of never completing
   • fix: The no reflector startup message is now logged at info instead of warning as it is not longer a mandatory requirement to use Angel3
   • fix: When nothing matches, the driver now returns 404 instead of 500
   • fix: The application and default logger now prints their record only once. Creating an app with a custom logger, or setting app.logger, no longer removes the application's own Logger.root listeners
   • fix: res.download() no longer sends the file's server path as the download name, encodes any filename safely (RFC 6266), uses application/octet-stream for unknown types instead of crashing, reads the file asynchronously, and returns 404 for a missing file. res.streamFile() also returns 404 for a missing file instead of an error that revealed its path
   • fix: startServer now rethrows the original error (e.g. a SocketException when the port is in use) instead of a generic ArgumentError, and closes the bound server if a startup hook fails
   • fix: res.addStream() (and so res.streamFile()) on a buffered response now writes into the buffer, instead of sending directly and leaving the buffer empty
   • fix: HEAD requests are now answered by the matching GET route, without a body, when no explicit HEAD route exists (RFC 9110), including in HostnameRouter sub-apps. Behaviour change: such requests previously returned 404 or reached a fallback route
   • fix: req.accepts() now parses the Accept header instead of matching substrings: application/json no longer matches application/json-patch+json, type wildcards such as text/* are honoured, and types marked q=0 are not accepted
   • fix: Controller methods named put… and head… now map to PUT and HEAD routes. The verb must be a whole word, so posts() or getter() are now GET /posts and GET /getter, not POST /s and GET /ter
   • refactor: With no container passed, it now falls back to the request's container
   • refactor: Resolved various issues with MapService
   • refactor: Consolidated multiple copies of the encoder selection logic

• angel3_authpub.devA complete authentication plugin for Angel3. Includes support for stateless JWT tokens, Basic Auth, and more.
• angel3_auth_oauth2pub.devAngel3 library for authenticating users with external identity providers via OAuth2.
• angel3_cachepub.devA service that provides HTTP caching to the response data for Angel3
• angel3_clientpub.devA browser, mobile and command line based client that supports querying Angel3 servers
• angel3_configurationpub.devAutomatic YAML application configuration loader for Angel 3, with .env support.