| v0.7.1 | Security updates: Phoenix HTML 4.4.0 fixes attribute injection (CVE-2026-117645), and ssl_verify_fun 1.1.8 fixes TLS hostname verification (CVE-2026-117666). Provider-knowledge switches accept on/off, true/false and 1/0, in any case. Startup warns when obsolete LW_BETA is set | Rename LW_BETA to BALANCED_FAST_BETA; the old name has not been read since v0.6.0. The learned-limit switches do not disable eth_getLogs range-limit failover or missing-block recovery. YAML null capability lists already failed on earlier releases; use []. See v0.7.0 and v0.6.0 below when upgrading from v0.5.x/v0.6.x. No migrations |
| v0.7.0 | Learned method refusals, historical depth and eth_getLogs range limits are on by default: matching providers are moved behind alternatives. Includes a Chainstack template | Routing order can change. Set LASSO_PROVIDER_KNOWLEDGE_METHOD_REFUSAL_MODE, LASSO_PROVIDER_KNOWLEDGE_HISTORICAL_DEPTH_MODE and LASSO_PROVIDER_KNOWLEDGE_SPAN_LIMIT_MODE to off to keep v0.6.0 ordering. Capability list fields left as YAML null now fail validation; use []. No migrations |
| v0.6.0 | latency-weighted is now balanced-fast, and priority has its own HTTP and WebSocket routes. load-balanced gives each physical upstream one first-pick share. Bare /api/ready reports replica readiness, so a dead upstream no longer takes every replica out of service. Bounded selection diagnostics name why a request found no eligible provider | Rename LW_BETA to BALANCED_FAST_BETA; the old name isn’t read. latency-weighted URLs and strategy values keep working as permanent aliases. Load balancers that need upstream-backed readiness use /api/ready?profile=PROFILE&chain=CHAIN |
| v0.5.1 | A full Prometheus /metrics contract with per-route totals, latency histograms, attempt diagnostics, circuit, WebSocket and BEAM series, and a refreshed Grafana dashboard. Opt-in OpenTelemetry tracing (LASSO_OTEL_ENABLED) with W3C propagation and log correlation. Fixes a provider staying ineligible after its first 429 until restart | Upgrade if your providers return 429s. Prometheus consumers should review the new metric families and the transport, profile and origin labels |
| v0.5.0 | Route readiness, node-local Prometheus metrics, JSON console logs, profile validation and reload commands, standalone provider discovery and routing evidence. Tighter HTTP and WebSocket resource limits | Stricter request and discovery validation can reject malformed input that earlier versions accepted |
| v0.4.5 | Phoenix, Cowboy, Cowlib and Ranch upgrades (Cowlib 2.20.0 resolves CVE-2026-43971). Correct Public Arbitrum archive routing. Requests no provider can serve fail at admission with a structured reason | Review local archival declarations against your historical state reads |
| v0.4.4 | load-balanced tries distinct physical providers before a second transport of the same one (details) | None |
| v0.4.3 | Rejects an HTTP endpoint whose chain-ID probe mismatches, orders orphan-log events correctly, and strips URL credentials and paths from provider diagnostics | None |