Changelog

All notable changes to sigil-web are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.17.0] - 2026-08-25

Breaking

This release requires Sigil 0.19 or newer. Upgrading is not a range bump; it moves your runtime. Raise sigil to ^0.19 in your own package.sgl in the same commit that raises sigil-web, then relock.

Nothing will tell you if you skip that. A dependency's sigil: floor is not enforced during resolution, only the root package's, so a consumer left on the 0.17 or 0.18 runtime resolves a 0.17 stdlib alongside 0.19-line packages and builds green with no error and no warning.

The minor bump is the signal. A patch release would have been picked up automatically by anyone pinned ^0.16, silently; 0.17.0 makes you opt in.

Changed

Crossed the Sigil 0.19 stdlib boundary. sigil-stdlib absorbed the ansi, socket, hooks, version, fp and match modules at 0.19.0, and this release moves every dependency range that still reached a standalone copy of one of them. The lock drops from 18 entries to 12: sigil-ansi, sigil-hooks, sigil-docs, sigil-socket, sigil-version, sigil-args and sigil-git leave it, and sigil-repl now resolves to the sigil-repl package inside codeberg:sigil/sigil rather than the archived standalone repository.

Crossing the boundary is not a single-range change. Bumping one range alone leaves the remaining standalones in the lock beside a 0.19 stdlib, which yields two providers of the same module compiling to one output path, where whichever section builds last silently wins. The ranges moved together:

dependency	from	to	why
`sigil`	`^0.17`	`^0.19`	`sigil-nrepl` 0.17.1 requires it
`sigil-nrepl`	`^0.16`	`^0.17.1`	0.17.1 is the first release consuming `sigil-repl` from the monorepo; 0.17.0 still reaches the archived standalone
`sigil-http`	`^0.18.0`	`^0.18.4`	0.18.4 is the first release that stopped declaring `sigil-socket`
`sigil-test` (dev)	`^0.17`	`^0.19`	keeps the runner pair on one release line
`sigil-test-runner` (dev)	`^0.17`	`^0.19`	0.17.3 declares `sigil-ansi`, and pulls `sigil-version` and `sigil-git` through the workspace

sigil-tls moves 0.16.3 -> 0.16.6 as part of the relock. That release line bounds the TLS handshake as a whole rather than per read, makes tls-write yield instead of blocking, and fixes a descriptor leak, so HTTPS behaviour changes with it.
sigil-crypto moves 0.16.3 -> 0.16.5, and sigil-sqlite 0.16.2 enters the lock transitively. sigil-sqlite vendors a SQLite amalgamation that is compiled as part of a build.

[0.16.1] - 2026-07-10

Fixed

Live-stream SSE endpoints (live-routes) no longer return 500 Internal Server Error with car: expected pair when a client connects. stream-events-handler now passes the broadcast handler (identity) explicitly to http-response/sse-broadcast instead of relying on its default. The stream hub carries pre-formatted SSE strings, so identity is the correct handler; passing it explicitly keeps GET on a live-stream endpoint working across every sigil-http release, including ones that type the broadcast handler as a required positional argument.

[0.16.0] - 2026-07-10

Added

serve-file honors a request's Range: header. Pass the request as an optional second argument (make-static-handler now threads it through): a satisfiable range yields 206 Partial Content, an unsatisfiable one 416 Range Not Satisfiable, served via http-response/file. Full-file responses now advertise Accept-Ranges: bytes, so static assets support byte-range seeking and resumable downloads. Existing single-argument serve-file callers are unaffected.

Changed

Bumped the sigil-http dependency to ^0.18.0, which provides http-response/file's range: keyword.