cymongoose provides Pythonic access to Mongoose, a lightweight embedded networking library written in C. It supports HTTP servers, WebSocket, TCP/UDP sockets, and more through a clean, event-driven API.

Changes since the last Release

Fixed

• AsyncManager poll loop lock starvation: The _run() loop held the RLock for the entire duration of poll(), causing listen()/connect()/etc. to block indefinitely on lock acquisition. On Linux, unfair pthread mutexes allowed the poll thread to immediately re-acquire after release; on all platforms, large poll_interval values (e.g. 5000ms) held the lock for seconds. Fixed by capping internal poll duration at 200ms (_MAX_POLL_MS) and yielding between cycles (_stop.wait(0.001)).
• Windows CI test timeouts from localhost IPv6 fallback: Tests using localhost on Windows could resolve to ::1 (IPv6) first, failing against the IPv4-only server before falling back to 127.0.0.1. Changed test helpers and benchmarks to use 127.0.0.1 directly.
• Windows CI ephemeral port exhaustion in benchmarks/tests: The test harness clients (urllib.request.urlopen) open hundreds of short-lived TCP connections in tight loops, exhausting Windows ephemeral ports due to aggressive TIME_WAIT (~2 minutes). This is a test client limitation, not a cymongoose server issue. Reduced test client iteration counts on Windows only: quick_bench.py (1000 -> 200), simple_load_test.py (5000/50 -> 500/20), test_rapid_sequential_connections (100 -> 50). Linux and macOS remain unchanged.

Security

• GitHub Actions workflow permissions: Added explicit permissions: contents: read to all workflow files (ci.yml, build-alt.yml, build-simple.yml, build-wheels.yml). Workflows without explicit permissions default to broad read/write access.
• Test socket binding restricted to loopback: Changed get_free_port() in conftest.py and all benchmark scripts to bind to 127.0.0.1 instead of "" (all interfaces).
• Incomplete URL substring sanitization: Changed "example.com:443" in connect_received[0] to exact equality check in test_examples_advanced.py.

Changed

• docs/dev/security.md TLS section: Replaced stale "future work" language and mg_tls_opts references with actual TlsOpts API usage, parameter table, and recommendations.
• Example tests CI job: Added non-blocking examples job to .github/workflows/ci.yml (continue-on-error: true) so example breakage is surfaced without blocking merges.
• Cross-platform load test CI job: Added non-blocking load-test job to .github/workflows/ci.yml running quick_bench.py (1000 sequential) and simple_load_test.py (5000 concurrent) on Linux, macOS, and Windows.

Removed

• USE_NOGIL_ENABLED: Removed dead constant from _mongoose.pyx, .pyi stub, __init__.py, docs/installation.md troubleshooting tip, and demo_server.py startup message. It was always True since the USE_NOGIL compile-time conditional was removed in v0.2.0.