Breaking changes:
Encrypt signing and rotation keys in the datastore, in AtpRepo entities. The old non-encrypted properties have been removed. See this GitHub issue for migration details.
Non-breaking changes:
- Add optional new
SUPPORTED_COLLECTIONSenvironment variable, a comma-separated set of NSIDs. - Add SSRF protection to all outgoing HTTP requests via
requests-hardened. datastore_storage:read_blocks_by_seq: set explicit 30s timeout on datastore query. Evidently, maybe, in rare cases, datastore queries can hang indefinitely if they don't have an explicit timeout (snarfed/bridgy-fed#2367).- New
read_many_rawmethod: bypasses ndb model instantiation and uses the raw Datastore gRPC stub directly for significantly faster bulk block reads incom.atproto.sync.getRepo. - Change
AtpBlock.decodedfrom DAG-JSON to decoded CBOR object.
storage: newread_many_rawbase method with default fallback implementation.did:write_plcetc: add new optionalnew_rotation_keykwarg. AcceptEllipticCurvePublicKeyforsigning_keyas well asEllipticCurvePrivateKey.resolve_*: thread safety bug fix for caches.
com.atproto.sync.getRecord: add the repo's head commit block, use its CID as the CAR root.com.atproto.sync.getRepo: drastically optimize, it's 15-20x faster or more for large repos, and uses much less memory.