FluidKit v1.3.0 Released: Fixes and Security Enhancements

The hardest part of building an open source framework isn't shipping v1. It's what happens the week after. I released FluidKit last week. A bridge between Python and SvelteKit that lets you write backend functions in Python and use them as native SvelteKit remote functions. 7 days later, I found two problems I couldn't ignore. The first was subtle. Edit a decorated function fast enough, or swap its decorator type mid-development, and the route would stick in FastAPI permanently. Ghost endpoints. Invisible unless you checked /docs. The root cause took hours to trace. The hot reload system assumed cleanup would always happen in order. But the reload engine sometimes fires delete before the proxy even attaches. The cleanup path never runs. The route lives forever. The fix: a reconciliation pass after every reload. Compare what the registry thinks exists against what the module actually exports. Mismatches get cleaned up immediately. The second problem was a security gap. FluidKit generates /remote/* endpoints meant only for SvelteKit's server. But anyone who knew the port could call them directly. Now every request carries an HMAC-signed timestamp. No valid signature, no access. Building a framework means your bugs become everyone's bugs. That's why I shipped both fixes within a week. FluidKit v1.3.0 is live. pip install --upgrade fluidkit If you're using FluidKit and hit something weird, open an issue: https://lnkd.in/g3zdvcYJ Docs and source: https://fluidkit.github.io If you're building fullstack apps with Python, I'd love your feedback. And if you've shipped something open source and know that post-launch anxiety, I get it now. #Python #SvelteKit #FastAPI #OpenSource #WebDevelopment #FullStack #Pydantic #BuildInPublic

To view or add a comment, sign in

Explore content categories