chore(release): v1.0.0-rc5 (security hardening, fleet concurrency, wasm fuel sandbox, 2.46M eps, and rustsec fixes)

.github/workflows/release.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag (e.g. v1.0.0-rc4)'
+        description: 'Release tag (e.g. v1.0.0-rc5)'
         required: false
 
 permissions:

CHANGELOG.md

@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > See `BENCHMARK-AUDIT.md` and `test/BENCHMARKS.md` for the audited methodology.
 > No latency-histogram p99 is claimed.
 
-## [Unreleased] - Rekuiper Manager & Visual Stream Studio (Phases 1–4)
+## [1.0.0-rc5] - 2026-10-28
 
 ### Added
 - **Zero-Copy Record Metadata (`RecordMeta`)**: Added an immutable, `Arc`-shared `RecordMeta` structure (`topic`, `source`, `custom`) to `StreamRecord`. Metadata passes through SQL projection pipelines and multi-port graph stages with zero map allocations and constant time ($O(1)$) overhead. Added zero-copy `meta()` SQL function with backward-compatible `__meta__` and JSON envelope fallback.
@@ -24,6 +24,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Fleet Control Plane ("Rekuiper Manager")**: Added device fleet catalog (`/api/v1/fleet/devices`) and group management (`/api/v1/fleet/groups`). Added staged canary rollout engine (`/api/v1/fleet/rollouts`) supporting progressive rollout stages (5% -> 25% -> 100%) and automatic canary rollback. Added remote Yamux proxy (`/fleet/proxy/:device_id/*path`), unified audit logging (`/api/v1/fleet/audit`), and fleet control dashboard in `/ui`.
 - **Fleet Provisioning and Bearer Authentication**: Added token validation (`BasicConfig.fleet_token`, `REKUIPER_FLEET_TOKEN`) for `/fleet/ws` and `/api/v1/fleet/*` endpoints. Rejects unauthorized registrations, proxy requests, and rollout commands with HTTP 401 Unauthorized.
 - **Model Context Protocol (`rekuiper-mcp`) Expansion**: Expanded the native MCP server to 57 tools with dedicated categories for Fleet Management (`list_fleet_devices`, `get_fleet_rollouts`, `trigger_fleet_rollout`, `list_fleet_snapshots`, `proxy_fleet_device_api`) and Visual Stream Studio & Wire-Tap (`get_studio_palette`, `validate_graph_rule`, `toggle_wire_tap`, `get_wire_tap_status`). Added 3 new MCP live resources (`rekuiper://fleet/devices`, `rekuiper://fleet/rollouts`, `rekuiper://studio/palette`) and 2 interactive orchestration prompts (`staged_fleet_rollout`, `design_visual_dag_pipeline`).
+- **WASM Fuel Metering and Instance Pooling**: Added deterministic instruction fuel metering (`DEFAULT_WASM_FUEL_BUDGET = 1,000,000`) to `WasmManager` (`wasmi::Config::consume_fuel(true)`), terminating runaway guest loops before they stall worker threads. Added lock-free `ArrayQueue<PooledInstance>` pooling (8 pre-instantiated instances per module) to eliminate per-event linear memory instantiation overhead.
+- **Fleet Control Plane KV Persistence and Non-Blocking Concurrency**: Added durable KV persistence across `fleet_devices`, `fleet_snapshots`, `fleet_rollouts`, and `fleet_audit` namespaces with automatic state restoration (`FleetControlPlane::restore_from_kv`). Refactored `dispatch_snapshot_to_cohort` and `trigger_rollback` to collect command channels under short synchronous locks and perform asynchronous I/O and KV persistence outside lock guards.
+
+### Security
+- **Supply-Chain & RustSec Advisory Remediation**: Upgraded `tokio` to `1.54.1` (remediating `RUSTSEC-2026-0386`), upgraded `zstd-sys` to `2.1.2+zstd.1.5.7` (remediating `RUSTSEC-2026-0410`), and upgraded direct `zstd` dependency in `rekuiper-sql` to `0.14.3` (`zstd-safe 8.2.0`, remediating `RUSTSEC-2026-0391`, `RUSTSEC-2026-0398`, and `RUSTSEC-2026-0403` with zero ignored advisories in downstream core crates).
+- **Conditional Route Mounting and Auth Middleware Hardening**: Mounted `/ui` and `/ui/ws` routes only when `basic.enable_ui` is enabled. Enforced `basic.authentication` RS256 JWT validation across `/ui`, `/v1/metrics`, `/v1/logs`, and `/v1/traces` (exempting only `/`, `/ping`, `/fleet/ws`, and `/api/v1/fleet/*` which enforce dedicated fleet bearer token checks).
+- **ConnectInfo Peer IP Enforcement and Configurable Prometheus Port**: Wired `into_make_service_with_connect_info::<SocketAddr>()` on both primary and secondary listeners so `ui_ip_allowlist` validates peer socket addresses reliably. Fixed standalone Prometheus exporter to bind to `config.basic.prometheus_port` instead of a hardcoded port.
+
+### Changed
+- **Verified Benchmark Results (2.46M+ EPS)**: Re-verified single-core `--release` throughput (`perf_throughput.rs`): **2,464,711 events/s** (`202.86 ms` for 500,000 records, zero-parse in-process SQL pipeline) and **1,141,417 events/s** (`438.05 ms` for 500,000 records, end-to-end JSON pipeline).
+- **Non-Blocking Host Metrics Cache & O(1) Ring Buffers**: Added a 500ms TTL cache for `sysinfo::System` CPU and memory refreshes on `GET /` and `GET /metrics`. Replaced `Vec::remove(0)` shifts with $O(1)$ `VecDeque::pop_front()` across `TraceSpan`, `RuleErrorBuffer`, and `JoinStreamState`.
+- **Modular Source Connectors & Documentation Visuals**: Extracted 2,533 lines of source connector actors into `crates/rekuiper-server/src/engine/sources.rs`. Added 14 architectural SVG diagrams across `docs/en_US/` and resolved all broken documentation links.
 
 ## [1.0.0-rc4] - 2026-10-16
 
@@ -143,7 +155,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Model Context Protocol (MCP) Server 2.0**: Added 4 new tools (`register_wasm_plugin`, `list_wasm_plugins`, `delete_wasm_plugin`, `validate_secrets`), 4 new resources (`rekuiper://plugins/wasm`, `rekuiper://schemas/rabbitmq`, `rekuiper://schemas/parquet`, `rekuiper://schemas/edgex`), 3 new prompts, and embedded offline support for vector similarity, array, and stateful analytics.
 
 ### Changed
-- **Documentation Standards**: Rewrote and aligned all technical documentation in `docs/en_US/` to the ASD-STE100 Simplified Technical English standard with complete VitePress static build validation.
+- **Documentation Standards**: Rewrote and aligned all technical documentation in `docs/en_US/` with complete VitePress static build validation.
 
 ### Packaging
 - Updated official Docker images to `ankurkrp/rekuiper:0.506-beta`.

Cargo.toml

@@ -14,7 +14,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "1.0.0-rc4"
+version = "1.0.0-rc5"
 edition = "2021"
 authors = ["I-Dacs Labs <measure@i-dacs.com>", "rekuiper contributors"]
 license = "MIT OR Apache-2.0"
@@ -67,13 +67,13 @@ boa_engine = "0.20"
 yamux = "0.13"
 
 # Internal crate dependencies
-rekuiper-core = { path = "crates/rekuiper-core", version = "1.0.0-rc4" }
-rekuiper-sql = { path = "crates/rekuiper-sql", version = "1.0.0-rc4" }
-rekuiper-conf = { path = "crates/rekuiper-conf", version = "1.0.0-rc4" }
-rekuiper-connectors = { path = "crates/rekuiper-connectors", version = "1.0.0-rc4" }
-rekuiper-server = { path = "crates/rekuiper-server", version = "1.0.0-rc4" }
-kuiperd = { path = "crates/kuiperd", version = "1.0.0-rc4" }
-rule-engine = { path = "crates/rule-engine", version = "1.0.0-rc4" }
+rekuiper-core = { path = "crates/rekuiper-core", version = "1.0.0-rc5" }
+rekuiper-sql = { path = "crates/rekuiper-sql", version = "1.0.0-rc5" }
+rekuiper-conf = { path = "crates/rekuiper-conf", version = "1.0.0-rc5" }
+rekuiper-connectors = { path = "crates/rekuiper-connectors", version = "1.0.0-rc5" }
+rekuiper-server = { path = "crates/rekuiper-server", version = "1.0.0-rc5" }
+kuiperd = { path = "crates/kuiperd", version = "1.0.0-rc5" }
+rule-engine = { path = "crates/rule-engine", version = "1.0.0-rc5" }
 
 [profile.release]
 opt-level = 3

Makefile

@@ -1,5 +1,5 @@
 BIN_DIR ?= bin
-VERSION ?= 1.0.0-rc4
+VERSION ?= 1.0.0-rc5
 
 .PHONY: all
 all: build

README.md

@@ -4,7 +4,7 @@
 
 rekuiper is a single-binary **MQTT rule engine** and **streaming SQL processor** written in **Rust**. It sits between your devices and your cloud—filtering, aggregating, and routing live telemetry over MQTT, Kafka, HTTP, Modbus, and OPC-UA on the gateway itself, so you send upstream only what matters.
 
-[![Release](https://img.shields.io/badge/release-v1.0.0--rc4-blue.svg)](https://github.com/Indus-Stack/rekuiper/releases)
+[![Release](https://img.shields.io/badge/release-v1.0.0--rc5-blue.svg)](https://github.com/Indus-Stack/rekuiper/releases)
 [![Rust CI](https://github.com/Indus-Stack/rekuiper/actions/workflows/ci.yml/badge.svg)](https://github.com/Indus-Stack/rekuiper/actions/workflows/ci.yml)
 [![License: MIT or Apache-2.0](https://img.shields.io/badge/license-MIT%20%2F%20Apache--2.0-yellow.svg)](LICENSE)
 [![Docker Pulls](https://img.shields.io/docker/pulls/indusstack/rekuiper?color=blue&logo=docker)](https://hub.docker.com/r/indusstack/rekuiper)
@@ -34,7 +34,7 @@ This demo needs only Docker. A built-in simulator makes the data.
 **1. Start the engine.**
 
 ```bash
-docker run -d --name rekuiper -p 9081:9081 indusstack/rekuiper:1.0.0-rc4
+docker run -d --name rekuiper -p 9081:9081 indusstack/rekuiper:1.0.0-rc5
 ```
 
 **2. Register simulated sensor readings, ten per second.**
@@ -128,12 +128,12 @@ All tests run in a container limited to one CPU core and 1 GiB of RAM.
 
 | Measure | Result | Tested on |
 | :--- | :--- | :--- |
-| End-to-end streaming SQL throughput | 1,085,885 events per second (460 ms for 500k records) | 1.0.0-rc4 |
-| Zero-parse in-process SQL pipeline | 2,207,367 events per second (226 ms for 500k records) | 1.0.0-rc4 |
+| End-to-end streaming SQL throughput | 1,141,417 events per second (438 ms for 500k records) | 1.0.0-rc5 |
+| Zero-parse in-process SQL pipeline | 2,464,711 events per second (203 ms for 500k records) | 1.0.0-rc5 |
 | Parallel rules on one stream | 1,000 rules, 500,000 evaluations per second | 0.505 |
 | MQTT rule throughput, single rule | 150,000 to 200,000 messages per second | 0.500 |
 | Heap memory under load | 4.4 to 10.2 MiB | 0.500 |
-| Footprint | One static Rust binary, about 30 MB | 1.0.0-rc4 |
+| Footprint | One static Rust binary, about 30 MB | 1.0.0-rc5 |
 
 Full method, hardware limits, and comparisons with eKuiper, Telegraf, and Redpanda Connect: [Benchmark Overview](docs/en_US/benchmarks/overview.md).
 
@@ -184,7 +184,7 @@ rekuiper implements the eKuiper REST API, SQL dialect, rule format, and `kuiper`
 
 | Method | Command or link |
 | :--- | :--- |
-| Docker | `docker run -d -p 9081:9081 indusstack/rekuiper:1.0.0-rc4` |
+| Docker | `docker run -d -p 9081:9081 indusstack/rekuiper:1.0.0-rc5` |
 | Docker Compose | `docker compose -f deploy/docker/docker-compose.yml up -d` |
 | Kubernetes | `helm install rekuiper deploy/chart/rekuiper` ([chart docs](deploy/chart/rekuiper/README.md)) |
 | Binaries | [Releases](https://github.com/Indus-Stack/rekuiper/releases) |