WeAmp.PageSpeed 2.0.32

• net10.0

  • WeAmp.PageSpeed.NativeAssets.Linux (>= 2.0.32)
  • WeAmp.PageSpeed.NativeAssets.macOS (>= 2.0.32)
  • WeAmp.PageSpeed.NativeAssets.Windows (>= 2.0.32)

• net8.0

  • WeAmp.PageSpeed.NativeAssets.Linux (>= 2.0.32)
  • WeAmp.PageSpeed.NativeAssets.macOS (>= 2.0.32)
  • WeAmp.PageSpeed.NativeAssets.Windows (>= 2.0.32)

2.0.32: Security hardening for the shipped native library. The optimizer `.so` is now built with full RELRO, immediate binding (`BIND_NOW`), stack-smashing protection, and `FORTIFY_SOURCE`, and a release-time assertion fails the build if any of these protections are missing (MPS2-SEC-05). The bundled image codecs (libavif, libaom, libyuv) are updated to pick up upstream CVE fixes. There are no API, wire, or configuration changes.
2.0.30: The image optimizer no longer strips Content Credentials (C2PA) during optimization (ADR-081). Recompression previously dropped the APP11/JUMBF manifest. Now JPEG-to-JPEG recompression carries it through, and the other paths (AVIF, WebP, viewport resize, PNG, XMP) serve the original bytes unchanged when a manifest is present rather than stripping it. This manifest-preserving behavior is on by default. An additional opt-in flag, `--c2pa-carry`, re-splices a PNG's provenance chunks after recompression, so a manifest-bearing PNG can stay both optimized and signed rather than served in its original form. Several worker correctness fixes. The FastSpring storefront validator rejected every value because of an off-by-one in its suffix comparison, leaving `--fastspring-storefront` and the matching config field inert; the comparison now uses an explicit `.onfastspring.com` suffix match. Critical-CSS extraction now keeps rules scoped by `:where()` and `:is()` (and rules where such a wrapper follows another pseudo-class), which previously dropped Tailwind v4 dark-mode utilities and produced a light-mode flash on dark sites. HEAD requests to `/console/` and `/v1/` endpoints now follow the same read-open authorization as GET when `PAGESPEED_API_READ_OPEN=true`, so HEAD-based monitoring probes no longer get a false 401. The "JS minification had parse errors" warning is now logged once per resource instead of on every cache refresh of a permanently unparseable file. Two concurrency-safety fixes in the worker make license-renewal shutdown deterministic and the lag timer race-free. SVG serve counts are now recorded at serve time through the shared serve-stats store, so `pagespeed_svg_served_total` and `/v1/stats` svg.served report real numbers. In the supporting libraries, the width-to-viewport C-ABI used by .NET P/Invoke now classifies the 1024–1279px band as Tablet, matching the engine's own viewport range at the 1280 split. The markdown extractor used for agent feeds now escapes a leading block marker on a list item's first line, closing a path that could forge markdown structure (headings, quotes, tables) into the output. ASP.NET Core middleware: when the default cache path is not writable, the middleware now raises an actionable error naming the path and the setting to change, instead of an opaque permission failure, and the getting-started docs show a writable cache path for local `dotnet run`. The .NET `RevalidationRequired` flag no longer aliases the worker-processed bit, so aggressive cache mode again emits `stale-if-error` (rather than `must-revalidate`) on optimized assets. The sample apps now target net8.0 and net10.0. The nginx front-end no longer re-notifies the worker on cache hits of worker-vectorized SVG variants, removing redundant IPC on every such hit, and the Docker nginx entrypoint self-heals cache-directory ownership on start, so a UID change across image rebuilds no longer breaks the `/analyze` PSI cache. This release also includes internal code-quality refactors with no behavior change and dependency bumps clearing flagged CVEs.
2.0.29: The PageSpeed console's URL list (`/console/urls`) and the `/v1/cache/urls` management API no longer time out. The listing handler computed each row's alternate count by walking that URL's Cyclone chain on the worker's single event-loop thread — roughly 0.3–0.7 s of cold-cache I/O per URL, so a 50-row page took 22–44 s and, because the management API and health checks share that thread, blocked `/v1/health` for the duration. The count is now kept in the in-memory URL registry, refreshed on the worker pool thread whenever a notification (or the asynchronous agent-markdown write) changes a URL's alternates, so the listing is a pure in-memory read with no per-row cache traversal. The JSON response is unchanged. Release builds now stamp the commit they were built from. The `gen_build_commit` step could be served a cached build-commit header from the shared build cache, producing a binary that reported a stale commit in `--version` and `/v1/health`; it is no longer cached, so the embedded commit always matches the source.
2.0.28: Async-CSS gains a cold-cache fail-safe (ADR-096) that fixes a flash-of-unstyled-content regression on low-traffic sites: when an external stylesheet is not yet cached the gate keeps it render-blocking and inlines critical CSS instead of async-deferring an unmeasured sheet, re-enabling async automatically once the sheet caches; the in-process ASP.NET Core path gained the same gate. Critical CSS is no longer double-shipped on multi-variant pages (the render-blocking external link is removed by a parser-driven rewriter and the extractor de-duplicates), and the critical-CSS element-tree cutoff no longer flaps. The agent_optimize markdown variant survives an unchanged-origin cache refresh and improves for citation (entity decoding in code spans, UTF-8-safe metadata, fenced-code languages). The Helm chart collapses the worker and nginx image tags into one lockstep tag defaulting to appVersion. No breaking public API change versus 2.0.27.
2.0.27: Cache-churn, console-accuracy, critical-CSS budget, markdown-variant and JS-minifier correctness fixes diagnosed from the worker admin console. The full-page cache content-hash dedup sentinel no longer self-purges a key by re-hashing the worker's own read of the identity slot (it guards on the worker-processed flag and stamps a durable raw-origin hash in the existing v7 metadata field, no wire/ABI change), so the homepage and the agent_optimize markdown variant stop churning. The agent_optimize markdown variant is now served (the origin-refresh rebuild no longer drops the agent request), and its quality improves for citation: entities decoded before structural escaping (non-ASCII preserved, raw fallback + UTF-8 validation), YAML front-matter with title/metadata, and page-level chrome stripped while in-article headers are kept. Critical-CSS inlining is budgeted by a single three-band coverage policy (ADR-096): below 10% coverage the sheet stays render-blocking and the critical subset is inlined; 10-60% inlines and async-defers; at or above 60% both are skipped, stopping the near-whole-sheet double-ship on Tailwind-like profiles. New /v1/stats counters (critical_css_skipped_high_coverage, async_css_suppressed_low_coverage) plus the previously-dead policy.* counters. The async-CSS loader is served at a content-hashed immutable path (/pagespeed_static/async_css.<hash>.js) by both front-ends (ADR-094 follow-up). The JS minifier tokenizer learned arrow-block bodies, optional catch bindings and optional chaining, so modern bundles minify instead of falling back. No breaking public API change versus 2.0.26.
2.0.26: CSP-safe async-CSS loading and honest console bandwidth reporting. Render-blocking stylesheets are deferred (switched to media=print and restored once loaded) by a same-origin external loader served at /pagespeed_static/async_css.js by both the nginx module and the in-process .NET middleware; it uses no inline onload handler, so it works under a script-src 'self' Content-Security-Policy, and a noscript fallback preserves integrity/crossorigin for clients without JavaScript. The inlined critical CSS now improves first paint instead of adding duplicate bytes for no benefit. The worker admin console clamps the dashboard bandwidth-saved headline to zero and discloses when an optimization trades payload for faster paint, rather than showing a negative figure. Additive C ABI: new ps_async_css_loader_path()/ps_async_css_loader_js() getters and an enable_async_css field appended to ps_html_config_t with existing offsets preserved; the native library, nginx module and .NET middleware move in lockstep. On by default in the worker when critical CSS is present; opt-in via EnableAsyncCss in the middleware. See ADR-094. No breaking public API change versus 2.0.25.
2.0.25: Follow-up correctness fix for the agent_optimize markdown variant. The async browser-analysis pass re-read the page HTML from cache; for larger pages the cache slot could be overwritten or purged before the pass ran ("HTML not in cache"), so the markdown variant failed to render and the page fell back to HTML. The worker now passes the raw origin HTML it already holds into the analysis queue (cache re-read kept as fallback), aligning the render source with the content hash the variant is bound to. Companion to 2.0.24. No breaking public API change versus 2.0.24.
2.0.24: Correctness fix for browser-analysis-driven optimization. A degraded browser-analysis pass (headless-Chrome first-contentful-paint CSS coverage over-reporting near-total criticality) could overwrite a good cached optimization profile, inlining the entire stylesheet instead of a critical subset and suppressing the agent_optimize markdown variant for the affected page. The worker now keeps the prior good profile when a pass looks degraded (near-total coverage) while still rendering markdown, and re-analyzes degraded first-seen profiles. No breaking public API change versus 2.0.23.
2.0.23: Correctness release. The full-page cache no longer serves entries past TTL expiry (expired entries revalidate; bounded stale-if-error fallback via the new pagespeed_stale_if_error_max_age directive), and purges are fenced against in-flight optimization writes so a purge can no longer be silently undone. Optimizer fixes: no JavaScript variants from unparseable sources, @import layer()/supports() preserved instead of flattened, SRI-pinned (integrity=) subresources left untouched, and modern-phone DPR detection with correct image Vary. No breaking public API change versus 2.0.22.
2.0.22: Per-site licensing support (ADR-092). License tokens gain optional scope and domain fields (v5), carried and displayed across the worker, middleware and workbench; scope never affects token verification — the software never locks you out. Telemetry reports by scope. The workbench purchase flow points at the per-site Business plan; plans and pricing at https://modpagespeed.com/pricing/. Shipped container images are rebuilt with full CVE remediation (0 Critical / 0 High across worker, nginx and combined). No breaking public API change versus 2.0.21.
2.0.21: Package polish. The README is rewritten for accuracy and clarity — the per-resource optimized-variant ceiling is corrected to 36 (format x viewport x density x Save-Data), the security example points at the real auth-exempt /v1/license/apply endpoint instead of the removed trial endpoint, and the ASP.NET Core options are regrouped into Top-level/Cache/Worker/Console tables. The package Title and Description are tightened (the retired 14-day-trial line is removed). Build hardening: EnableSourceControlManagerQueries=false + IncludeRepositoryUrlInNuspec=false so the private source repository's commit SHA cannot be re-injected into the package's repository metadata. No middleware or worker code change versus 2.0.20.
2.0.19: Documentation alignment with the always-functional licensing model — the README now states that optimization runs out of the box, unlicensed responses carry X-PageSpeed-Warn: unlicensed, and production use requires a commercial license (the software never locks you out). The 14-day trial is retired; subscriptions are billed immediately. Docs-only; no middleware or worker code change versus 2.0.18.
2.0.18: Product enhancements and changes around license handling. See the release notes at https://modpagespeed.com/.
2.0.17: Various bug fixes and enhancements. No public API change versus 2.0.16.
2.0.16: README clarity — the on-NuGet docs now state up front that the middleware is a no-op until you activate a trial or license (requests pass through unchanged), removing the apparent contradiction with the "optimization on out of the box" wording. Docs-only; no middleware or worker code change versus 2.0.15.
2.0.14: trial-experience fix. Worker.SocketPath now defaults to an auto-resolved per-process socket when Worker.AutoStart is true (its default), so AddPageSpeed() + UsePageSpeed() optimizes out of the box — previously the default was null, which silently disabled worker coordination and left notifications.received, variants.written, and every Dashboard/Savings/Metrics counter at zero. Set SocketPath to null/empty to deliberately disable coordination (now logs a startup warning); set a concrete path for an out-of-process worker. Reference samples no longer ship the "demo mode" SocketPath=null. Docs/README/FAQ clarify that 2.0 does not rewrite URLs — optimized image variants are served at the original URL via content negotiation (Vary: Accept). No breaking API change.
2.0.13: the embedded /console/ now reaches all of its data pages in the in-process middleware sample — Dashboard, Configuration, URLs, Savings, and Metrics proxy /v1/cache, /v1/stats, /v1/capture, and /v1/config through to the worker (previously only License and Health were wired, so those pages 404'd outside the Docker demo). The worker now reports its real version on /v1/health, generated from VERSION.txt at build time (it had been pinned at 2.0.7 since that release). Release-pipeline reliability fixes; no public API change.
2.0.7: NuGet page + build-metadata polish — README now points readers at https://modpagespeed.com/pricing/ (three visible CTAs in lead, trial step, and Links). CI builds set Deterministic + ContinuousIntegrationBuild, so nuget.info's deterministic + compiler-flags health checks go green and shipped PDBs no longer embed local source paths. No middleware/worker code change vs 2.0.6.
2.0.6: republish 2.0.5 with worker version string corrected — kPageSpeedVersion was stale at 2.0.4 in 2.0.5, so /v1/health and heartbeat telemetry mis-reported the install version on every install. Pinned via a new VersionInvariantTests case that checks version.h, Directory.Build.props, and VERSION.txt agree on every PR.
2.0.5: hotfix — trial + paid activation now work on a stock install. The middleware was not wiring the upstream license-service URL into the worker; new WorkerOptions.LicenseRenewalUrl (default https://api.modpagespeed.com/) closes that gap. License-service allow-list updated in lockstep to accept the NuGet middleware's server=aspnetcore identifier (was silently 400'd by the prod license service since #377).
2.0.4: workbench /console/ now served by the middleware out of the box — trial activation no longer requires Worker.ApiPort. NOTICE + THIRD-PARTY-NOTICES are now packed.
2.0.3: hotfix linux-x64 GLIBC_2.38 baseline; 2.0.2 unlisted.
2.0.2: Linux native binaries statically link libc++/libc++abi/libunwind — dotnet add + dotnet run works end-to-end.
2.0.1: single-package install (NativeAssets pulled transitively).
2.0.0: General Availability. Microsoft Trusted Signing + nuget.org Trusted Publishing.