What loco-rs/loco shipped
Written by FoxPlug from the repository's own releases; not affiliated with Loco. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/loco-rs/loco; Loco did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- The 1.3.0 release cuts what a generated app compiles significantly. Release
- Auth gains server-side sessions with database or Redis storage and a remember-me rotating token. Pull request #1896
- Version 1.3.1 fixes SQLite apps that could fail to boot with PoolTimedOut. Release
- SQLite gets production pragma defaults and a database-backed cache option. Pull request #1891
- The default storage driver can now be set in config YAML instead of wired by hand. Pull request #1840
- Native scheduler tasks run without a shell, fixing images without a shell and paths with spaces. Pull request #1887
- Small fixes include a fallback page hint,
or_erron Result and Option, and raw task args; Vars is nownon_exhaustive. Pull request #1892 - A dev-dependency advisory for an unmaintained crate is ignored with a reason. Pull request #1901
- A 1.3.0 announcement post and missed changelog entries cover OAuth sign-in and contributor fixes. Pull request #1898
Why it matters
This week brings a broad release with server-side sessions, SQLite improvements and a smaller compile footprint for generated apps. The 1.3.1 patch fixes a boot timeout that could affect SQLite apps. Config and scheduler changes make storage and native tasks easier to set up.
Changelog entry
- Release 1.3.0 with reduced build work for generated apps. Release
- Version bump to 1.3.0 and CHANGELOG. Pull request #1897
- Auth: server-side sessions in database or Redis with revocation and remember me. Pull request #1896
- SQLite: per-connection pragmas by default and cache.kind Database option. Pull request #1891
- Config: storage driver selectable via YAML, defaulting to Null. Pull request #1840
- Scheduler: native jobs run directly without a shell. Pull request #1887
- Fixes: fallback hint,
or_erron Result and Option, raw task args; Vars isnon_exhaustive. Pull request #1892 - Fix SQLite boot timeout and release 1.3.1. Pull request #1899
- Release 1.3.1 fixing PoolTimedOut on SQLite boot. Release
- Ignore RUSTSEC-2026-0440 for astral-tokio-tar with a reason. Pull request #1901
- Add 1.3.0 announcement post and changelog entries. Pull request #1898
Loco 1.3.0 is out: adjusted generated apps with less compiler work, server-side sessions with database or Redis, production SQLite pragmas and a database cache. 1.3.1 follows with a fix for SQLite boot timeouts on a locked file.
Loco 1.3.0 is released. Generated apps now do 31% less compiler work on a SQLite app with auth, workers and mail, and the first cargo test does 34% less. Auth adds server-side sessions with database or Redis storage and a remember-me token. SQLite gets production pragma defaults and a database-backed cache, the storage driver can be set in YAML, and native scheduler tasks run without a shell. Version 1.3.1 fixes SQLite apps that could fail to boot with PoolTimedOut when opening a connection waited on another connection's lock.
Week of October 19, 2026
What shipped
- OAuth2 sign-in, signed cookies and CurrentUser extractors are added as three opt-in auth features. Pull request #1884
- Postgres and SQLite queues gain unique jobs, retries with backoff and heartbeats. Pull request #1862
- New db-postgres, compression and generators features let slim builds skip unused dependencies, and generated apps compile one database driver. Pull request #1876
- Local and in-memory storage drivers are now native, with OpenDAL only behind a feature for cloud backends. Pull request #1870
- The InMem cache driver now keeps entries in a native map with expiry and least-recently-used eviction instead of moka. Pull request #1874
- HS256/384/512 JWTs are signed and verified natively, dropping jsonwebtoken and its RSA advisory from the auth path. Pull request #1867
- The scheduler parses cron natively and runs on a plain tokio loop, dropping tokio-cron-scheduler. Pull request #1866
- The opendal HTTP transport is installed for S3, Azure and GCS storage, fixing those backends. Pull request #1881
- The fallback middleware now answers with the configured status code instead of 200. Pull request #1882
- New Postgres apps get corrected queue database and pool defaults in their generated config. Pull request #1863
Why it matters
This week trims what apps compile: six dependency stacks were replaced or made optional, from the cache driver and JWT signing to cron parsing and storage. Teams on SQL queues also get unique jobs, retries with backoff and heartbeats, and anyone using S3, Azure or GCS storage gets a fix for backends that failed on the current release.
Changelog entry
- Feat(auth): OAuth2 sign-in, signed cookies and CurrentUser extractors as opt-in features Pull request #1884
- Feat(bgworker): unique jobs, retries with backoff and heartbeats for SQL queues Pull request #1862
- Feat: db-postgres, compression and generators features; generated apps compile one database driver Pull request #1876
- Perf(storage): native local and in-memory drivers; OpenDAL only for cloud backends Pull request #1870
- Perf(cache): native in-memory cache, dropping moka Pull request #1874
- Perf(auth): sign and verify HS JWTs natively, dropping jsonwebtoken Pull request #1867
- Perf(scheduler): native cron parsing and a tokio loop, dropping tokio-cron-scheduler Pull request #1866
- Perf: parse and format byte sizes natively, dropping byte-unit Pull request #1873
- Fix(storage): install opendal HTTP transport for S3, Azure and GCS Pull request #1881
- Fix(middleware): fallback.file answers with the configured code Pull request #1882
- Fix(loco-new): Postgres queue and pool defaults in new apps Pull request #1863
- Perf: compile the default server and logger once in Loco, not in every app Pull request #1875
This week: OAuth2 sign-in, signed cookies and CurrentUser as opt-in features. Unique jobs, retries with backoff and heartbeats for Postgres and SQLite queues. Native cache, JWT, cron and storage drivers, and new features so slim apps skip unused dependencies.
This week in Loco: OAuth2 sign-in, signed cookies and CurrentUser extractors land as three opt-in auth features. Postgres and SQLite queues gain unique jobs, retries with backoff and heartbeats. Several dependency stacks were replaced or made optional: the in-memory cache, HS JWT signing, cron parsing, byte-size parsing, local and in-memory storage, and argon2 all avoid pulling in crates apps do not need. Storage backends on S3, Azure and GCS get a fix for the missing HTTP transport, the fallback middleware now answers with its configured status code, and new apps get corrected Postgres queue and pool defaults.
Week of September 21, 2026
What shipped
- Loco 1.2.0 released with row-level multi-tenancy, presigned storage URLs, Tera components, Postgres-only builds, and fixes to app generation. Release
- Added opt-in multi-tenancy feature with TenantEntity declarations and TenantQueryExt::in_tenant for scoping Sea-ORM queries. Pull request #1824
- Storage layer now supports presigned URLs via StoreDriver::presign_get and
presign_putfor direct client uploads and downloads. Pull request #1827 - TeraView gained
render_componentmethod to render individual Tera v2 components without rendering entire pages. Pull request #1822 - Db-sqlite is now an optional feature, allowing Postgres-only apps to compile without SQLite dependencies and reduce build time. Pull request #1828
- Background worker Redis connections now survive slow or dropped connections instead of silently losing queued jobs. Pull request #1831
Why it matters
Loco 1.2.0 brings production-ready multi-tenancy support for applications serving multiple organizations, adds presigned URLs for scalable file handling, and reduces compilation overhead for Postgres-focused deployments. Several reliability fixes address failure modes in background workers that were previously hidden from monitoring.
Changelog entry
- Release Loco 1.2.0 Release
- Add opt-in multi-tenancy feature with TenantEntity and TenantQueryExt::in_tenant Pull request #1824
- Add
presign_getandpresign_putto StoreDriver for presigned URLs Pull request #1827 - Add
render_componentmethod to TeraView Pull request #1822 - Make db-sqlite an optional feature, on by default Pull request #1828
- Fix background worker to survive slow or dropped Redis connections Pull request #1831
Loco 1.2.0 ships row-level multi-tenancy, presigned storage URLs, Tera components, Postgres-only builds, and background worker reliability fixes.
Loco 1.2.0 is out. Multi-tenancy at the query level lets you scale applications serving many organizations. Presigned URLs enable direct client uploads. Postgres-only builds skip SQLite entirely. Background workers survive connection failures. Plus Tera components and dozens of app generation fixes.
More from loco-rs/loco on GitHub
Merged pull requests
- Loco 1.2.0 (#1835, merged September 24, 2026 by jondot) (source)
- Add tenant query scoping and a full-stack multitenancy example (#1824, merged September 24, 2026 by shuvroroy) (source)
- Add
render_componentto TeraView. (#1822, merged September 22, 2026 by schungx) (source) - fix(bgworker/redis): survive a slow or dropped worker connection (#1831, merged September 22, 2026 by mikosco4real) (source)
- feat: optional db-sqlite feature for Postgres-only compile paths (#1828, merged September 22, 2026 by robertazzopardi) (source)
- feat(storage): add presign_get/presign_put to StoreDriver (#1827, merged September 22, 2026 by robertazzopardi) (source)
- docs: modernize "the tour" applying new code style (#1829, merged September 16, 2026 by Data5tream) (source)
- feat(bgworker):
perform_all_laterbatch job enqueueing (#1821, merged September 16, 2026 by mccormickt) (source) - docs(readme): add Indonesian translation (#1823, merged September 8, 2026 by Yoruxyv) (source)
- ci: pin the toolchain, and stop style from hiding test results (#1825, merged September 8, 2026 by jondot) (source)
- feat(website): "and AI agents" note on the hero (#1819, merged August 19, 2026 by jondot) (source)
- docs(blog): 1.1.0 release announcement (#1816, merged August 19, 2026 by jondot) (source)