chore: prepare v2.5.0

Cargo.toml

@@ -53,7 +53,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "2.4.2"
+version = "2.5.0"
 edition = "2024"
 # Track the latest stable. We rely on let-chains, async-fn-in-trait HRTB
 # inference fixes (rustc#100013), and edition 2024. Bumping is non-breaking
@@ -136,13 +136,13 @@ subtle = "2.6.1"
 syn = { version = "2" }
 # Path-only doctest dependencies are omitted from published crates, avoiding an umbrella cycle.
 tako-rs = { path = "tako-rs" }
-tako-rs-core = { path = "tako-rs-core", version = "2.4.2" }
-tako-rs-extractors = { path = "tako-rs-extractors", version = "2.4.2" }
-tako-rs-macros = { path = "tako-rs-macros", version = "2.4.2" }
-tako-rs-plugins = { path = "tako-rs-plugins", version = "2.4.2" }
-tako-rs-server = { path = "tako-rs-server", version = "2.4.2" }
-tako-rs-server-pt = { path = "tako-rs-server-pt", version = "2.4.2" }
-tako-rs-streams = { path = "tako-rs-streams", version = "2.4.2" }
+tako-rs-core = { path = "tako-rs-core", version = "2.5.0" }
+tako-rs-extractors = { path = "tako-rs-extractors", version = "2.5.0" }
+tako-rs-macros = { path = "tako-rs-macros", version = "2.5.0" }
+tako-rs-plugins = { path = "tako-rs-plugins", version = "2.5.0" }
+tako-rs-server = { path = "tako-rs-server", version = "2.5.0" }
+tako-rs-server-pt = { path = "tako-rs-server-pt", version = "2.5.0" }
+tako-rs-streams = { path = "tako-rs-streams", version = "2.5.0" }
 thread_local = "1.1.10"
 tikv-jemallocator = "0.7.0"
 tokio = { version = "1.52.1", features = ["fs", "io-util", "macros", "net", "rt", "rt-multi-thread", "signal", "sync", "time"] }

README.md

@@ -24,7 +24,7 @@ Add these dependencies to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-tako-rs = "2.4"
+tako-rs = "2.5"
 tokio = { version = "1", features = ["macros", "net", "rt-multi-thread"] }
 ```
 
@@ -76,9 +76,11 @@ and integrations through [Cargo features](https://tako.rust-dd.com/docs/referenc
 See the [runtime compatibility guide](https://tako.rust-dd.com/docs/concepts/runtimes)
 for transport support on Tokio and Compio.
 
-Upgrading? 2.4 needs no code changes; its
-[migration guide](https://tako.rust-dd.com/docs/reference/migration-2-4) covers
-the core pinning default, the header deadline, and extractor entries. The
+Upgrading? 2.5 changes the WebSocket API, removes deprecated APIs, and wraps
+the raw multipart stream to enforce upload limits. Follow the
+[2.5 migration guide](https://tako.rust-dd.com/docs/reference/migration-2-5).
+The [2.4 migration guide](https://tako.rust-dd.com/docs/reference/migration-2-4)
+covers core pinning, the header deadline, and extractor entries. The
 [2.3 migration guide](https://tako.rust-dd.com/docs/reference/migration-2-3)
 covers the removed HTTP client, WebTransport, and gRPC changes, the
 [2.2 migration guide](https://tako.rust-dd.com/docs/reference/migration-2-2) the per-thread

docs/releases/2.5.0.md

@@ -0,0 +1,40 @@
+Tako 2.5 replaces tungstenite with a WebSocket engine shared by Tokio and Compio.
+All eight crates are versioned at 2.5.0 and require Rust 1.95 or newer.
+
+### Breaking changes
+
+- Replace `TakoWs` with `WebSocketUpgrade` and import message and error types
+  from `tako::ws`. On Compio, replace the `compio-ws` feature with `compio` and `ws`.
+- WebSocket `send()` buffers frames until the handler waits, the write buffer
+  fills, or `flush()` is called. Call `flush()` before continuing if a frame must
+  be written immediately. Sends from another task still write immediately.
+- Deprecated serving functions, `Router::state`, `set_state`, and other legacy
+  APIs are removed. Use the server builders and `Router::with_state`.
+- Raw multipart access now returns `MultipartFields` and `MultipartError`
+  instead of multer's types, so part-count and content-type limits also apply
+  when reading fields directly.
+
+The [migration guide](https://tako.rust-dd.com/docs/reference/migration-2-5)
+lists every removed API and its replacement, with WebSocket examples for both
+runtimes.
+
+### Fixes
+
+- WebSockets send a close frame when a handler returns with no socket handles
+  left, panics, or reaches its lifetime limit. Subprotocol negotiation handles
+  repeated header fields.
+- Multipart uploads enforce configured limits and timeouts, preserve returned
+  temporary files, and remove abandoned uploads.
+- Cookie extraction reads repeated headers; response cookie jars emit only
+  changed cookies. Accept negotiation respects `q=0`; ETag matching handles
+  repeated headers and commas inside quoted tags.
+- HMAC verification uses the configured timestamp header. CSRF path matching
+  respects path boundaries, and IP filters reject unknown clients when
+  configured to deny by default.
+- SSE timers run on Compio without a Tokio runtime. Filtered signal streams
+  recover after lagging behind.
+
+All 247 selected Autobahn cases pass on Tokio and Compio. Performance and
+compression groups are excluded.
+
+[Full diff](https://github.com/rust-dd/tako/compare/v2.4.2...v2.5.0)