> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Fastly Rust Compute@Edge changelog

## October 8, 2026

## 2.2.4

### Fixed

* JWT field names can contain dots
* Attempt to convert JWT values to strings

## October 5, 2026

## 2.2.3

### Added

* hard_block_custom_fn a runtime callback for HardBlock page customization

### Changed

* px_agentic_trust_mcp_endpoint_path accepts a list of regex

## August 20, 2026

## 2.2.2

### Fixed

* Issue with `enforced_request` logic

## August 7, 2026

## 2.2.1

### Fixed

* Improved processing of the Bypass Monitor header

## July 30, 2026

## 2.2.0

### Added

* Added enforced/monitored request callbacks, update example application
* Added `px_pxhd_domain` configuration

### Fixed

* Populate `custom_params` before Risk API call
* Correctly update SAPI/collector host names

## June 30, 2026

## 2.1.1

### Added

* Two additional fields to all async activities:
  * `s2s_call_reason`
  * `risk_mode`

### Changed

* Updated dependencies

## June 17, 2026

## 2.1.0

### Added

* \[Secret store] Load PX credentials from Fastly Secret Store so deployments can keep
  required secrets out of ConfigStore/KVStore. Secret values override
  configured keys when present, while missing secrets fall back to existing
  config and log errors.

* add documentation for all public PXContext getters

### Changed

* update fastly dependency to v0.13.0

## June 16, 2026

## 2.0.0

### Added

* \[MCP Protection / Agentic Trust] verify MCP requests and extract JSON-RPC metadata (method, tool name, tool argument keys, session id); config `px_agentic_trust_enabled`, `px_agentic_trust_mcp_endpoint_path`
* \[Credentials Intelligence] login credential extraction with breached-credential detection and login-success reporting; config `px_login_credentials_extraction_enabled`, `px_login_credentials_extraction`, `px_credentials_intelligence_version`, `px_compromised_credentials_header`, `px_additional_s2s_activity_*`, `px_login_successful_*`, callbacks `px_extract_credentials_fn` / `px_login_successful_fn`
* \[User Identifiers] extract app user id and extra fields from a JWT in a cookie or header; config `px_jwt_cookie_*` and `px_jwt_header_*`
* \[\_pxhd cookie] set the `_pxhd` risk cookie on responses; config `px_secured_pxhd_enabled` to add the `Secure` attribute
* \[Risk cookie hardening] configurable validation limits: `px_user_agent_max_length`, `px_risk_cookie_max_length`, `px_risk_cookie_min_iterations`, `px_risk_cookie_max_iterations`
* \[Remote configuration] KV Store backend (`kv_store` cargo feature) and runtime config updates via `update_from_json` (initial support, used by e2e testing)
* \[Hard block page] new `block_page_hard_block.tmpl` template and block/rate-limit template updates
* \[Cookie V2 / Mobile SDK] add V2 cookie validation and mobile SDK token (original-token) support; config `px_token_version` (V2/V3)
* \[E2E testing harness] new `e2e_testing` application for testing Enforcer code
* \[CI workflows] auto changelog update, example-compilation check, and cargo-tests workflows
* \[Test suites] new config and credentials-intelligence integration tests

### Changed

* \[Split backends/hosts] separate Fastly backend per HUMAN service: `human_sapi`, `human_collector`, `human_client`, `human_captcha`
* \[Config] large `pxconfig` refactor: serde-based deserialization, typed `PXConfigKey` with sensitive/static/local classification, documented `px_*` fields
* \[Telemetry] improve support for Telemetry command
* \[Client IP extraction] improved real-client-IP resolution from trusted `px_ip_headers`
* \[Enforcer] enforcement-flow fixes and improvements
* \[Dependencies] add `strum`/`strum_macros`, bump `regex`/`uuid`, update project metadata
* renamed `px_filter_by_method` to `px_filter_by_http_method`
* public getters/fields renamed (`whitelist_*` -> `filter_by_*`)

## June 1, 2026

## v1.2.9

### Added

* support for APQ-style GraphQL queries
* support for GraphQL keywords extraction
* new configuration: px_graphql_keywords

## May 28, 2026

## v1.2.8

### Added

* support for px_custom_cookie_header configuration (default is "x-px-cookies")

### Changed

* update fastly dependency to v0.12.1

## May 7, 2026

## Version 1.2.7

### Changed

* Fix `is_sensitive_request_fn` callback overwriting prior sensitivity detection from `sensitive_routes` configuration and GraphQL inspection. The callback's result is now OR-ed with the existing value, so it can only escalate (never demote) a request's sensitivity.

## April 30, 2026

## Version 1.2.6

### Added

* `px_graphql_body_max_length` configuration to set GraphQL max body length
* Included missing fields in all activities

### Fixed

* Optimized processing of GraphQL requests with large bodies

## April 24, 2026

## Version 1.2.5

### Added

* CORS support configurations:
  -`px_cors_support_enabled`
  -`px_cors_preflight_request_filter_enabled`
* Callback functions:
  -`cors_custom_preflight_handler_fn()`
  -`cors_create_custom_block_response_headers_fn()`

### Changed

* Updated dependencies

## March 10, 2026

## Version 1.2.4

### Added

* Implemented **Access Cookie** feature, which adds support for extracting the `_pxac` cookie (or custom cookies defined in `px_extracted_cookies`)

## September 17, 2025

## Version 1.2.3

### Changed

* Updated to Fastly v1.11.5 (due to a bug in Fastly v1.11.6)

## Version 1.2.2

### Added

* Support for data enrichment feature
* `px_data_enrichment_header_name` configuration
* `additional_activity_handler` callback function to be executed after sending `page_requested` or `block` activity to the collector
* Support for `pxcts` cookie

### Changed

* Updated dependencies
* Updated documentation
* Updated example code

## September 11, 2025

## Version 1.2.1

### Added

* `is_filtered_request` callback function to filter out requests that should not be verified by Enforcer
* `px.set_module_mode()` to change module mode at runtime

## Version 1.2.0

### Added

* `is_sensitive_request` callback function to identify sensitive requests

### Changed

* Hid Enforcer internal API
* Allowed read-only access to `PXConfig`, `PXContext`, and `PXEnforcer` members using getters

## August 11, 2025

## Version 1.1.7

### Added

* Support for HEAD requests for First Party paths

## November 28, 2024

## Version 1.1.6

### Added

* Support for `request_id` feature

### Changed

* Updated Fastly dependencies to v1.11

## September 26, 2024

## Version 1.1.5

### Changed

* Logging reworked. It now uses `Level::Info` level
* Do not call `log::set_max_level()`, to avoid "panic!" in the application
* `wasm32-wasi` target was renamed to `wasm32-wasip1`

## September 4, 2024

## Version 1.1.4

### Fixed

* Blocking logic for V3 cookies

_Showing the 20 most recent of 24 entries. Append `/llms.txt` to the changelog URL for the complete index._