> See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
#### New since `v3.1.3`
* [#144] [New] Add `org.joda.time.DateTime` to `default-thaw-serializable-allowlist` (@slipset)
> See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
#### New since `v3.1.3`
* [#144] [New] Add `org.joda.time.DateTime` to `default-thaw-serializable-allowlist` (@slipset)
> See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
> See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
> This is a non-breaking, bugfix release. But please note that large keywords or symbols (with >127 characters) frozen with >=`v3.1.1` will need >=`v3.1.1` to thaw.
#### Fixes since `v3.1.0`
* Large keywords and symbols (with >127 characters) can now thaw without throwing (@danmason).
[1] Keywords or symbols with >127 characters in their name
> This release is focused on smoothing out rough edges left by `CVE-2020-24164` [#130], and to **ease transition** from versions of Nippy < `v2.15.0 final`.
> See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
Note that there's **separate details** below for upgrading from `v2.15` vs `v2.14`:
Usually a non-breaking drop-in replacement, but there's some changes you might like to take advantage of. See [#130] for **detailed upgrade instructions**.
#### Changes
- **[BREAKING]** Bumped minimum Clojure version from `v1.5` to `v1.7`.
- **[BREAKING]** `:nippy/unthawable` responses now have a standardized form: `{:nippy/unthawable {:type _ :cause _ ...}`. Most folks won't care about this change unless they have code specifically to deal with `:nippy/unthawable` responses.
- [Deprecated] `*serializable-whitelist*` has been split into two separate vars: `*freeze-serializable-allowlist*`, `*thaw-serializable-allowlist`*. See [#130] for details.
- By default, `freeze` now **allows** the use of Java's Serializable for **any** class. `thaw` continues to be restrictive by default, and will quarantine any objects not on the class allowlist. See [#130] for details.
#### New
- [#122] Option to disable freezing and/or thawing of metadata.
-`freeze` and `thaw` now support opts: `:serializable-allowlist`, `:incl-metadata?`.
- New `read-quarantined-serializable-object-unsafe!` util to read quarantined Serializable objects. See [API docs](http://ptaoussanis.github.io/nippy/taoensso.nippy.html#var-read-quarantined-serializable-object-unsafe.21) and/or [#130] for details.
- Add `allow-and-record-any-serializable-class-unsafe` util. See [API docs](http://ptaoussanis.github.io/nippy/taoensso.nippy.html#var-allow-and-record-any-serializable-class-unsafe) and/or [#130] for details.
Likely breaking. Please see [#130] for **detailed upgrade instructions**.
#### Changes
- **[BREAKING]** Bumped minimum Clojure version from `v1.5` to `v1.7`.
- **[BREAKING]** [#130] `thaw` will now quarantine Serializable objects whose class is not allowed by `*thaw-serializable-allowlist*`. See [#130] for details.
- **[BREAKING]** `:nippy/unthawable` responses now have a standardized form: `{:nippy/unthawable {:type _ :cause _ ...}`. Most folks won't care about this change unless you have code specifically to deal with `:nippy/unthawable` responses.
- [#101] Switch default encryptor from `AES-CBC` to `AES-GCM` (faster, includes integrity check)
> See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
> This release is focused on smoothing out rough edges left by `CVE-2020-24164` [#130], and to **ease transition** from version of Nippy < `v2.15.0` final.
> Apologies for the recent breaking changes!
Note that there's separate documentation below if upgrading from `v2.15` or `v2.14`:
- **[BREAKING]** Bumped minimum Clojure version from `v1.5` to `v1.7`.
- **[BREAKING]** `*serializable-whitelist*` has been split into two separate vars: `*freeze-serializable-allowlist*`, `*thaw-serializable-allowlist`*. See [#130] for details.
- **[BREAKING]** `:nippy/unthawable` responses now have a standardized form: `{:nippy/unthawable {:type _ :cause _ ...}`. Most folks won't care about this change unless you have code specifically to deal with `:nippy/unthawable` responses.
- By default, `freeze` now allows the use of Java's Serializable for any class. `thaw` continues to be restrictive by default, and will quarantine any objects not on the class allowlist. See [#130] for details.
- **[BREAKING]** [#130] `thaw` will now quarantine Serializable objects whose class is not allowed by `*thaw-serializable-allowlist*`. See [#130] for details.
- **[BREAKING]** Bumped minimum Clojure version from `v1.5` to `v1.7`.
- **[BREAKING]** `:nippy/unthawable` responses now have a standardized form: `{:nippy/unthawable {:type _ :cause _ ...}`. Most folks won't care about this change unless you have code specifically to deal with `:nippy/unthawable` responses.
- [#101] Switch default encryptor from `AES-CBC` to `AES-GCM` (faster, includes integrity check)
> Non-breaking release. See [here](https://github.com/ptaoussanis/encore#recommended-steps-after-any-significant-dependency-update) for recommended steps when updating any Clojure/Script dependencies.
> This is a **major release** that **may** involve some **breaking API changes** in rare cases for users of some low-level or obscure features that have been made private or removed. If your code compiles with this new version of Nippy, you should be fine.
> As with all Nippy releases: this version can read data written by older versions but older versions may not be able to read data written by _this_ version.
> No changes since `2.12.0-RC2`
> Changes since `2.11.1`:
* **BREAKING**: dropped support for `*final-freeze-fallback*` (rarely used)
* **BREAKING**: dropped support for `*default-freeze-compressor-selector*` (rarely used)
* **BREAKING**: made several implementation details private, incl. most low-level `write-<x>` and `read-<x>` fns (rarely used)
* **Performance**: several significant speed + space efficiency improvements, including more variable-sized types
* **New built-in types** (these previously fell back to the reader): regex patterns, symbols
* **New experimental caching feature** (please see `cache` docstring for details)
* **New**: `fast-freeze`, `fast-thaw` utils (please see docstrings for details)
* **Change**: `freeze` return val is no longer auto type hinted as `^bytes` (had a performance cost, rarely used)
* **Hotfix**: `fn?`s were incorrectly reporting true for `serializable?`
* **Hotfix**: *final-freeze-fallback* back compatibility was broken
> This is a **major release** that **may** involve some **breaking API changes** in rare cases for users of some low-level or obscure features that have been made private or removed. If your code compiles with this new version of Nippy, you should be fine.
> As with all Nippy releases: this version can read data written by older versions but older versions may not be able to read data written by _this_ version.
**PLEASE REPORT ANY PROBLEMS**, thank you!
-@ptaoussanis
> No changes since `2.12.0-beta3`.
> Changes since `2.11.1`:
* **BREAKING**: dropped support for `*final-freeze-fallback*` (rarely used)
* **BREAKING**: dropped support for `*default-freeze-compressor-selector*` (rarely used)
* **BREAKING**: made several implementation details private, incl. most low-level `write-<x>` and `read-<x>` fns (rarely used)
* **Performance**: several significant speed + space efficiency improvements, including more variable-sized types
* **New built-in types** (these previously fell back to the reader): regex patterns, symbols
* **New experimental caching feature** (please see `cache` docstring for details)
* **New**: `fast-freeze`, `fast-thaw` utils (please see docstrings for details)
* **Change**: `freeze` return val is no longer auto type hinted as `^bytes` (had a performance cost, rarely used)
* **Hotfix**: `fn?`s were incorrectly reporting true for `serializable?`
* **Hotfix**: *final-freeze-fallback* back compatibility was broken
> This is a **major release** that **may** involve some **breaking API changes** in rare cases for users of some low-level or obscure features that have been made private or removed. If your code compiles with this new version of Nippy, you should be fine.
> As with all Nippy releases: this version can read data written by older versions but older versions may not be able to read data written by _this_ version.
* **BREAKING**: dropped support for `*final-freeze-fallback*` (rarely used)
* **BREAKING**: dropped support for `*default-freeze-compressor-selector*` (rarely used)
* **BREAKING**: made several implementation details private, incl. most low-level `write-<x>` and `read-<x>` fns (rarely used)
* **Performance**: several significant speed + space efficiency improvements, including more variable-sized types
* **New built-in types** (these previously fell back to the reader): regex patterns, symbols
* **New experimental caching feature** (please see `cache` docstring for details)
* **New**: `fast-freeze`, `fast-thaw` utils (please see docstrings for details)
* **Change**: `freeze` return val is no longer auto type hinted as `^bytes` (had a performance cost, rarely used)
> This is a major **non-breaking** release that improves performance and makes thawing more resilient to certain failures. Identical to **v2.9.0-RC3**.
* **Performance**: eliminate some unnecessary boxed math
* **New**: allow intelligent auto-selection of `freeze` compression scheme using `:auto` compressor (now the default). This can result in significant speed+space improvements for users serializing many small values.
> **Major release** with significant performance improvements, a new default compression type ([LZ4](http://blog.jpountz.net/post/28092106032/wow-lz4-is-fast)), and better support for a variety of compression/encryption tools.
>
> The data format is fully **backwards-compatible**, the API is backwards compatible **unless** you are using the `:headerless-meta` thaw option.
### Changes
* A number of internal performance improvements.
* Added [LZ4](http://blog.jpountz.net/post/28092106032/wow-lz4-is-fast) compressor, **replacing Snappy as the default** (often ~10+% faster with similar compression ratios). **Thanks to [mpenet](https://github.com/mpenet) for his work on this**!
* **BREAKING**: the `thaw``:headerless-meta` option has been dropped. Its purpose was to provide Nippy v1 compatibility, which is now done automatically. To prevent any surprises, `thaw` calls with this option will now **throw an assertion error**.
* **IMPORTANT**: the `thaw` API has been improved (simplified). The default `:encryptor` and `:compressor` values are now both `:auto`, which'll choose intelligently based on data now included with the Nippy header. Behaviour remains the same for data written without a header: you must specify the correct `:compressor` and `:encryptor` values manually.
