Versions

Read from Runique's Cargo.toml at each release.

Item	Version
Rust (minimum)	1.94
Rust edition	2024
`axum`	0.8.9
`tower`	0.5.3
`tower-http`	0.7.1
`tower-sessions`	0.15.0
`tokio`	1
`sea-orm`	2.0.4 (pinned: use exactly this one)
`sea-orm-migration`	2.0.4 (pinned: use exactly this one)
`sea-query`	1.0.1
`tera`	2.1
`serde`	1.0
`chrono`	0.4.45
`uuid`	1.29.1
`argon2`	0.6
`lettre`	0.11.22

Tested engines

The test suite runs on these engines (images from docker-compose.yml).

Engine	Test image
PostgreSQL	`postgres:16-alpine`
MariaDB	`mariadb:11`
SQLite	in memory, bundled

Compatibility

The page's Versions and Tested engines tables are generated from Cargo.toml and docker-compose.yml. This file only holds the part written by hand.

Defaults

What Runique does without any setting on your side. Each value can be changed, on the page given.

Item	Default	Page
Template escaping (Tera)	on for `.html` and `.xml`; `{{ var }}` is always escaped, except with the `safe` filter	Template syntax
CSRF	required for every method but `GET` and `HEAD`	CSRF
CSP	`default-src 'none'`, `script-src 'self'`, `style-src 'self' 'unsafe-inline'`	CSP
Anonymous session	5 minutes of inactivity, in memory only	Sessions
Logged-in session	24 hours of inactivity, also stored in the database	Sessions
`LoginGuard`	5 attempts, then 5 minutes locked out	LoginGuard
`RateLimiter`	60 requests per minute, on the routes it is attached to	Rate limit
Passwords	hashed with Argon2	Passwords
Request size	form and JSON: 2 MB read into memory; file uploads: 100 MB (`RUNIQUE_MAX_BODY_MB`)	Assets and media

Good practices

Use exactly the SeaORM version pinned above in your project and in its migration/ crate: runique new writes it for you.
Generate migrations in development (runique makemigrations), commit them, and only run migration up in production.
Test on your production engine, not only on SQLite: some behaviours (time zones, text case, foreign-key indexes) differ from one engine to another.
On MySQL and MariaDB, back the database up before each migration up: a CREATE or an ALTER is never rolled back there.

To avoid

Mixing another SeaORM or sea-query version into the same project: the types would no longer match.
Running runique makemigrations in production.
Writing raw SQL where search!, search_cond! or SeaORM's methods do the job: the ? placeholder breaks Postgres.
Putting | safe on a value that comes from a visitor.

Releases and security