docs: update all version references to 0.2.0-M7, add changelog entry

Author: ancongui

CHANGELOG.md

@@ -6,6 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
+## v0.2.0-M7 (2026-02-19)
+
+### Added
+
+- **WebSocket support**: New `pyfly.websocket` module with `@websocket_mapping` decorator, `WebSocketSession` wrapper, and auto-discovery in `create_app()` via `WebSocketRegistrar`
+- **OAuth2 auto-configuration**: Three new auto-configuration classes — `OAuth2ResourceServerAutoConfiguration` (JWKS-based Bearer validation), `OAuth2AuthorizationServerAutoConfiguration` (token endpoint with client_credentials/refresh_token grants), `OAuth2ClientAutoConfiguration` (client registrations from config)
+- **OAuth2ResourceServerFilter**: WebFilter for Bearer token validation using `JWKSTokenValidator`, with configurable exclude patterns
+- **Session management**: New `pyfly.session` module with `HttpSession`, `SessionStore` Protocol, `InMemorySessionStore`, `RedisSessionStore`, `SessionFilter` middleware, and auto-configuration
+- **i18n / locale support**: New `pyfly.i18n` module with `MessageSource` Protocol, `ResourceBundleMessageSource` (YAML/JSON), `AcceptHeaderLocaleResolver`, `FixedLocaleResolver`, and auto-configuration
+- **XML serialization**: `dict_to_xml()` / `xml_to_dict()` converters (stdlib xml.etree), `XMLResponse` class, and content negotiation via `Accept` header in controller dispatch
+- **`@controller_advice`**: New stereotype for global exception handling across all controllers, with MRO-sorted handler resolution
+- **`@shell_method_availability`**: Decorator for conditional shell command registration — unavailable commands are skipped during wiring
+- **`@Value` injection**: Existing `Value` descriptor now wired into `Container._inject_autowired_fields()` for config property injection
+- **`EventFailureStrategy`**: Configurable strategy (LOG/RAISE) for `CommandBus` event publishing failures
+
+### Fixed
+
+- **InMemoryMessageBroker race condition**: Added `asyncio.Lock` to protect subscriptions and group iterators from concurrent access
+- **InMemoryPersistenceAdapter race condition**: Added `asyncio.Lock` to protect saga state store from concurrent mutations
+- **Background task lifecycle**: Background tasks created during startup are now tracked and cancelled on `stop()`
+- **ASGI pathsend OOM risk**: Changed `read_bytes()` to chunked 64 KB streaming for large file responses
+
+---
+
 ## v0.2.0-M6 (2026-02-19)
 
 ### Fixed

README.md

@@ -11,7 +11,7 @@
   <a href="https://github.com/fireflyframework"><img src="https://img.shields.io/badge/Firefly_Framework-official-ff6600?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI+PHBhdGggZmlsbD0id2hpdGUiIGQ9Ik0xMiAyQzYuNDggMiAyIDYuNDggMiAxMnM0LjQ4IDEwIDEwIDEwIDEwLTQuNDggMTAtMTBTMTcuNTIgMiAxMiAyeiIvPjwvc3ZnPg==" alt="Firefly Framework"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/python-3.12%2B-blue?logo=python&logoColor=white" alt="Python 3.12+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-green" alt="License: Apache 2.0"></a>
-  <a href="#"><img src="https://img.shields.io/badge/version-0.2.0--M6-yellow" alt="Version: 0.2.0-M6"></a>
+  <a href="#"><img src="https://img.shields.io/badge/version-0.2.0--M7-yellow" alt="Version: 0.2.0-M7"></a>
   <a href="#"><img src="https://img.shields.io/badge/type--checked-mypy%20strict-blue?logo=python&logoColor=white" alt="Type Checked: mypy strict"></a>
   <a href="#"><img src="https://img.shields.io/badge/code%20style-ruff-purple?logo=ruff&logoColor=white" alt="Code Style: Ruff"></a>
   <a href="#"><img src="https://img.shields.io/badge/async-first-brightgreen" alt="Async First"></a>
@@ -304,13 +304,13 @@ my-addon = "my_package.auto_configuration:MyAutoConfiguration"
 
 ```bash
 # Install the latest release
-pip install "pyfly @ https://github.com/fireflyframework/pyfly/releases/latest/download/pyfly-0.2.0a6-py3-none-any.whl"
+pip install "pyfly @ https://github.com/fireflyframework/pyfly/releases/latest/download/pyfly-0.2.0a7-py3-none-any.whl"
 
 # Install with specific extras
-pip install "pyfly[web,data-relational,cache] @ https://github.com/fireflyframework/pyfly/releases/latest/download/pyfly-0.2.0a6-py3-none-any.whl"
+pip install "pyfly[web,data-relational,cache] @ https://github.com/fireflyframework/pyfly/releases/latest/download/pyfly-0.2.0a7-py3-none-any.whl"
 
 # Or with uv
-uv pip install "pyfly @ https://github.com/fireflyframework/pyfly/releases/latest/download/pyfly-0.2.0a6-py3-none-any.whl"
+uv pip install "pyfly @ https://github.com/fireflyframework/pyfly/releases/latest/download/pyfly-0.2.0a7-py3-none-any.whl"
 ```
 
 ### One-Line Install (CLI + Framework)
@@ -592,21 +592,21 @@ PyFly follows the same versioning system as Spring Boot, based on **Semantic Ver
 | Stage | Format | Description |
 |-------|--------|-------------|
 | **SNAPSHOT** | `0.2.0-SNAPSHOT` | Active development build. Unstable, changes daily. |
-| **Milestone** | `0.2.0-M6` | Pre-release feature preview. New functionality available for early feedback. |
+| **Milestone** | `0.2.0-M7` | Pre-release feature preview. New functionality available for early feedback. |
 | **Release Candidate** | `0.2.0-RC1` | Feature-complete. Only bug fixes from this point. |
 | **GA** | `0.2.0` | General Availability. Production-ready, fully tested and stable. |
 
 **Release lifecycle:** `SNAPSHOT` → `M1` → `M2` → ... → `RC1` → `RC2` → ... → `GA`
 
-For Python packaging (PEP 440), milestone versions map to alpha pre-releases (`0.2.0a6`), release candidates map to `rc` (`0.2.0rc1`), and GA is the final release (`0.2.0`). See [docs/versioning.md](docs/versioning.md) for full details.
+For Python packaging (PEP 440), milestone versions map to alpha pre-releases (`0.2.0a7`), release candidates map to `rc` (`0.2.0rc1`), and GA is the final release (`0.2.0`). See [docs/versioning.md](docs/versioning.md) for full details.
 
 ---
 
 ## Changelog
 
 See **[CHANGELOG.md](CHANGELOG.md)** for detailed release notes.
 
-**Current:** 0.2.0-M6 (2026-02-19) — ASGI pathsend extension fix for Granian in WebFilterChainMiddleware.
+**Current:** 0.2.0-M7 (2026-02-19) — Comprehensive audit: bug fixes, WebSocket, OAuth2, session management, i18n, XML serialization.
 
 ---
 

ROADMAP.md

@@ -4,7 +4,7 @@ PyFly's roadmap is driven by achieving feature parity with the full [Firefly Fra
 
 ---
 
-## Current State (v0.2.0-M6)
+## Current State (v0.2.0-M7)
 
 PyFly ships with **27 modules** covering the foundation, application, infrastructure, and cross-cutting layers. See the [Changelog](CHANGELOG.md) for full details on what's included.
 

docs/cli.md

@@ -645,7 +645,7 @@ Missing optional tools are shown with a `-` dash indicator (dimmed), while missi
 Verifies that PyFly itself is importable and displays the installed version:
 
 ```
-✓ pyfly v0.2.0-M6
+✓ pyfly v0.2.0-M7
 ```
 
 ### Summary

docs/getting-started.md

@@ -470,7 +470,7 @@ ______ ___.__._/ ____\  | ___.__.
 |   __// ____| |__|  |____/ ____|
 |__|   \/                 \/
 
-  PyFly v0.2.0-M6 | Python 3.12.0
+  PyFly v0.2.0-M7 | Python 3.12.0
 
 2026-01-15T10:30:00Z [info] starting_application  app=my-service version=0.1.0
 2026-01-15T10:30:00Z [info] no_active_profiles     message=No active profiles set, falling back to default

docs/installation.md

@@ -472,7 +472,7 @@ PyFly Doctor
     ✓ mypy — Type checker
 
   PyFly packages:
-    ✓ pyfly v0.2.0-M6
+    ✓ pyfly v0.2.0-M7
 
   All checks passed!
 ```

docs/modules/core.md

@@ -536,7 +536,7 @@ class BannerMode(enum.Enum):
 | Mode | Behavior |
 |---|---|
 | `TEXT` | Full ASCII art banner (default) with a framework version line. |
-| `MINIMAL` | Single line: `:: PyFly :: (v0.2.0-M6)` |
+| `MINIMAL` | Single line: `:: PyFly :: (v0.2.0-M7)` |
 | `OFF` | No banner output at all. |
 
 ### BannerPrinter Class
@@ -577,7 +577,7 @@ ______ ___.__._/ ____\  | ___.__.
 |   __// ____| |__|  |____/ ____|
 |__|   \/                 \/
 
-:: PyFly Framework :: (v0.2.0-M6)
+:: PyFly Framework :: (v0.2.0-M7)
 ```
 
 ### Custom Banner Files

docs/versioning.md

@@ -12,7 +12,7 @@ All PyFly versions follow the `MAJOR.MINOR.PATCH` scheme:
 - **MINOR** — New functionality in a backward-compatible manner
 - **PATCH** — Backward-compatible bug fixes
 
-Pre-release versions append a stage suffix: `0.2.0-M6`, `0.2.0-RC1`.
+Pre-release versions append a stage suffix: `0.2.0-M7`, `0.2.0-RC1`.
 
 ---
 
@@ -40,7 +40,7 @@ SNAPSHOT versions represent the bleeding edge of development. They are rebuilt f
 
 | | |
 |-|-|
-| **Format** | `X.Y.Z-MN` (e.g., `0.1.0-M1`, `0.2.0-M6`) |
+| **Format** | `X.Y.Z-MN` (e.g., `0.1.0-M1`, `0.2.0-M7`) |
 | **Stability** | Pre-release — APIs may still change |
 | **Purpose** | Feature previews and early feedback |
 | **Audience** | Developers evaluating upcoming features |
@@ -78,18 +78,19 @@ Python packaging standards ([PEP 440](https://peps.python.org/pep-0440/)) use a
 | PyFly (Spring Boot Style) | PEP 440 (`pyproject.toml`) | Example |
 |---------------------------|---------------------------|---------|
 | `0.2.0-SNAPSHOT` | `0.2.0.dev1` | Development |
-| `0.2.0-M6` | `0.2.0a6` | Milestone 6 |
+| `0.2.0-M7` | `0.2.0a7` | Milestone 7 |
 | `0.2.0-RC1` | `0.2.0rc1` | Release Candidate 1 |
 | `0.2.0` (GA) | `0.2.0` | General Availability |
 
-The display version (`__version__` in `pyfly/__init__.py`) uses the Spring Boot format (`0.2.0-M6`), which is what you see in the startup banner, CLI output, and admin dashboard. The `pyproject.toml` version uses PEP 440 format for compatibility with Python packaging tools (pip, uv, hatchling).
+The display version (`__version__` in `pyfly/__init__.py`) uses the Spring Boot format (`0.2.0-M7`), which is what you see in the startup banner, CLI output, and admin dashboard. The `pyproject.toml` version uses PEP 440 format for compatibility with Python packaging tools (pip, uv, hatchling).
 
 ---
 
 ## Version History
 
 | Version | Date | Stage | Highlights |
 |---------|------|-------|------------|
+| `0.2.0-M7` | 2026-02-19 | Milestone | Comprehensive audit: WebSocket, OAuth2, session, i18n, XML, bug fixes |
 | `0.2.0-M6` | 2026-02-19 | Milestone | ASGI pathsend extension fix for Granian |
 | `0.2.0-M5` | 2026-02-19 | Milestone | Auto-configuration audit (8 new auto-config classes), stdlib logging fallback, post-processor deduplication |
 | `0.2.0-M4` | 2026-02-18 | Milestone | Admin dashboard overhaul, pure ASGI middleware (anyio fix), built-in metrics, bean categories, mapping/trace/logger enhancements |
@@ -112,7 +113,7 @@ See **[CHANGELOG.md](../CHANGELOG.md)** for detailed release notes.
 
 ```python
 import pyfly
-print(pyfly.__version__)  # e.g., "0.2.0-M6"
+print(pyfly.__version__)  # e.g., "0.2.0-M7"
 ```
 
 **CLI:**
@@ -131,7 +132,7 @@ ______ ___.__._/ ____\  | ___.__.
 |   __// ____| |__|  |____/ ____|
 |__|   \/                 \/
 
-:: PyFly Framework :: (v0.2.0-M6) (Python 3.13.9)
+:: PyFly Framework :: (v0.2.0-M7) (Python 3.13.9)
 Copyright 2026 Firefly Software Solutions Inc. | Apache License 2.0
 ```
 

install.sh

@@ -26,7 +26,7 @@ set -euo pipefail
 
 # ── Constants ──────────────────────────────────────────────────────────────────
 
-PYFLY_VERSION="0.2.0-M6"
+PYFLY_VERSION="0.2.0-M7"
 PYFLY_REPO="https://github.com/fireflyframework/pyfly.git"
 DEFAULT_INSTALL_DIR="$HOME/.pyfly"
 MIN_PYTHON_MAJOR=3

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pyfly"
-version = "0.2.0a6"
+version = "0.2.0a7"
 description = "The official Python implementation of the Firefly Framework — DI, CQRS, EDA, hexagonal architecture, and more."
 readme = "README.md"
 license = "Apache-2.0"