nghttp2

What's Changed

• nghttpx: Fix batch UDP QUIC packet dropped on GRO read by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2196

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.62.0...v1.62.1

What's Changed

• nghttpx: Fix QUIC stateless reset stack buffer overflow by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2136
• Require c-ares >= 1.16.0 for ares_getaddrinfo by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2137
• Require C++20 compiler by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2138
• ci: Bump macos to 13 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2140
• Adopt std::to_array and remove make_array by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2141
• nghttpx: Define APIEndpoints separately by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2142
• build(deps): bump golang.org/x/net from 0.22.0 to 0.24.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2143
• nghttpx: Do not send error/status body when method is HEAD by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2144
• nghttpx: Fix alignment issues in BlockAllocator by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2146
• nghttpx: Simplify parameter declaration for ipc_fd functions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2149
• CMakListsts: Add Build Test info on summary by @alagoutte in https://github.com/nghttp2/nghttp2/pull/2150
• nghttpx: Add extent to ipc_fd explicitly by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2151
• src: Add util::format_hex overload functions taking std::span by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2152
• Make make_byte_ref return std::span by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2153
• Make util::decode_hex return std::span by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2154
• Rewrite util::parse_uint by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2155
• Let base64::decode return std::span by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2156
• Refactor StringRef by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2157
• Stringref refactor c str and str by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2158
• Add StringRef literal operator and remove StringRef::from_lit by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2159
• Make StringRef(const std::string&) implicit by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2160
• Add http2::make_field family functions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2161
• Bump munit by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2162
• Remove std::string conversion operator from StringRef by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2163
• Optimize StringRef comparisons against c-string by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2164
• Pack more quic pkt by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2167
• nghttpx: Dynamic GSO failover by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2168
• Refactor ImmutableString by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2169
• nghttpx: Refactor QUIC data path by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2170
• nghttpx: Fix inherited TCP port comparison by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2171
• make_websocket_accept_token: Lesser conversions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2172
• Add http3::make_field family functions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2173
• Remove unnecessary namespace qualifications by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2174
• Refactor http utils by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2175
• Refactor streq by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2176
• Remove util::streq and let StringRef operator== deal with it by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2177
• Update the link for the Prefix.pdf document. fix #2178 by @DD-L in https://github.com/nghttp2/nghttp2/pull/2179
• Rewrite util:shuffle by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2180
• build(deps): bump github.com/quic-go/quic-go from 0.42.0 to 0.43.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2181
• nghttpd: Use nghttp2_ssize by @alyssais in https://github.com/nghttp2/nghttp2/pull/2185
• build(deps): bump github.com/quic-go/quic-go from 0.43.0 to 0.43.1 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2184
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2186
• Bump llhttp to v9.2.1 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2187
• Introduce typed nghttp2_min and nghttp2_max by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2188
• Add macos 14 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2189
• Add dedicated distcheck buildtool parameter by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2190

New Contributors

• @DD-L made their first contribution in https://github.com/nghttp2/nghttp2/pull/2179
• @alyssais made their first contribution in https://github.com/nghttp2/nghttp2/pull/2185

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.61.0...v1.62.0

What's Changed

• Fixes CVE-2024-28182
• nghttpx: Shutdown h3 stream read with trailer as well by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2087
• Checkout with submodules by @jonaski in https://github.com/nghttp2/nghttp2/pull/2093
• Respect BUILD_STATIC_LIBS and add option for tests by @jonaski in https://github.com/nghttp2/nghttp2/pull/2092
• build(deps): bump golang.org/x/net from 0.21.0 to 0.22.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2097
• Workaround llvm issue on github ubuntu runner by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2098
• docker: Use copy --link by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2099
• Nghttpx header idle timeout by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2100
• nghttpx: Fix frontend-header-timeout does not work in config file by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2101
• Rewrite hexdump by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2102
• Switch to distroless/base-nossl by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2103
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2105
• nghttpx: Simplify quic connection close handling by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2106
• build(deps): bump github.com/quic-go/quic-go from 0.41.0 to 0.42.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2107
• autotools: Use tar-ustar automake option by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2108
• Automate release process by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2109
• autotools: Switch to tar-pax by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2110
• nghttpx: Drop a UDP datagram from well-known port by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2111
• nghttpx: Fix port byte order by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2112
• h2load: Allow host header to be overridden by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2113
• nghttpx: Rework QUIC stateless reset packet size by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2114
• nghttpx: More QUIC prohibited ports by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2115
• Add actions/stale by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2116
• nghttpx: Discard UDP datagram that is too short to be a valid QUIC packet by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2117
• nghttp: Support SSLKEYLOGFILE by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2119
• No rfc7540 priority fix by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2120
• Further reduce Stateless reset emission by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2122
• nghttpx: Rework Connection ID construction by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2124
• Nghttpx faster worker lookup by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2125
• nghttpx: Split thread into worker_process and thread by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2126
• bpf: Drop bad QUIC packet by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2127
• cmake: check SSL_provide_quic_data when ENABLE_HTTP3 is ON by @jimmy-park in https://github.com/nghttp2/nghttp2/pull/2128
• nghttpx: Allocate 3 bits for QUIC configuration in Connection ID by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2129
• nghttpx: Migrate to ares_getaddrinfo by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2132
• Bump munit by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2131
• nghttpx: Fix error message by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2133
• nghttpd: Fix read stall by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2134

New Contributors

• @jonaski made their first contribution in https://github.com/nghttp2/nghttp2/pull/2093
• @jimmy-park made their first contribution in https://github.com/nghttp2/nghttp2/pull/2128

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.60.0...v1.61.0

[!CAUTION]

Do not download from https://github.com/nghttp2/nghttp2/archive/refs/tags/v1.61.0.zip or https://github.com/nghttp2/nghttp2/archive/refs/tags/v1.61.0.tar.gz. They do not work.

What's Changed

• makerelease.sh: Speed up git submodule by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2043
• Speed up git clone by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2044
• build(deps): bump actions/cache from 3 to 4 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2046
• Fixing the build and install trees by @anthonyalayo in https://github.com/nghttp2/nghttp2/pull/2051
• build(deps): bump microsoft/setup-msbuild from 1 to 2 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2052
• nghttpx: Set ocsp response to SSL in case of boringssl by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2055
• Run with python3 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2054
• src: Certificate Compression with boringssl by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2056
• Fix missing newline by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2057
• Switch to aws lc by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2058
• Libbrotli fixup by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2059
• Deprecate RFC 7540 priorities (aka stream dependencies) by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2060
• Let dependabot manage go modules by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2061
• build(deps): bump golang.org/x/net from 0.20.0 to 0.21.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2062
• integration-tests: Omit unused parameters by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2065
• Munit by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2064
• Introduce nghttp2_ssize API by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2066
• Move deprecated warning upfront by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2067
• Describe RFC 7540 priorities deprecation plan by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2068
• Apps migrate nghttp2 ssize by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2069
• src: Remove unused functions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2070
• Reconsider ssize t usage in src by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2071
• Use GitHub private vulnerability reporting by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2072
• Move security policy to GitHub standard location by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2073
• Bump mruby to 3.3.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2074
• Bump llhttp to 48588093ca4219b5f689acfc9ebea9e4c8c37663 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2075
• h2load: Add --sni option by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2076
• Bump ngtcp2 dependencies by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2077
• mruby: Adopt deprecation of mrbc_ prefix by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2078
• neverbleed: Define _GNU_SOURCE for pthread_setaffinity_np by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2079
• bpf: Pre-expand aes key by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2080
• mruby: Exclude mrdb gem which causes nghttpx to crash by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2081
• nghttpx: Reuse EVP_CIPHER_CTX for QUIC connection ID encryption by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2082
• Run apt-get update before install by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2083
• src: Deal with the case that send_quantum < max_udp_payload_size by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2084
• nghttpx: Remove SHRPX_QUIC_MAX_UDP_PAYLOAD_SIZE by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2085
• Fix build when AI_NUMERICSERV is undefined by @barracuda156 in https://github.com/nghttp2/nghttp2/pull/2086

New Contributors

• @barracuda156 made their first contribution in https://github.com/nghttp2/nghttp2/pull/2086

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.59.0...v1.60.0

[!IMPORTANT]

The APIs that uses ssize_t, including structs and callback functions, have been deprecated. New APIs that use nghttp2_ssize are introduced as a replacement. See #2066 for details.

RFC 7540 priorities (aka stream dependencies) APIs have been deprecated. They work just like before, but in the future release after the end of 2024, the functionality is removed, and the deprecated APIs start behaving differently. See the API documentation for details. RFC 7540 priorities have been deprecated by RFC 9113. Consider migrating RFC 9218
extensible prioritization scheme.

The asc files are now signed with rsa4096/5339A2BE82E07DEC. You can find it at keyserver.ubuntu.com.

What's Changed

• Bump clang to 15 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1986
• Bump clang format by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1987
• Bump quictls to 3.1.4+quic by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1988
• Update ax_cxx_compile_stdcxx.m4 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1989
• nghttpx: Prefer FILE_NAME if defined by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1990
• Add API to get and parse RFC 9218 priority by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1991
• nghttpx: Propagate stream priority from backend to frontend by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1992
• Check whether CLOCK_MONOTONIC is declared by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1995
• Bump go packages by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2001
• cmake: Remove itprep target by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2002
• h2load: Fix IPv6 address in :authority by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2000
• Bump ngtcp2 and nghttp3 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2006
• Bump libbpf to v1.3.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2007
• Use nghttp3_pri_parse_priority added since nghttp3 v1.1.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2008
• cmake: Set minimum quic package versions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2009
• Use #include <windows.h> instead of #include <sysinfoapi.h> by @hrxi in https://github.com/nghttp2/nghttp2/pull/1997
• build(deps): bump actions/setup-go from 4 to 5 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2010
• cmake: bring back ENABLE_STATIC_CRT by @bwncp in https://github.com/nghttp2/nghttp2/pull/2011
• Avoid detecting OpenSSL 3.2 as quictls by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2012
• build(deps): bump golang.org/x/crypto from 0.15.0 to 0.17.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2015
• build(deps): bump actions/upload-artifact from 3 to 4 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2014
• src: Support building with aws-lc by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2013
• boringssl has SSL_CTX_set1_groups_list by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2016
• Drop old OpenSSL support by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2017
• Drop old OpenSSL support part 2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2019
• Remove NPN by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2020
• Remove end_to_end.py by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2021
• cmake: Require OpenSSL >= 1.1.1 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2022
• nghttpx: OpenSSL needs SSL_CTX_set_recv_max_early_data by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2023
• App fix by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2024
• nghttpx: Remove a trailing whitespace by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2025
• H2load header ttfb fix by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2026
• Not finding packages when ENABLE_LIB_ONLY is set by @anthonyalayo in https://github.com/nghttp2/nghttp2/pull/2027
• Have less stuff in config.h by @hrxi in https://github.com/nghttp2/nghttp2/pull/1996
• Update minimum CMake version to 3.5 by @anthonyalayo in https://github.com/nghttp2/nghttp2/pull/2030
• build(deps): bump github.com/quic-go/quic-go from 0.35.1 to 0.37.7 by @dependabot in https://github.com/nghttp2/nghttp2/pull/2032
• Fix typo by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2033
• Specify DEBIAN_FRONTEND=noninteractive by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2034
• Revert "nghttpx: Shutdown h3 stream write if reset by a remote endpoint" by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2036
• ci: Add aws-lc builds by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2037
• Bump go modules by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2038
• Bump neverbleed by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2039
• Bump go-nghttp2 and go mod tidy by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2040
• Bump ngtcp2 to v1.2.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2041
• src: Avoid copies by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/2042

New Contributors

• @hrxi made their first contribution in https://github.com/nghttp2/nghttp2/pull/1997
• @bwncp made their first contribution in https://github.com/nghttp2/nghttp2/pull/2011
• @anthonyalayo made their first contribution in https://github.com/nghttp2/nghttp2/pull/2027

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.58.0...v1.59.0

What's Changed

• Fix build error when both clock_gettime and GetTickCount64 are available by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1963
• nghttpx: Shutdown h3 stream write if reset by a remote endpoint by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1964
• Bump golang.org/x/net from 0.15.0 to 0.17.0 by @dependabot in https://github.com/nghttp2/nghttp2/pull/1965
• cmake: speed up warning option detection by @vszakats in https://github.com/nghttp2/nghttp2/pull/1967
• Update doc by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1969
• ngtcp2 has merged BBR and BBRv2 under BBR (fixes issue #1955) by @av223119 in https://github.com/nghttp2/nghttp2/pull/1956
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1970
• Integration servertester h3 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1974
• Refactor character comparison by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1975
• nghttpx: Stricter transfer-encoding checks by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1973
• Configure cygwin by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1978
• windows: Fix warnings by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1979
• Prefer clock_gettime if CYGWIN defined by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1977
• Bump neverbleed by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1981
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1983
• Bump neverbleed by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1985

New Contributors

• @av223119 made their first contribution in https://github.com/nghttp2/nghttp2/pull/1956

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.57.0...v1.58.0

What's Changed

• Fixes CVE-2023-44487
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1944
• Add dependabot to update actions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1946
• Bump golang.org/x/net to v0.15.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1950
• Bump actions/setup-go from 3 to 4 by @dependabot in https://github.com/nghttp2/nghttp2/pull/1948
• Bump actions/checkout from 3 to 4 by @dependabot in https://github.com/nghttp2/nghttp2/pull/1949
• Bump actions/upload-artifact from 1 to 3 by @dependabot in https://github.com/nghttp2/nghttp2/pull/1947
• docker: Bump base image to debian 12 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1951
• nghttpx: Header field name must be lowercase by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1953
• Bump quictls by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1945
• Apps fix by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1957
• nghttpx: Fix bug that --single-process does not work by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1958
• Fix clang-format by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1959
• Rework session management by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1961

New Contributors

• @dependabot made their first contribution in https://github.com/nghttp2/nghttp2/pull/1948

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.56.0...v1.57.0

What's Changed

• doc: Bump boringssl by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1928
• Fix memory leak by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1930
• Return void by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1931
• nghttpx: Rework sending and receiving ECN bits by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1934
• CMSG_DATA does not necessarily return an aligned pointer by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1935
• Bump quictls by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1937
• Bump ngtcp2 and its dependencies by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1939
• nghttpx: Simplify std::unique_ptr get and release by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1940
• Bump llhttp to 926c982942eb53a13f01c1e9e6b19bd3b196e7dd by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1941
• Bump libbpf to v1.2.2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1942
• Update Dockerfile by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1943

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.55.0...v1.56.0

What's Changed

• doc: Bump boringssl by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1928
• Fix memory leak by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1930

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.55.0...v1.55.1

What's Changed

• Fix build error without libev by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1915
• Bump go to 1.20 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1916
• Bump go package dependencies by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1917
• mruby: Support cross build for autotools by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1918
• h2load, nghttpx: Add UDP_GRO support by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1920
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1923
• nghttpx: Randomize initial QUIC packet number by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1925
• Bump llhttp to a0e744f850d8101a51284868ffdf745bcfe4fbcc by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1926
• Bump macos to 12 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1927

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.54.0...v1.55.0

What's Changed

• nghttpx: Consistent error handling and use of high-level API by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1904
• h2load: Fix http3 upload stall by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1905
• h2load: Use std::chrono::steady_clock for quic timestamp by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1906
• Avoid ev_now by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1907
• Remove unused macro bswap64 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1910
• Bump ngtcp2 and nghttp3 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1911
• Bump libbpf to v1.2.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1912
• Avoid copies by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1913

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.53.0...v1.54.0

What's Changed

• Bump golang.org/x/net to v0.7.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1867
• Cache dependencies to speed up workflow builds by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1869
• Bump nghttp3 to v0.9.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1870
• nghttpx: Gracefully shutdown HTTP/3 connection by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1871
• Bump mruby to 3.2.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1872
• Bump go modules by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1873
• nghttpx: Fix bug that causes 400 response after upgrade failure by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1874
• sphinx-doc understands :enum: by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1877
• Set workflow permissions by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1879
• Nghttpx tweak worker process handling by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1880
• nghttpx: Fix heap-use-after-free by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1881
• nghttpx: Fix numeric hostname verification by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1885
• Fix compile errors with clang-15 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1886
• Add verify_hostname tests by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1887
• Add missing if condition to MacOS setup by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1888
• Bump ngtcp2 to v0.14.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1891
• nghttpx: write watcher should only be started upon blocking write by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1892
• Msvc build check by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1896
• Initialize map table lazily by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1897
• Import ngtcp2/sfparse, Structured Field Values parser by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1898
• Bump ngtcp2 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1899
• nghttpx: Send NEW_TOKEN on path change by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1900
• Initialize z_stream completely with zeros by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1901
• Bump neverbleed by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1902

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.52.0...v1.53.0

What's Changed

• Integration h3 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1833
• integration: Use HTTP status code constants by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1834
• integration: Fix lint errors by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1835
• Don't use the unofficial libevent component by @fredizzimo in https://github.com/nghttp2/nghttp2/pull/1837
• Bump ngtcp2 dependencies by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1843
• Minor cleanup by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1845
• Remove deprecated libnghttp2_asio by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1844
• Remove deprecated python bindings by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1846
• Bump zlib to 1.2.13 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1847
• Remove src/includes by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1848
• Remove unused function by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1849
• src: Fix path component resolution by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1850
• Bump neverbleed by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1851
• Remove sphinx theme bundle by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1852
• Bump ngtcp2 to v0.13.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1853
• Bump ngtcp2 in Dockerfile to v0.13.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1854
• nghttpx: Fix bug that stalls TLS write by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1857
• Bump ngtcp2 to v0.13.1 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1858
• Bump libbpf to v1.1.0 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1859
• Bump llhttp to f2e1914b6c59f5cd88f492abc9d8af6be246bc85 by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1860
• Simplify std::uniform_int_distribution call by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1861
• Bump quictls by @tatsuhiro-t in https://github.com/nghttp2/nghttp2/pull/1862

New Contributors

• @fredizzimo made their first contribution in https://github.com/nghttp2/nghttp2/pull/1837

Full Changelog: https://github.com/nghttp2/nghttp2/compare/v1.51.0...v1.52.0

• lib: add casts to silence implicit conversion warnings (GH-1822)
• doc: Update Ubuntu packages based on Ubuntu 22.04 (GH-1812)
• doc: Update android build documentation (GH-1806)
• build: Bump NDK and others to the latest (GH-1804)
• build: Bump OpenSSL versions (GH-1828)
• build: Bump libbpf to v1.0.1 (GH-1830)
• build: Bump ngtcp2 (GH-1819, GH-1831)
• build: Disable python bindings by default because it has been deprecated (GH-1811, GH-1826, GH-1829)
• build: Dockerfile android improvements (GH-1805)
• build: Update dependency versions for Dockerfile.android (GH-1802)
• third-party: Bump llhttp (GH-1827)
• src: Fix test failure on Linux if tz database is not available (GH-1813)
• nghttpx: Fix affinity-cookie-stickiness parameter handling (GH-1818)
• integration: Add http3 integration test (GH-1832)

• lib: Option no rfc9113 ltws validation (GH-1792)
• build: Bump libbpf to v1.0.0 (GH-1798)
• build: Bump ngtcp2 (GH-1791, GH-1800)
• build: Fix typographic error (GH-1787)
• nghttpx: Respect backend-address-family on dynamic DNS lookup (GH-1799)

• lib: No need to check pseudo header lws (GH-1745)
• lib: Add nghttp2_check_header_value_rfc9113 (GH-1743)
• doc: Bump sphinx_rtd_theme (GH-1754)
• asio: libnghttp2_asio has moved to its own repository (GH-1761)
• asio: Deprecate libnghttp2_asio (GH-1749)
• python: Deprecate Python bindings (GH-1750)
• build: Bump libbpf (GH-1783)
• build: Bump ngtcp2 and nghttp3 (GH-1780)
• build: Bump boringssl (GH-1779)
• build: cmake: add ENABLE_DOC option. (GH-1596)
• build: Bump QUIC related libraries (GH-1759)
• build: cmake: fix detecting quic openssl with win32 (GH-1755)
• build: Bump quictls (GH-1751)
• src: Fix errors reported by coverity scan (GH-1784)
• src: Replace the use of strtoul and strtol with parse_uint (GH-1775)
• fuzz: add frames fuzzer (GH-1770)
• fuzz: add extended fuzzer using FuzzedDataProvider (GH-1771)
• nghttpx: Embed km_id in a regular token (GH-1782)
• nghttpx: Regular token does not require server issued DCID (GH-1781)
• nghttpx: Randomize backend address backend robin order per thread (2nd Ed.) (GH-1769)
• nghttpx: Fix broken PROXY-protocol (GH-1747)
• nghttpx: Remove trailing white spaces from HTTP/1.1 fields (GH-1744)
• h2load: Implement nghttp3 reset_stream callback (GH-1766)
• h2load, nghttpx: Ignore nghttp3 errors which can be ignored (GH-1764)
• third-party: Bump neverbleed (GH-1763)
• third-party: Bump llhttp (GH-1762)

• lib: Allow server to override RFC 9218 stream priority (GH-1734)
• lib: Add a server option to fallback to RFC 7540 priorities (GH-1731)
• lib: Add PRIORITY_UPDATE frame support (GH-1729)
• lib: Implement RFC 9218 extensible prioritization scheme (GH-1728)
• lib: Do not verify host field specific characters for response field (GH-1727)
• lib: No rfc7540 priorities (GH-1725)
• lib: Fix stream stall when initial window size is decreased (GH-1680)
• doc: Document how to change stream prioritization scheme (GH-1732)
• build: Compile with libressl 3.5 (GH-1724)
• build: EXTRA_DIST: List mruby files explicitly (GH-1712)
• build: Bump ngtcp2 and nghttp3 (GH-1693, GH-1698, GH-1714, GH-1736)
• build: Do not check application libraries if --enable-lib-only is given (GH-1681)
• src: Update default TLS cipher suites (GH-1735)
• nghttpx, h2load: Better pack UDP packets in one GSO write (GH-1716)
• nghttpx, h2load: Quic error handling (GH-1710)
• nghttpx, h2load: Fix QUIC performance regression (GH-1695)
• nghttp, nghttpd, nghttpx: Add ktls support (GH-1702, GH-1705)
• h2load: Send more packets without GSO per event loop (GH-1739)
• h2load: Add ktls support (GH-1704)
• nghttpd: Fix TLS read stall (GH-1707)
• nghttpx: Disable RFC 7540 priorities (GH-1733)
• nghttpx: Client always uses simpler TLS handshake (GH-1703)
• nghttpx: Add affinity-cookie-stickiness backend parameter (GH-1685)
• nghttpx: Fix broken session affinity (GH-1683)
• nghttpx: Limit CONNECTION_CLOSE and Retry under server amplification limit (GH-1682)
• integration: Go update (GH-1719)
• integration: Add go.mod (GH-1697)
• third-party: Bump llhttp to 75b45129db961e1fb3c56044e1b8f7721bfaee5d (GH-1738)
• third-party: Bump libbpf to v0.8.0 (GH-1737)
• third-party: Bump mruby to 3.1.0 (GH-1709)
• third-party: Bump neverbleed based on the latest head (GH-1708)

• lib: Fix decoder table size update (GH-1667)
• lib: chore: fix -Wunreachable-code-return (GH-1625)
• build: Make Docker speak HTTP/3 (GH-1657)
• build: Remove SPDY option for CMake (GH-1665)
• build: cmake: Disable libbpf build by default
• doc: Fix typos (GH-1668)
• doc: Update nghttp2.pyx (GH-1666)
• h2load: Handle EAGAIN/EWOULDBLOCK from sendmsg
• h2load: allow setting max frame size for h2load (GH-1640)
• nghttpx: Add --require-http-scheme option
• nghttpx: Add support QUIC BBR2
• nghttpx: Bump libbpf to v0.7.0 and turn on all strict features
• nghttpx: Change qlog file extension to .sqlog
• nghttpx: Fix bug that h3 stream ends prematurely
• nghttpx: Fix the issue that forwarded h3 GET request always has chunked TE
• nghttpx: Handle EAGAIN/EWOULDBLOCK from sendmsg
• nghttpx: Send and receive ECN in QUIC packets
• nghttpx: Set IP_PMTUDISC_DO explicitly
• nghttpx: Support h3 trailer fields
• nghttpx: fix quotes in --altsvc example (GH-1643)
• nghttpx: shrpx: make nghttpx -v show ngtcp2 and nghttp3 version as well (GH-1636)
• third-party: Bump llhttp to v6.0.6

• build: Workaround broken version check in AX_PYTHON_DEVEL (GH-1622)
• build: Remove check for UDP_SEGMENT (GH-1619)
• build: Fix issue that libev cannot be found with autotools under mac osx
• build: Fix compile error with libressl
• build: Always include optional files to EXTRA_DIST
• build: Add missing cmake files to EXTRA_DIST
• src: Enable HTTP/3 with boringssl
• src: Compile with boringssl for non-http3 build
• src: Guard msghdr_get_local_addr with ENABLE_HTTP3 macro (GH-1620)
• nghttpx: Reduce dgram size if sendmsg fails with EINVAL or EMSGSIZE
• nghttpx: Set SCT data when built with boringssl
• nghttpx: Fix wrong SSL_CTX object usage
• nghttpx: Respect !tls-no-postpone-early-data with boringssl
• nghttpx: Send session ticket after handshake with boringssl
• nghttpx: Add --frontend-quic-initial-rtt option
• nghttpx: Unload BPF program after setting up all QUIC listeners
• nghttpx: Add --worker-process-grace-shutdown-period option
• nghttpx: Add --max-worker-processes option
• nghttpx: Unload BPF objects on reload to avoid running out of memlock
• nghttpx: Support h3-29
• nghttpx: Fail h3 connection attempt if no ALPN is negotiated
• nghttpx: Add --rlimit-memlock option
• nghttpx: Read QUIC keying materials from file
• nghttpx: Allocate server id in Connection ID (see --quic-server-id option)

• build: Fix compile error with libressl
• build: Always include optional files to EXTRA_DIST
• build: Add missing cmake files to EXTRA_DIST