swift-nio-http2

SemVer Minor

• Reduce sendability warnings (#417)

SemVer Patch

• Mark public generic async methods inlinable (#426)
• Use explicit 64-bit UInt64 to support 32-bit platforms (#430)
• Remove precondition: yielding to terminated AsyncSequence (#432)

Other Changes

• Add missing availability guards in tests (#429)
• Fix Bench1Conn10kRequests crash (#434)

New async APIs (former AsyncChannel SPI)

• Add new async and typed HTTP/2 APIs (#424)

SemVer Minor

• Bump minimum Swift version to 5.7 (#420)

Other Changes

• Remove retroactive CustomDebugStringConvertible conformance in tests (#425)

SemVer Patch

• DOSHeuristics DeadlineClock more explicit on 5.6 (#422)

SemVer Minor

• Limit rate of permitted RST frames (3798fe5f1564f27461390b4f6163f6ddfb21fd2d)

SemVer Patch

• Replace os() with canImport(Darwin) (#399, patch credit to @brennobemoura)
• Fix parent channel read() call on HTTP2StreamChannel initialization causing incorrect order of inbound HTTP2Frames (#413, patch credit to @qusc)
• Generic helpers for HTTP/2 async pipelines (#401)
• Inline http2 fixups (#402)
• H2 stream AsyncIterator non-sendable on 5.7 (#405)
• Delay stream creation until the next loop tick (#416)

Other Changes

• Update allocation limits (#400)
• HTTP/2 pipeline NIOAsyncChannel pipeline changes (#403) (#406) (#407) (#408) (#409) (#411) (#414) (#415) (#419)

SemVer Minor

• Drop support for Swift 5.5 (#392)
• Add HPACKHeader.removeAll(keepingCapacity:) (#393)

SemVer Patch

• Fix the test for HPACKHeader.removeAll(keepingCapacity:) on Android (#395, patch credit to @finagolfin)
• Use the synchronous NIOHTTP2Handler multiplexer accessor for synchronous channel operations (#396)

Other Changes

• Update the allocation counts CI build script to drop support for Swift 5.5 and add Swift 5.9 (#397)

SemVer Minor

• Integrate the multiplexer into the NIOHTTPHandler (#377, #379, #380, #381, #382, #383, #384, #386)

SemVer Patch

• Avoid an allocation in the outbound frame buffer (#385)
• Replace estimatedFrameSize with flowControlledSize and only count DATA frames (#387, #388)

Other Changes

• Make soundness check aware of 2023 (#378)
• Add regression testing for docs and fix the issues. (#389)
• Add docker-compose file for Swift 5.9 (#390)

SemVer Patch

• Soften errors when seeing inactive before active (#376)

SemVer Patch

• Correctly respect changes to HEADER_TABLE_SIZE (#374)

SemVer Minor

• Ensure that we fire channelActive and channelInactive in order (#373)

SemVer Patch

• Better handle writes issued with already completed promises (#372)

SemVer Patch

• Content-Length errors shouldn't crash (#371)

SemVer Minor

• Verify content length is not negative (#361)
• Provide an iterator for header values (#362)

SemVer Patch

• Verify all content-length header values match (#360)
• Make FramePayload.Data class-backed (#365)
• Ignore content-length for HEAD requests and 304 responses (#369)

Other Changes

• Add .spi.yml for Swift Package Index DocC support (#363)
• Add Swift 5.8 CI and update nightly CI to Ubuntu 22.04 (#366)
• Point docs to Swift Package Index (#367)
• Remove Jazzy doc generation (#368)
• Update allocation limits (#370)

SemVer Patch

• Replace NIOSendable with Sendable (#358)

Other Changes

• Remove #if compiler(>=5.5) (#357)

SemVer Minor

• Raise minimum supported Swift version from 5.4 to 5.5 (#355)

SemVer Patch

• Better GoAWAY error (#354)

Other Changes

• Use Docc for documentation (#351)
• Validate missing imports in CI (#352)
• Update allocation limits (#356)

SemVer Patch

• Use swift-atomics instead of NIOAtomics (#350)

Other Changes

• Use 5.7 nightlies (#348)

SemVer Minor

• Adopt Sendable in relevant types (#343)
• Make HPACKHeaders hashable. (#344)

SemVer Patch

• Improve HTTPHeader normalisation performance for large inputs (#347)

Other Changes

• Add script to list transitive dependencies (#340)
• Remove build_podspec.sh (#341)
• HPACKHeaders performance test for HTTPHeader normalisation (#346)

SemVer Minor

• Drop support for Swift 5.2 and 5.3 (#337)

Other Changes

• Use SPM API diff checker (#334)
• Fix warnings, that appeared after requiring Swift 5.4 (#338)

SemVer Patch

• Forbid clients from pushing (#332)

Other Changes

• ci update (#329)
• Update alloc limits and clean up soundness (#331)

Security Fixes

This version contains a fix for CVE-2022-0618: Denial of service via HTTP/2 HEADERS frames padding. This fix involves a substantial rewrite of the frame parser to address a number of related issues that all trigger crashes in swift-nio-http2. For more details see the advisory. We recommend updating to this release as soon as possible. (commit)

SemVer Minor

• Make UnrepresentableInteger public (#325)

SemVer Patch

• Remove a retain/release (#327)
• Use unchecked math in encodeInteger (#328)

Other Changes

• Update minimum dependency version in README (#326)

The release contains fixes for three security vulnerabilties.

SemVer Patch

• CVE-2022-24668: Denial of service via ALTSVC or ORIGIN frames
• CVE-2022-24667: Denial of service via mishandled HPACK variable length integer encoding
• CVE-2022-24666: Denial of service via invalid HTTP/2 HEADERS frame length

Other Changes

• Update doc generation script (#322)
• Add 5.6 nightly CI (#324)

SemVer Patch

• Protect against reentrancy inside the HTTP2ChannelHandler (#319)
• Only flush when necessary in the HTTP2ChannelHandler (#320)

Other Changes

• Update nightly allocation limits (#321)