Commit Graph

  • d37bae3b77 chore(deps): bump actions/checkout from 6 to 7 (#2297) master dependabot[bot] 2026-06-19 12:22:52 +02:00
  • ad93216ac1 reject duplicate Content-Length in response header parser (#2294) alhuda 2026-06-15 22:54:03 +05:30
  • 76aa66015c fix(lbclient): prevent deadlock when all clients are removed (#2287) Y.Horie 2026-06-13 16:24:36 +09:00
  • 8fe6af3619 Fix flaky race tests (#2292) Erik Dubbelboer 2026-06-13 15:00:14 +08:00
  • 97372e6a9a Drain streamed body in content length test flakey-tests Erik Dubbelboer 2026-06-13 08:04:49 +02:00
  • fdbe5bdec4 Fix flaky race tests Erik Dubbelboer 2026-06-13 07:20:02 +02:00
  • ca4600a0a3 fix: deep-copy trailer keys Erik Dubbelboer 2026-06-13 05:48:08 +02:00
  • 3aa09fee51 fix(client): avoid dst aliasing after timeout Erik Dubbelboer 2026-06-13 05:47:54 +02:00
  • c7e642b843 Fix suffix byte ranges on empty files Erik Dubbelboer 2026-06-13 05:18:48 +02:00
  • 0643f42190 ci: re-enable gocritic deferInLoop check (#2288) Y.Horie 2026-06-13 12:49:39 +09:00
  • eb9bc61c6d chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 (#2291) dependabot[bot] 2026-06-11 19:58:21 +08:00
  • 9df7942bcd chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 (#2290) dependabot[bot] 2026-06-09 17:36:36 +08:00
  • 5be41c4aee chore(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 (#2289) dependabot[bot] 2026-06-09 17:30:46 +08:00
  • cb4dc24ca0 fix(client): switch to GET on 303 redirect per RFC 9110 (#2265) Y.Horie 2026-06-08 11:00:17 +09:00
  • fa2b76590b fix double release of streamed client response body (#2211) Vladislav Sedov 2026-06-07 10:11:17 +02:00
  • 60f78f517d fix(fs): remove temporary file when compression fails (#2264) Y.Horie 2026-06-07 13:36:59 +09:00
  • ebaf0e20f8 security: TLS verification silently disabled for malformed addresses (#2236) (#2274) Erik Dubbelboer 2026-06-06 22:31:37 +08:00
  • ab3bc8550d bug: filesLockMap grows unboundedly, leaking memory (#2256) (#2286) Erik Dubbelboer 2026-06-06 17:30:52 +08:00
  • 44115f3838 bug: file descriptor leak on z/OS s390x when FcntlInt fails (#2255) (#2285) Erik Dubbelboer 2026-06-06 17:30:35 +08:00
  • f3f769f74c security: SO_REUSEADDR on Windows enables port hijacking (#2254) (#2284) Erik Dubbelboer 2026-06-06 17:30:23 +08:00
  • d132fea936 bug: file descriptor leak in prefork parent process (#2253) (#2283) Erik Dubbelboer 2026-06-06 17:30:11 +08:00
  • 4cf334be95 bug: SetBodySizePoolLimit data race — plain int written without synchronization (#2252) (#2282) Erik Dubbelboer 2026-06-06 17:29:55 +08:00
  • bac672751b bug: AppendCert/AppendCertEmbed not thread-safe (#2251) (#2281) Erik Dubbelboer 2026-06-06 17:29:39 +08:00
  • 31f7138f8c bug: closeIdleConns TOCTOU race with serveConn idle timestamp (#2250) (#2280) Erik Dubbelboer 2026-06-06 17:29:29 +08:00
  • 1899b234a1 bug: fasthttpproxy dialers return nil DialFunc on error, causing panic (#2248) (#2279) Erik Dubbelboer 2026-06-06 17:28:48 +08:00
  • 4b198af059 bug: fasthttpadaptor writer leak, data race, and crash on handler panic (#2246) (#2278) Erik Dubbelboer 2026-06-06 17:28:23 +08:00
  • 4ef0547d4c bug: InMemoryListener deadlock under high concurrency (#2245) (#2277) Erik Dubbelboer 2026-06-06 17:28:07 +08:00
  • da69ed9d3f bug: body stream leak in compression methods when response is discarded (#2244) (#2276) Erik Dubbelboer 2026-06-06 17:26:48 +08:00
  • 21f66e0a2f bug: double concurrency counter increment in ServeConn causes counter leak (#2238) (#2275) Erik Dubbelboer 2026-06-06 17:26:22 +08:00
  • 82190178c8 bug: TCPDialer.tcpAddrsClean() goroutine leaks — no shutdown mechanism (#2222) (#2273) Erik Dubbelboer 2026-06-06 17:25:39 +08:00
  • eee784158a bug: data race on pipeline client c.chR during worker drain (#2220) (#2272) Erik Dubbelboer 2026-06-06 17:24:52 +08:00
  • 289229aad3 bug: FS cache cleaner goroutine leaks when CleanStop is nil (default) (#2218), #2247 (#2271) Erik Dubbelboer 2026-06-06 17:00:24 +08:00
  • 6c530c5b81 chore(deps): bump securego/gosec from 2.27.0 to 2.27.1 (#2267) dependabot[bot] 2026-06-04 11:50:24 +08:00
  • 46bfd1b9d8 fix(server): return ErrMissingFile when MultipartForm.File is nil (#2260) Y.Horie 2026-06-02 20:35:29 +09:00
  • a7d4e8d770 chore(deps): bump securego/gosec from 2.26.1 to 2.27.0 (#2261) dependabot[bot] 2026-06-02 19:33:16 +08:00
  • bf00c3e2df chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (#2207) dependabot[bot] 2026-05-24 04:42:04 +02:00
  • e4e2651d9f chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (#2208) dependabot[bot] 2026-05-24 04:34:06 +02:00
  • 533beb9338 chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#2209) dependabot[bot] 2026-05-24 04:33:48 +02:00
  • 54d5dbb463 chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#2210) dependabot[bot] 2026-05-24 04:33:30 +02:00
  • 6d7682aa72 client: add aggregate connection count metrics (#2201) Ali 2026-05-17 07:14:05 +04:00
  • c1e4fdd5b5 Update to go1.25 as minimal version (#2205) Erik Dubbelboer 2026-05-16 11:08:08 +09:00
  • e9208ecebf Revert "feat(prefork): graceful shutdown, leak fixes, hook robustness" commit v1.71.0 Erik Dubbelboer 2026-05-02 13:31:45 +02:00
  • 481e579af9 feat(prefork): Enhance prefork management with WatchMaster, CommandProducer, and Windows support (#2180) RW 2026-05-02 13:17:27 +02:00
  • 805cd10465 Add note on MaxResponseBodySize compatibility with StreamResponseBody Erik Dubbelboer 2026-05-02 07:11:35 +02:00
  • 5b5c1be52c chore(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#2196) dependabot[bot] 2026-05-01 17:24:53 +09:00
  • d6a99db432 chore(deps): bump securego/gosec from 2.25.0 to 2.26.1 (#2195) dependabot[bot] 2026-04-29 09:04:46 +02:00
  • f36c900902 header: match net/http CL+TE handling (#2190) Erik Dubbelboer 2026-04-28 11:33:01 +09:00
  • 0b4cede30f header: reject unsupported response Transfer-Encoding (#2192) Erik Dubbelboer 2026-04-28 11:28:05 +09:00
  • c497746f7d http: reject whitespace before chunk extensions (#2193) Erik Dubbelboer 2026-04-28 11:27:54 +09:00
  • 97b38d3a48 server: document SaveMultipartFile path trust requirement Erik Dubbelboer 2026-04-27 07:36:17 +02:00
  • 19e4b24955 feat: add ExpectHandler for richer Expect: 100-continue handling (#2175) Yevgeniy Miretskiy 2026-04-26 23:58:04 -04:00
  • 00410e7309 Sanitize cookie setters to prevent CRLF injection (#2185) Erik Dubbelboer 2026-04-27 12:29:14 +09:00
  • 3ac3b24635 server: keep hijacked reader out of pool (#2184) Erik Dubbelboer 2026-04-27 12:28:40 +09:00
  • 19b39dd08a Sanitize redirect Location header to prevent CRLF injection (#2186) Erik Dubbelboer 2026-04-27 12:28:30 +09:00
  • b8d29bee6e header: reject pre-colon whitespace in request headers (#2187) Erik Dubbelboer 2026-04-27 12:28:18 +09:00
  • 52131689e9 header: reject invalid trailer names (#2188) Erik Dubbelboer 2026-04-27 12:28:07 +09:00
  • 1f00bc7c28 server: apply ReadTimeout before first byte with ReduceMemoryUsage (#2183) Erik Dubbelboer 2026-04-25 10:02:03 +09:00
  • 3eab931bf1 Sanitize first-line header setters to prevent CRLF injection (#2182) Erik Dubbelboer 2026-04-25 10:01:52 +09:00
  • 6cd91f311b Match net/http sensitive header redirect policy (#2181) Erik Dubbelboer 2026-04-25 10:01:41 +09:00
  • c2e2a6c3e5 feat(client): add RetryIfErrUpstream function to handle upstream information (#2176) Max Denushev 2026-04-20 09:38:48 +03:00
  • 534461ad12 fasthttpproxy: reject CRLF in HTTP proxy CONNECT target (#2174) v1.70.0 Erik Dubbelboer 2026-04-05 14:03:35 +09:00
  • 267e740f56 fs: reject '..' path segments in rewritten paths (#2173) Erik Dubbelboer 2026-04-05 14:03:25 +09:00
  • a95a1ad11c Only normalize pre-colon whitespace for HTTP headers (#2172) Erik Dubbelboer 2026-04-04 11:24:04 +09:00
  • ab8c2aceea fix: detect master process death in prefork children (#2158) Corné Steenhuis 2026-04-01 09:59:29 +02:00
  • c4569c5fbb feat: enhance performance (#2135) RW 2026-04-01 09:19:26 +02:00
  • beab280ed3 chore(deps): bump github.com/andybalholm/brotli from 1.2.0 to 1.2.1 (#2170) dependabot[bot] 2026-04-01 16:15:58 +09:00
  • 82254a7add Normalize framing header names with pre-colon whitespace Erik Dubbelboer 2026-03-28 05:32:02 +01:00
  • 611132707f Strict HTTP version validation and simplified first line parsing (#2167) Erik Dubbelboer 2026-03-28 12:31:32 +09:00
  • eb38f5fc14 HTTP1/1 requires exactly one Host header (#2164) Erik Dubbelboer 2026-03-28 11:10:37 +09:00
  • 7d90713bda Validate request URI format during header parsing to reject malformed requests (#2168) Erik Dubbelboer 2026-03-28 11:10:23 +09:00
  • 3c43293b0c Prevent chunk extension request smuggling (#2165) Erik Dubbelboer 2026-03-28 11:10:11 +09:00
  • 95dcc31d24 docs: added httpgo to related projects (#2169) Mikhail 2026-03-26 05:46:45 +01:00
  • 389cba6472 chore(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 (#2166) dependabot[bot] 2026-03-23 06:07:01 +01:00
  • d64d07686a Prevent unnecessary logging during tests Erik Dubbelboer 2026-03-23 05:18:59 +01:00
  • d238e60fed Add ServeFileLiteral, ServeFSLiteral and SendFileLiteral (#2163) Erik Dubbelboer 2026-03-23 11:21:36 +09:00
  • e2f8a255a0 Sanitize header values in all setter paths to prevent CRLF injection (#2162) Erik Dubbelboer 2026-03-23 11:21:27 +09:00
  • 87f0fe1394 Update securego/gosec from 2.23.0 to 2.25.0 (#2161) Erik Dubbelboer 2026-03-20 15:27:24 +09:00
  • 4001e91911 Fix acquireRealZstdWriter panic Erik Dubbelboer 2026-03-16 02:35:36 +01:00
  • 1ceb192a9b Remove stripTrailingSlashes Erik Dubbelboer 2026-03-16 02:30:25 +01:00
  • 6fcfcb1ac0 export ErrConnectionClosed (#2152) pj 2026-03-04 10:40:34 +11:00
  • bed2c19699 chore(deps): bump actions/upload-artifact from 6 to 7 (#2149) dependabot[bot] 2026-02-27 05:50:32 +01:00
  • 1d3c69196c Honor Root for fs.FS and normalize fs-style roots (#2145) Erik Dubbelboer 2026-02-22 18:15:07 +01:00
  • f0d5d9a5cb Add WithLimit methods for uncompression (#2147) Erik Dubbelboer 2026-02-22 18:13:40 +01:00
  • c2b317d47d Go 1.26 and golangci-lint updates (#2146) Erik Dubbelboer 2026-02-21 10:28:39 +01:00
  • 80e3281747 fasthttpproxy: scope proxy auth cache to GetDialFunc (#2144) Erik Dubbelboer 2026-02-20 22:53:25 +01:00
  • a4ae8ef778 chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 (#2138) dependabot[bot] 2026-02-15 12:27:21 +01:00
  • 407041cba6 chore(deps): bump securego/gosec from 2.22.11 to 2.23.0 (#2142) dependabot[bot] 2026-02-12 08:45:43 +01:00
  • 5002cc2c99 chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 (#2139) dependabot[bot] 2026-02-10 08:40:19 +01:00
  • 6a47a4c24d chore(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 (#2140) dependabot[bot] 2026-02-10 08:40:04 +01:00
  • 29c900bf8c chore(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 (#2137) dependabot[bot] 2026-02-09 19:39:41 +01:00
  • 3471acf23f Limit url length in FuzzURIParse Erik Dubbelboer 2026-01-30 22:55:42 +01:00
  • 5fbda86a8e chore(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 (#2129) dependabot[bot] 2026-01-19 16:41:29 -03:00
  • a47d28f18f chore(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 (#2128) dependabot[bot] 2026-01-13 14:11:36 -03:00
  • 4df3fcd1fe chore(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 (#2125) dependabot[bot] 2026-01-09 13:15:33 -05:00
  • 21dbfe80ce return prev values (#2123) pj 2026-01-08 10:13:11 +11:00
  • 7cf1fb7967 Add documentation that modifying during iteration can panic (#2122) v1.69.0 Erik Dubbelboer 2026-01-05 11:10:34 -03:00
  • 7b5cb77b95 Add sortkeys (#2118) pj 2025-12-30 05:00:35 +11:00
  • 42f89fbefd update readme (#2114) pj 2025-12-26 11:16:03 +11:00
  • fb6b6d160c chore(deps): bump securego/gosec from 2.22.10 to 2.22.11 (#2110) dependabot[bot] 2025-12-18 16:34:33 +01:00
  • fe7e70d901 chore(deps): bump actions/upload-artifact from 5 to 6 (#2111) dependabot[bot] 2025-12-15 12:24:35 -03:00