Changelog for libnghttp2-devel-1.50.0-1.1.x86_64.rpm :

* Sat Sep 24 2022 Dirk Müller - update to 1.50.0:
* https://nghttp2.org/blog/2022/09/21/nghttp2-v1-50-0/ This release adds nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation which disables checking leading and trailing white spaces against HTTP field value.
* Fri Sep 23 2022 Dirk Müller - disable asio by default as it is deprecated by upstream and will be removed in the next release
* Mon Aug 22 2022 Dirk Müller - update to 1.49.0:
* https://nghttp2.org/blog/2022/08/22/nghttp2-v1-49-0/
* Mon Jul 11 2022 Dirk Müller - update to 1.48.0:
* lib: Allow server to override RFC 9218 stream priority
* lib: Add a server option to fallback to RFC 7540 priorities
* lib: Add PRIORITY_UPDATE frame support
* lib: Implement RFC 9218 extensible prioritization scheme
* lib: Do not verify host field specific characters for response field
* lib: No rfc7540 priorities
* lib: Fix stream stall when initial window size is decreased
* doc: Document how to change stream prioritization scheme
* build: Compile with libressl 3.5
* build: EXTRA_DIST: List mruby files explicitly
* build: Bump ngtcp2 and nghttp3
* build: Do not check application libraries if --enable-lib-only is given
* src: Update default TLS cipher suites
* nghttpx, h2load: Better pack UDP packets in one GSO write
* nghttpx, h2load: Quic error handling
* nghttpx, h2load: Fix QUIC performance regression
* nghttp, nghttpd, nghttpx: Add ktls support
* h2load: Send more packets without GSO per event loop
* h2load: Add ktls support
* nghttpd: Fix TLS read stall
* nghttpx: Disable RFC 7540 priorities
* nghttpx: Client always uses simpler TLS handshake
* nghttpx: Add affinity-cookie-stickiness backend parameter
* nghttpx: Fix broken session affinity
* nghttpx: Limit CONNECTION_CLOSE and Retry under server amplification limit
* integration: Go update
* integration: Add go.mod
* third-party: Bump llhttp to 75b45129db961e1fb3c56044e1b8f7721bfaee5d
* third-party: Bump libbpf to v0.8.0
* third-party: Bump mruby to 3.1.0
* third-party: Bump neverbleed based on the latest head (GH-1708)
* Sun Mar 20 2022 Dirk Müller - update to 1.47.0:
* see https://nghttp2.org/blog/2022/02/23/nghttp2-v1-47-0/
* Sat Dec 18 2021 Dirk Müller - update to 1.46.0:
* see https://nghttp2.org/blog/2021/07/18/nghttp2-v1-44-0/
* see https://nghttp2.org/blog/2021/09/20/nghttp2-v1-45-0/
* see https://nghttp2.org/blog/2021/10/19/nghttp2-v1-46-0/
* Thu Feb 04 2021 Dirk Müller - update to 1.43.0:
* doc: Make doc generation work with sphinx v3.3
* python: Require python3 for python bindings
* python: Require python3 for python scripts
* nghttpx: Make sure that Pool gets cleared when all buffers are returned
* nghttpx: Choose ECDSA cert if compatible signature algorithm available
* nghttpx: Add workaround to include \':\' in backend pattern
* Wed Jan 06 2021 Dirk Müller - update to 1.42.0:
* lib: fix ubsan errors (Patch from Asra Ali) (GH-1468)
* lib: Don\'t send RST_STREAM to idle stream (GH-1477)
* lib: nghttp2_map backed by nghttp2_ksl
* doc: Update sphinx_rtd_theme
* doc: nghttp2_session_send is also affected by max concurrent streams (Patch from Tomas Krizek) (GH-1489)
* doc: clarify flow control behaviour for nghttp2_session_send() (Patch from Tomas Krizek) (GH-1488)
* build: Add missing cmake/FindSystemd.cmake to dist (GH-1526)
* third-party: Bump llhttp to 2.2.0
* third-party: Bump mruby to 2.1.2
* nghttpx: Deal with the case when h2 backend is retired before it is initialized
* nghttpx: Add accesslog variables to record request path without query (GH-1511)
* nghttpx: Fix stall when TLS follows after proxy protocol
* nghttpx: Fix logging integer
* Wed Jun 03 2020 Paolo Stivanin - Update to 1.41.0
* Fix CVE-2020-11080
* lib: Implement max settings option (Patch from James M Snell)
* lib: Earlier check for settings flood (Patch from James M Snell)
* lib: Fix receiving stream data stall (GH-1444)
* build: cmake: Make hard-coded static lib suffix optional (Patch from Viktor Szakats) (GH-1418)
* third-party: Bump llhttp to 2.0.4 (GH-1442)
* nghttpx: Add PROXY-protocol v2 support (GH-1452)
* nghttpx: Fix get_x509_serial for long serial numbers (Patch from Jacky Tian) (GH-1455)
* h2load: Allow port in --connect-to
* h2load: add --connect-to option (Patch from Lucas Pardue) (GH-1426)
* Tue Jan 14 2020 Michał Rostecki - Update to version 1.40.0
* lib: Add nghttp2_check_authority as public API
* lib: Fix the bug that stream is closed with wrong error code
* lib: Faster huffman encoding and decoding
* build: Avoid filename collision of static and dynamic lib
* build: Add new flag ENABLE_STATIC_CRT for Windows
* build: cmake: Support building nghttpx with systemd
* third-party: Update neverbleed to fix memory leak
* nghttpx: Fix bug that mruby is incorrectly shared between backends
* nghttpx: Reconnect h1 backend if it lost connection before sending headers
* nghttpx: Returns 408 if backend timed out before sending headers
* nghttpx: Fix request stal
* Fri Aug 30 2019 Martin Pluskal - Conditionally remove dependecy on jemalloc for SLE-12
* Mon Aug 19 2019 Martin Pluskal - Require correct library from devel package - boo#1125689
* Mon Aug 19 2019 Adam Majer - Update to version 1.39.2 (bsc#1146184, bsc#1146182):
* This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack.
* Add nghttp2_option_set_max_outbound_ack API function
* nghttpx: Fix request stall
* Tue Aug 13 2019 Martin Pluskal - Update to version 1.39.1:
* This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend.- Changes for version 1.39.0:
* libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230.
* mruby has been upgraded to 2.0.1.
* libnghttp2-asio now supports boost-1.70.
* http-parser has been replaced with llhttp.
* nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT.- Drop no longer needed boost170.patch
* Fri May 10 2019 Tomáš Chvátal - Update to 1.38.0:
* This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
* It also fixes the bug that HTTP/1.1 chunked request stalls.
* Now nghttpx does not log authorization request header field value with -LINFO.
* This release fixes possible backend stall when header and request body are sent in their own packets.
* The backend option gets weight parameter to influence backend selection.
* This release fixes compile error with BoringSSL.- Add patch from upstream to build with new boost bsc#1134616:
* boost170.patch
* Fri Jan 18 2019 seanlewAATTopensuse.org- Update to 1.36.0
* build: disable shared library if ENABLE_SHARED_LIB is off
* third-party: use http-parser to v2.9.0 (GH-1294)
* third-party: Update mruby to 2.0.0
* nghttpx: Pool h1 backend connection per address (GH-1292)
* nghttpx: Randomize backend address round robin order per thread (GH-1291)
* nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287)
* h2load: add an option to write per-request logs (GH-1256)
* asio: added access to # of the current server port (GH-1257)
* Fri Jan 18 2019 Tomáš Chvátal - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system
* Fri Jan 11 2019 Martin Pluskal - Update to version 1.35.1:
* nghttpx: Fix broken trailing slash handling (GH-1276)- Changes for version 1.35:
* build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
* lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
* src: Require C++14 language feature
* nghttpx: Write mruby send_info early
* nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
* h2load: Handle HTTP/1 non-final response (GH-1259)
* h2load: Clarify that time for connect includes TLS handshake
* Mon Oct 08 2018 adam.majerAATTsuse.de- Update to version 1.34.0: (bsc#1112438, FATE#326776)
* lib: Implement RFC 8441 :protocol support
* nghttpx: Add read/write-timeout parameters to backend option
* nghttpx: Fix mruby parameter validation in backend option
* nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
* nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
* nghttpx: Update mruby 1.4.1
* nghttpx: Add mruby env.tls_handshake_finished
* nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
* nghttpx: Add RFC 8470 Early-Data header field support
* nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support
* Wed Sep 26 2018 adam.majerAATTsuse.de- Update to version 1.33.0:
* lib: Tweak nghttp2_session_set_stream_user_data
* lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
* lib: Implement ORIGIN frame
* asio: support definition of local endpoint for cleartext client session
* integration: Remove remaining SPDY code from the integration tests
* nghttpx: Fix worker process crash with neverbleed write error
* nghttpx: Support per-backend mruby script
* nghttpx: Fix stream reset if data from client is arrived before dconn is attached
* Mon Jul 09 2018 mpluskalAATTsuse.com- Update to version 1.32.0:
* lib: Ignore all input after calling session_terminate_session
* lib: Fix treatment of padding
* lib: Don\'t allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade
* build: add ENABLE_STATIC_LIB option to build static lib
* third-party: Upgrade neverbleed to the latest master
* asio: Support client side SNI
* src: Compile with libressl 2.7.2
* src: Allow building without NPN
* h2load: -r and --duration are mutually exclusive
* Fri Apr 13 2018 tchvatalAATTsuse.com- Version umpdate to 1.31.1:
* Fix bsc#1088639 CVE-2018-1000168
* https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
* Mon Apr 09 2018 tchvatalAATTsuse.com- Version update to 1.31.0:
* lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
* src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
* nghttpx: Close listening socket on graceful shutdown
* nghttpx: Add an option to accept expired client certificate (GH-1126)
* nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
* nghttpx: Fix potential memory leak
* lib: Allow PING frame to be sent after GOAWAY (GH-1103)
* nghttpx: Fix bug that h1 backend idle timeout expires sooner
* nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
* nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
* nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
* nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)
* Mon Apr 09 2018 tchvatalAATTsuse.com- Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0
* Thu Feb 22 2018 fvogtAATTsuse.com- Use %license (boo#1082318)
* Fri Jan 05 2018 mpluskalAATTsuse.com- Update to version 1.29.0:
* lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY
* build: Remove SPDY
* build: Fix CMAKE_MODULE_PATH
* nghttpx: Revert \"nghttpx: Use an existing h2 backend connection as much as possible\"
* nghttpx: Write API request body in temporary file
* nghttpx: Increase api-max-request-body
* nghttpx: Faster configuration loading with lots of backends
* nghttpx: Fix crash with --backend-http-proxy-uri option