Log message:
nghttp2: updated to 1.45.1

Nghttp2 v1.45.1

build

This release fixes packaging issues which lack some configuration files in tar \ 
archives.

Nghttp2 v1.45.0

lib

Stricter checks for :method: and :path pseudo header fields are introduced.

build

nghttp2 applications can be compiled with OpenSSL v3.0.0.

Fix warning about systemd when cmake is used.

Added build options to enable HTTP/3 and eBPF.

nghttpx

The experimental HTTP/3 support has been added.

“dnf” (= “do not forward”) parameter is added to backend option.

h2load

The experimental HTTP/3 support has been added.

SSLKEYLOGFILE environment variable support has been added.

Log message:
nghttp2: updated to 1.44.0

1.44.0:

nghttpx

The bug which prevents a backend which is excluded from a load balancing group \ 
temporarily from being restored.

The word master is replaced main. The nghttpx master process is now called main \ 
process.

--no-http2-cipher-black-list and --client-no-http2-cipher-black-list are \ 
deprecated and replaced with --no-http2-cipher-block-list and \ 
--client-no-http2-cipher-block-list respectively.

Remove trailing white space after $method log variable.

h2load

--rps option has been added.

The time unit (e.g., ms) is now allowed in -D option.

Log message:
revbump for boost-libs

Log message:
revbump for textproc/icu

Log message:
nghttp2: accept lower python3.

Upstream has only intended to reject python 2.x.

Log message:
nghttp2: updated to 1.43.0

v1.43.0:

doc

Documentations are now built with Sphinx 3.3.0 or later.

python

The python binding now requires Python 3.
All python scripts for nghttp2 development are translated to Python 3 compatible.

nghttpx

This release fixes a potential memory issue that a memory pool gets cleared \ 
while it is still in use.
ECDSA certificate is now chosen when compatible signature algorithm is available.
This release adds a workaround to include ‘:’ in backend pattern.

Log message:
Revbump packages with a runtime Python dep but no version prefix.

For the Python 3.8 default switch.

Log message:
nghttp2 nghttp2-tools: updated to 1.42.0

Nghttp2 v1.42.0

This release includes security advisory.

lib

The UBSAN errors are now fixed.

nghttp2_map is now backed by tree for storing collisions.

doc

Some clarifications are made for nghttp2_session_send function.

build

The missing cmake/FindSystemd.cmake has been added to the tar distribution.

Log message:
*: Recursive revbump from textproc/icu-68.1

Log message:
nghttp2: updated to 1.14.0

Nghttp2 v1.41.0

Security Advisory

CVE-2020-11080: Denial of service: Overly large SETTINGS frames

For more information, read the security advisory.

lib

This release implements nghttp2_option_set_max_settings API which sets the \ 
maximum number of SETTINGS entries in one SETTINGS frame to mitigate the \ 
security issue. It also moves SETTINGS flood check earlier to make it more \ 
effective.

The bug which stalls receiving stream data is fixed. Previously, if automatic \ 
window update is enabled (which is default), after window size is set to 0 by \ 
nghttp2_session_set_local_window_size, once the receiving window is exhausted, \ 
even after window size is increased by nghttp2_session_set_local_window_size, no \ 
more data cannot be received. This is because \ 
nghttp2_session_set_local_window_size does not submit WINDOW_UPDATE. It is only \ 
triggered when new data arrives but since window is filled up, no more data \ 
cannot be received, thus dead lock happens.

build

With cmake build, the hard-coded static lib suffix is now optional.

nghttpx

proxyprotocol v2 has been implemented.

The bug in getting certificate serial number with mruby script has been fixed.

h2load

New option, --connect-to, is added.