Summary

2026/10/09 : 3.4r1 (1.0.0-381.448) - BUG/MAJOR: h1-htx: report an error on a too long chunk-size line - BUG/MAJOR: mux-h2: properly handle short reads on PING frames - REGTESTS: http-messaging: Fix http_fail_cnt_body to succeed with small timeouts - BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request - BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode - BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty - BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure - BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake() - BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy() - BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut() - BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut() - BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server - BUG/MINOR: spoe: Fix the message list splice with an empty list - REGTESTS: log: check that a log-forward TCP session ends on client close - BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet - REGTESTS: cli: test a command line of exactly tune.bufsize bytes - BUG/MEDIUM: cli: fix the last command detection on a full command line - BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions - BUG/MINOR: proxy: also look for the closest option among cfg_opts3 - BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section - BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning - BUG/MINOR: cfgparse-listen: fix the argument checked by "email-alert" - BUG/MINOR: cfgparse-listen: release the previous description of the proxy - BUG/MINOR: cfgparse-global: add missing calloc() check for the global description - BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks - BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords - MINOR: doc: elaborate on diagnostic mode behavior - BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC - BUG/MINOR: h3: reject RS/SS for QPACK uni streams - BUG/MINOR: h3: close connection on GOAWAY frame too long - BUG/MINOR: h3: reject frames with truncated header - BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream - BUG/MINOR: ssl: use standard names for X25519 and X448 groups - BUG/MEDIUM: listener: Consider maxconn before waking listeners - BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC - BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC - BUG/MINOR: ssl: fix trace crash on BE conn release in io cb - BUG/MINOR: ssl: fix trace crash on FE conn release in io cb - BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN - BUG/MINOR: log: fix erroneous error message in log-steps parser - MINOR: http-ana: automatically enable http-no-delay for streaming events (SSE) - BUG/MINOR: cli: update wait help usage - BUG/MINOR: server: fix "del server" description - BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend - DOC: config: mention that url_ip and url_port fail when passed a name - DOC: config: fix doc for hex2i() converter on unparsable input - DOC: config: mention other responses not blocked by option checkcache - BUG/MINOR: sample: return the decoded JWT part when no path is given - BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer - BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies - BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext - BUG/MINOR: stick-table: do not count the lookup itself in table_trackers() - BUG/MINOR: http-ana: return a 502 when checkcache blocks a response - BUG/MINOR: sample: make quic_enabled() always succeed - BUG/MINOR: sample: zero-pad the fractional part emitted by http_date() - BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit - BUG/MINOR: http: do not consume the delimiter of a truncated q-factor - BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5) - BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5 - BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it - BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer - MINOR: stick-table: calculate the on-wire size of each key - MINOR: stick-table: provide a function to estimate on-wire data size - BUILD: haring: fix compile issue due to nop warning. - MINOR: stconn: prefer to replace endpoints rather than detaching them - BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag - BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression - MINOR: quic: implement the AEAD integrity limit - MEDIUM: jwt: Reject "none" alg in jwt_verify by default - MINOR: stats: report the SSL library FIPS mode in "show info" - MINOR: ssl: report FIPS mode in -vv for OpenSSL >= 3.0 too - MEDIUM: ssl: add fips_mode() config condition predicate - MINOR: hapee: update to new URLs - BUILD: ssl: avoid mixed declarations in the AWS-LC curve fetch - MINOR: ssl: support curve fetches with AWS-LC API 30 - REGTESTS: log: check that a ring's internal server may target a UNIX socket - BUG/MEDIUM: server: skip log backend addr checks for internal proxies - BUG/MEDIUM: sink: reconnect attempt not working after session lasted more than ~25 days - BUG/MAJOR: mux_quic: fix potential crash on RESET_STREAM receive - MINOR: log: add the +utf8 encoding option to let valid UTF-8 pass - MINOR: log: pass the input end to the _lf_encode_bytes() byte encoders - BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream - REGTESTS: log: check the escaping performed by the +json option - BUG/MEDIUM: log: encode the whole non-printable range in the +json output 2026/09/24 : 3.4r1 (1.0.0-381.364) - BUG/MEDIUM: mux_quic: activate timeout on FE init - BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception - BUG/MINOR: http-ana: restore the transaction status after early hints - BUG/MINOR: tcpcheck: refresh the start-line after updating the authority - BUG/MINOR: mux-h1: only mark C-L and T-E as sent once the header is emitted - BUG/MINOR: http-fetch: fix the space check of http_auth_bearer(<hdr>) - BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header - BUG/MINOR: http-ana: count response body failures only once in http_fail_cnt - BUG/MEDIUM: tcp-rules: ignore "capture len" rules evaluated from a backend - BUG/MEDIUM: http-act: ignore "capture len" rules evaluated from a backend - BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash chunk - BUG/MEDIUM: log: reserve the trailing 0 in CBOR int and bool encoders - REG-TESTS: http-messaging: Add a script to test interim responses for H1/H2 - BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses - BUG/MINOR: http-client: Convert server timeout ticks when setting it - BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf() - BUG/MINOR: hlua: release private Lua rule data on teardown - BUG/MAJOR: htx: Check the header/trailer length limits when one is updated - BUG/MINOR: tools: Don't try to anonymize a NULL string - BUG/MEDIUM: htx: Fix the position returned by htx_defrag() - BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed - MINOR: http-client: Add a function to notify some data were consumed - BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client - BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client - MINOR: http-client: Add an option to not stop the reception of the response - BUG/MEDIUM: http-client: Don't use the httpclient context if it was released - BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy 2026/09/19 : 3.4r1 (1.0.0-381.337) - OPTIM: tools: keep a cache of recent localtime() and gmtime() - MAJOR: filters: Revert the filter-sequence directive - BUG/MINOR: proxy: pass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults - BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield - CLEANUP: stream: Remove an excess newline in the stream dump - BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks - BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session - DOC: configuration: clarify the validity ranges of sample types - REGTESTS: http-rules: check "-m str" on a sample with an embedded \0 - BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query - BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry - BUG/MINOR: cli: Reject payload with no command - BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer - BUG/MEDIUM: cli: Don't parse next command if input buffer is empty - BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition - REGTESTS: map: check map_regm inside an ACL over an iterating fetch - BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm() - BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL - BUG/MEDIUM: http-ana: apply tunnel timeout with data filters - BUG/MINOR: h3: only increment frame type counter on new header - BUG/MINOR: h3: handle unknown frame type on request stream as specified - BUG/MINOR: h3: handle empty HEADERS frame as specified - BUG/MEDIUM: h3: do not block FIN on empty DATA frame - BUG/MINOR: h3: reject truncated frames with mandatory payload - BUG/MINOR: stream/debug: harden the stream dump function regarding signals - BUG/MEDIUM: htx: Don't reset flags when source must be preserved during transfer - BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages - BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished - BUG/MEDIUM: hlua: Never release a cosocket applet from the GC - DOC: config: clarify tune tune.bufsize doc regarding various limits - BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure - BUG/MAJOR: h3: reject H3 truncated frames - BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe - MEDIUM: mux-h1: Harden test for short data at end of stream - REGTESTS: log: check that the +cbor output passes the logged bytes through - DOC: config: mention that section 8.6 does not apply to the cbor encoding - REGTESTS: log: check which log-format tags escape control characters - REGTESTS: log: add a test for "show events -s" - MINOR: ring: add "-s" flag to "show events" to sanitize the output - BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail - BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached - BUG/MINOR: qpack: encoder and decoder stream data is never consumed - MINOR: quic: protect the ChaCha20 header protection context from being freed - CLEANUP: resolvers: stop clearing the DNS response buffer - BUG/MINOR: resolvers: classify empty truncated responses - BUN/MINOR: hlua: reset hlua_body variable after per-thread files loading - BUG/MEDIUM: filters: check the filter name before comparing it - BUG/MINOR: quic: late packets of the first key phase are dropped - BUG/MEDIUM: quic: crash on key update phase change after a failed one - BUG/MINOR: payload: bound ClientHello extension lists by the extension length - BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse() - BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames - OPTIM: server: remember the lowest known unused server ID - BUG/MINOR: cache: Seed cache primary hash - BUG/MINOR: cache: Manage collisions on primary key 2026/09/16 : 3.4r1 (1.0.0-380.282) - BUG/MEDIUM: sink: do not create one implicit ring per logger copy - BUG/MEDIUM: sink: initialize the settings of the implicit log server - BUG/MINOR: flt-http-comp: Don't read next block to detect end of data - BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters - BUG/MEDIUM: cache: ignore cache on redundant origin/referer - REGTESTS: converters: use connection: close in the has_ctl() test - MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain() - MINOR: sample: add new converter has_ctl() to detect control characters - DOC: haterm: add a missing 'haterm' build target on an example - BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages() - BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch - MEDIUM: mux-h2: don't report EOM on a short content-length message - BUG/MEDIUM: mux-h1: close the connection on a short content-length - BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2 - BUG/MINOR: hbuf: treat unexpected escape sequences as literals - BUG/MINOR: ech: fix label at end of compound statement - BUG/MEDIUM: mux-fcgi: check the room left before appending the index - BUG/MEDIUM: sink: pre-initialize the implicit log forwarding server - BUG/MINOR: resolvers: accept fields at the response boundary - BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f' - BUG/MINOR: haproxy: fix out-of-scope tmpdir usage in do_chroot() - BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy - BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter - BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate - BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL - BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC - BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals - BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls - BUG/MINOR: ssl: release the previous client cert reference at depth > 0 - BUG/MINOR: ssl: Fix leak of X509_NAME in traces - BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled - BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd - BUG/MINOR: log: fix double-free error when error in parse_loger occurs - BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB) - BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var - BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn - BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode - DOC: security: clarify that only up-to-date versions may get securty reports - BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path - BUG/MINOR: server: fix off-by-one error when parsing and copying source port range - BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval - BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches - BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches - BUG/MEDIUM: cache: do not release an entry under the cache read lock - BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row - DOC: config: clarify req.ssl_sni - BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator - BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string - BUG/MINOR: quic: drop multiple Retry on same connection - BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content - BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server - BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE() - BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree - BUG/MEDIUM: session: don't release a reversed connection twice on error - BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer - BUG/MINOR: acme: restrict the permissions of the generated account key - BUG/MINOR: ssl: reject server certificate names containing a NUL byte - BUG/MEDIUM: acme: don't delete a NULL token from the map - BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM - BUG/MINOR: jwt: don't take an extra reference on the certificate public key - BUG/MEDIUM: jwe: validate the secret length against the algorithm of the token - BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers - MINOR: log/tools: fix ambiguous comments for some log encoding helpers - BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them - BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets - BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets - BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL - BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect - BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream - BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start - DEV: haring: bound the ring geometry to the size of the file - BUG/MINOR: hlua: use a local buffer to format the socket addresses - BUG/MINOR: stats-file: reject tgid 0 when preloading shm objects - BUG/MEDIUM: hpack: encode long methods and schemes using the long form - REGTESTS: proxy: complete "del backend" test - BUG/MINOR: proxy: release watcher in various commands on CLI abort - DOC: explain better that named defaults are preserved - MINOR: proxy: implement unpublished backend keyword - BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup - BUG/MINOR: server: check strdup return value on server ID - BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering - BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all' - BUG/MINOR: ech: reject an ECH store with no usable private key - BUG/MINOR: ech: propagate error from load_echkeys() - BUG/MINOR: cli: do not reject the "/<fd>" form of "show fd" - BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd" - BUG/MEDIUM: proxy: fix crash on delete first backend - IMPORT: cebtree: private: fix the duplicate detection in the lookup shortcut - BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy() - BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy() - BUG/MINOR: server: fix QUIC on server-template - MINOR: server: improve parsing error for server-template - BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback - BUG/MEDIUM: sample: reject the deprecated protobuf group wire types - BUG/MEDIUM: peers: check the available room before encoding dict values - BUILD: ssl: Do not use SSL3_MT_KEY_UPDATE, hardcode 24 instead - BUG/MEDIUM: ssl: Put CO_ER_SSL_KEYUPDATE at the right place - DOC: ssl: Document tune.ssl.keyupdate-rate-limit - MEDIUM: ssl: Add a way to rate-limit TLSv1.3 KeyUpdate - CLEANUP: slz: clarify that the size promise applies to the stream, not to a call - BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte - BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit - BUG/MINOR: slz: do not append a block to an already finished stream - BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals - BUG/MINOR: slz: use the exact switch cost for the last literals of a block - CLEANUP: slz: fix the documented worst case size of flush() and finish() - BUG/MINOR: slz: do not read past the end of the input around the match loop - BUG/MINOR: http-rules: fix release of a failed "set-cookie-fmt" redirect rule - BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg() - BUG/MINOR: htx: Perform raw copy for messages of same size in htx_copy_msg() - BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating - BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument - BUG/MINOR: http-act: reject a negative capture id in the capture actions - BUG/MINOR: http-act: work on a copy of the sample in del-headers-bin - BUG/MINOR: http-act: restore the response buffer state in the early-hint action - BUG/MINOR: http-act: fix a double free of the map reference on a parsing error - BUG/MINOR: http-act: fix a double free of the regex on a rule parsing error - BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie parser - BUG/MINOR: h3: don't use a block pointer to roll back a partial HTX conversion - BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX conversion - BUG/MINOR: h1: report the right error position on authority/host mismatch - BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize() - BUG/MINOR: http: fix an out-of-bounds read in http_get_host_port() on empty host - BUG/MINOR: http-fetch: fix a NULL channel dereference in smp_fetch_body() - BUG/MEDIUM: http-fetch: reject a negative capture id in capture.{req,res}.hdr - BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX message - BUG/MINOR: http-htx: fix the length moved when removing a header value - BUG/MEDIUM: mux-h1: Always adjust case for all outgoing headers as expected - REORG: h1-htx: Move h1 headers map in h1-htx - DEBUG: fd: catch access attempts to closed FDs - BUG/MEDIUM: ssl: Handle non-application data record while splicing - BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly - BUG/MEDIUM: proxy: protect "show errors" against backend deletion - BUG/MINOR: resolvers: do not index resolvers names in the proxies - BUG/MEDIUM: server: Properly check for streams before deletion - CI: hapee: update list of modules - CI: hapee: run modules CI with hapee-maint-3.4r1 branch - BUG/MEDIUM: proxy: protect show backend against be deletion - BUG/MEDIUM: proxy: protect "show servers ..." against backend deletion - BUG/MEDIUM: proxy: protect "show servers ..." against server deletion - DOC: remove outdated experimental mention on dynamic backends - DOC: fix typo in "del ssl ech" command - BUG/MINOR: sample: Fix bytes() when length it greater than remaining data - BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim() - BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes() - BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift - BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent - REGTESTS: protobuf: add regression test for nested vs flat paths - BUG/MINOR: ssl: fix proxy lookup for show ssl sni - BUG/MEDIUM: protobuf: fix nested path bypass in field lookup - BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift - BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done - DOC: stats: Document that stats admin is vulnerable to a CSRF attack - BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs - BUG/MEDIUM: cache: reattach the row when a secondary entry is incomplete - DOC: stats: document the per-proxy byte count fields in the CSV list - MINOR: shctx: clamp shctx_row_data_get() reads against the offset - BUG/MINOR: shctx: fix shctx_row_data_get() when offset exceeds a block - BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope" filtering - MINOR: stats: factor the proxy vs scope check into its own function - BUG/MEDIUM: applet: Reenable reads in applet context if requesting a connection - BUG/MINOR: hlua: Apply socket timeout on server side only - MINOR: haterm: add note about QUIC usage on SSL port - BUG/MINOR: http-conv: Make url-dec failed if no space for trailing null byte - BUG/MINOR: stream: Fix custom max-retries initialization when setting backend - REGTESTS: Improve script testing the set-timeout action - BUG/MINOR: stream: Fix custom timeouts initialization when setting backend - MEDIUM: htx: Be sure size of headers never exceed regular buffer on update - MINOR: htx: Add a field to save the headers data size - BUG/MEDIUM: chunk: Review chunks usage to not retrieve a large buffer by error - MINOR: chunks: Add function to get a large/regular chunk depending on a buffer - BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size - BUG/MEDIUM: tcpcheck: Add proxy used for healthcheck sections in proxies list - BUG/MEDIUM: fd: Fix a deadlock when closing other tgroups fds - BUG/MINOR: quic: ignore STREAM after MUX closure on BE side - BUG/MEDIUM: mux_quic: complete stream shutdown for read channel - MINOR: mux_quic: use separate error code for STOP_SENDING - BUG/MEDIUM: mux_quic: do not free QCS if STOP_SENDING to sent - BUG/MINOR: trace/quic_frame: use buf, not trace_buf in chunk_frm_appendf() - MINOR: trace: always pretend to use args when disabled - MINOR: compiler: add a macro to ignore all arguments - CLEANUP: traces: get rid of a few rare empty args in TRACE calls - BUILD: quic: workaround a gcc bug saying "maybe used uninitialized" when USE_TRACE=0 - BUG/MINOR: mux_quic: prevent multiple STOP_SENDING emission per stream - BUG/MEDIUM: h3: fix parser desync on error with multiple frames - BUG/MINOR: http-htx: Don't by-pass HTX API when merging cookie values - BUG/MINOR: mux-quic: Fix handling EOM after in qcs_http_rcv_buf() - BUG/MAJOR: htx: Don't swap buffers for empty HTX message with an error - BUG/MINOR: tools: fix invalid character detection in strl2ic() - BUG/MINOR: init: fix default global settings being overwritten by -G - MINOR: hbuf: new lightweight hbuf API - BUG/MEDIUM: servers: Use a refcount for port_range and free it properly - BUG/MINOR: sample: set SMP_F_CONST on srv_name fetch - BUG/MEDIUM: server: initialise agent.health in srv_settings_init() - BUG/MINOR: hq-interop: support transcoding of absolute URI - BUG/MINOR: hq-interop: fix transcoding of wrapping response buffer - BUG/MEDIUM: mux_quic: fix memory leak of rx app_buf on stream free - BUG/MEDIUM: mux-quic: Drain the given amount of data in qcs_http_reset_buf() - BUG/MEDIUM: mux-spop: Truly drain outgoing data when the stream is closed - BUG/MEDIUM: mux-h2: Truly drain outgoing HTX data when the stream is closed - BUG/MEDIUM: mux-fcgi: Truly drain outgoing HTX data when the stream is closed - REGTESTS: quic: test H3 request without content-length - BUG/MEDIUM: h3: increment unknown request payload length - DOC: lua: remove incorrect init tags - BUG/MINOR: hq-interop: support response buffer wrapping - BUG/MINOR: hq-interop: support full demux buf on large response - BUG/MEDIUM: hlua: Properly report EOS when http applet exits - BUG/MINOR: hq-interop: prevent reset if missing content-length - BUG/MINOR: hq-interop: reject too big content - BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp - BUG/MEDIUM: http-act: Make a copy of the sample expr in (set/add)-headers-bin - BUG/MEDIUM: mux_quic: fix freeze transfer after QCS rxbuf realign - BUG/MINOR: hpack-tbl: add missing NULL check after hpack_dht_defrag() - BUG/MEDIUM: ssl: Don't free the early data buffer too early - BUG/MINOR: quic: fix rxbuf settings on backend side - BUG/MINOR: mux-h1: Properly resolve file path for 'h1-case-adjust-file' - BUG/MEDIUM: http-ana: Don't ignore L7 retry errors - BUG/MINOR: http-ana: Remove a debugging memset on redirect - BUG/MINOR: server: fix add server with consistent hash balancing - BUG/MEDIUM: h3: Properly handle PUSH_PROMISE on backend connections - BUG/MINOR: cpu-topo: use ha_diag_notice() to report thread creations - MINOR: errors: add ha_diag_notice() to report diag-level notifications - BUG/MEDIUM: ktls: defer enabling TLS ULP on a socket until connected - BUG/MEDIUM: acme: stuck ACME task when authz is already "valid" - BUG/MINOR: quic: fix Initial length value in sent packets - REGTESTS: Fix log matching in healthcheck-section.vtc - BUG/MEDIUM: checks: Dequeue checks on purge - BUG/MINOR: acl: report "ACL" not "map" in ACL ID lookup failures - CLEANUP: sessions: simplify the sess_priv_conns pool name - BUG/MEDIUM: xprt_qmux: implement ->get_ssl_sock_ctx() to get the SSL laye - BUG/MEDIUM: threads: Fiw build when using no thread - BUG/MEDIUM: regex: initialize the match array earlier during boot - REGTESTS: checks: Add script for external healthchecks - BUG/MINOR: tcpcheck: Override external check if healthcheck section is set - BUG/MINOR: mux_quic: do not interrupt recv on error/incomplete data - BUG/MEDIUM: mux_quic: prevent risk of infinite loop on recv - BUG/MEDIUM: server/checks: Support healtcheck keyword on default-server lines - MINOR: check: Don't dump buffers state in check traces for external checks - BUG/MEDIUM: check: Ignore small-buffer option when starting an external check - BUG/MEDIUM: check: Skip tcpcheck post-config for external checks - CLEANUP: hapee: remove 51d, deviceatlas and wurfl addons - MINOR: log: add app_log_raw() and send_log_raw() for binary-safe logging - CI: hapee: update list of modules - CI: hapee: compile lb with USE_PCRE2 - CI: hapee: add more modules in the CI - CI: hapee: add more modules in the CI - CI: hapee: name the vtest pipeline - CI: hapee: add the SAST to the gitlab-ci dispatcher - CI: hapee: Configure SAST in sast.yml - CI: hapee: .gitlab-ci.yml becomes a dispatcher - CI: hapee: trigger modules in the CI pipeline - CI: hapee: simple CI that compiles HAProxy - MINOR: hapee/modules: report the per-stream allocated size for each module - BUG/MEDIUM: hapee: prevent the module file name being overwritten - MEDIUM: hapee: HAPEE_MODULE_DECLARE() allows to declare an HAPEE module - BUG/MINOR: hapee: Makefile: bad substitution for MODVERSION variable - BUG/MINOR: hapee: relax __vers symbol check - BUG/MINOR: hapee/modules: can't load modules with USE_OBSOLETE_LINKER - BUG/MINOR: hapee: remove leading \n on __vers error - MEDIUM: hapee: warn on unsupported initcalls - BUG/MINOR: hapee: forbid to load a module twice - HAPEE: udp: update structs and functions required for the UDP module - HAPEE: makefile: automatically build objects in addons/hapee_* - HAPEE: makefile: update the cleanup rule to also remove *.i from addons - HAPEE: addons: quic CID in -vv - HAPEE: addons: adds quic CID generator to interop with packetshield - MEDIUM: hapee: does not pass OPTION_LDFLAGS to modules - MINOR: hapee/modules: check if we generate the API hash correctly - BUG/MINOR: hapee/modules: adjust include match() in gen-modules-config-h.awk - BUG/MINOR: hapee/modules: initialize the module head list - BUILD: hapee/modules: select either md5 or md5sum - MEDIUM: hapee/modules: load the STG_REGISTER initcalls - BUG/MINOR: hapee/modules: display detailed error message on mod_init() failure - MINOR: hapee/modules: add a new label MODULES_LOCK to the lock_label enum - MINOR: hapee/modules: add the ability to register variable and functions. - MEDIUM: hapee/modules: 'modules list' on the cli shows currently loaded modules - MINOR: hapee/modules: terminate properly loaded modules if possible - MEDIUM: hapee/modules: add memory reservation support for the modules - BUILD: hapee/modules: update HAPEE version macro to 3.4r1 - BUILD: hapee/modules: add macros to compute numerical value of a HAPEE version - BUILD: hapee/modules: add version of the module in the defines - MEDIUM: hapee/modules: add modules support