http2-5.4.6: ChangeLog.md

# ChangeLog for http2

## 5.4.6

* Security: a regression in 5.4.5. Since stream errors reset the stream
  rather than the connection, a peer could have the server reset streams
  for it -- with a PRIORITY on a stream depending on itself, DATA on a
  half-closed stream, and the like -- and so free concurrency slots while
  the handlers went on running, without ever sending RST_STREAM itself
  (MadeYouReset, CVE-2025-8671). Resets we send because of the peer now
  count against `rstRateLimit` with the peer's own.
  [#190](https://github.com/kazu-yamamoto/http2/pull/190)
* Security: a PRIORITY frame for a stream that was never opened created
  the stream and took a concurrency slot for good, so 64 PRIORITY frames
  were enough to have every later request refused.
  [#195](https://github.com/kazu-yamamoto/http2/pull/195)
* Security: a SETTINGS_INITIAL_WINDOW_SIZE that overflowed a stream's
  window stopped the sender without a word, leaving the connection open
  and silent. It is now a connection error of type FLOW_CONTROL_ERROR,
  and any failure of the sender closes the connection.
  [#196](https://github.com/kazu-yamamoto/http2/pull/196)
* The HPACK dynamic table lost entries, or had the encoder send the wrong
  one (index 61 of the static table), once it held as many entries as it
  has room for -- which a small or odd SETTINGS_HEADER_TABLE_SIZE from the
  peer makes easy. Headers were silently wrong on both sides.
  [#192](https://github.com/kazu-yamamoto/http2/pull/192)
* A Huffman-coded string of 16K or more was corrupted by the encoder: the
  length's fourth octet overwrote the start of the code.
  [#188](https://github.com/kazu-yamamoto/http2/pull/188)
* Header blocks and trailers larger than a frame are sent and received as
  HEADERS and CONTINUATION frames, and the header blocks of streams that
  are already reset are still decoded, so that the HPACK tables stay in
  step. Thanks to Edsko de Vries.
  [#187](https://github.com/kazu-yamamoto/http2/pull/187)
  [#189](https://github.com/kazu-yamamoto/http2/pull/189)
* A race between the receiver and the sender lost a stream's half-closed
  state, so that it was never removed from the stream table: with both
  ends streaming, a client ran out of streams and a server refused every
  new one.
  [#193](https://github.com/kazu-yamamoto/http2/pull/193)
* A client no longer rejects a response that has no content but a
  non-zero content-length, as responses to HEAD and 304 responses do.
  [#194](https://github.com/kazu-yamamoto/http2/pull/194)
* A client request that failed before it was queued -- a `requestFile` for
  a file that cannot be opened, say -- made every later request on the
  connection wait for ever.
  [#198](https://github.com/kazu-yamamoto/http2/pull/198)
* Server push: a PUSH_PROMISE could come after the response it belongs
  to, and pushed streams were never closed, so a connection stopped after
  64 pushes.
  [#199](https://github.com/kazu-yamamoto/http2/pull/199)
* An upload through `runIO` larger than the stream's window was cut short
  with END_STREAM after the first window's worth.
  [#200](https://github.com/kazu-yamamoto/http2/pull/200)
* GHC 9.12 and later, with `-O`, miscompile a value holding a
  never-returning streaming body into one with no body
  ([GHC #27857](https://gitlab.haskell.org/ghc/ghc/-/work_items/27857)).
  The test suite works around it.
  [#197](https://github.com/kazu-yamamoto/http2/pull/197)

## 5.4.5

* Security: frame payload decoders read their fixed-size fields without
  checking that the payload holds them, so a truncated frame, or padding
  covering a field, read past the end of the buffer -- and an empty payload
  is the shared empty `ByteString`, whose pointer is null. An
  unauthenticated peer could segfault the process with 33 bytes.
  [#182](https://github.com/kazu-yamamoto/http2/pull/182)
* Security: HPACK integer decoding overflowed `Int` silently, so a long
  enough encoding decoded to whatever value the sender aimed at and two
  different byte strings could decode to the same header. Integers are now
  bounded and over-long encodings are a decoding error, as RFC 7541
  section 5.1 requires.
  [#181](https://github.com/kazu-yamamoto/http2/pull/181)
* A RST_STREAM gave a stream's concurrency slot back twice, so a peer could
  walk `SETTINGS_MAX_CONCURRENT_STREAMS` upwards and hold open as many
  streams as it liked.
  [#178](https://github.com/kazu-yamamoto/http2/pull/178)
* A stream reset while its response was still being produced left the
  worker blocked until the timeout manager killed it, one thread per reset
  stream.
  [#179](https://github.com/kazu-yamamoto/http2/pull/179)
* Stream errors now reset the stream and the connection carries on, as
  RFC 9113 section 5.4.2 requires. A field block abandoned part-way is
  still a connection error, since the HPACK tables have diverged by then.
  [#183](https://github.com/kazu-yamamoto/http2/pull/183)
* A stream over `SETTINGS_MAX_CONCURRENT_STREAMS` is refused with
  RST_STREAM(REFUSED_STREAM) rather than ending the connection.
  [#184](https://github.com/kazu-yamamoto/http2/pull/184)
* `DecodeError` has a new constructor, `TooLargeInteger`. Strictly this is
  a breaking change -- an exhaustive match on `DecodeError` no longer
  compiles -- but it ships as a patch version on purpose: no package on
  Hackage names any constructor of that type, while a minor bump would
  shut out every dependant carrying a `< 5.5` bound, these security fixes
  along with it.
* A malformed request now reaches a client as `StreamResetIsReceived` on
  the stream it concerns, where it used to arrive as
  `ConnectionErrorIsReceived` on the connection.

## 5.4.4

* Improvements for dealing with RST_STREAM
  [#172](https://github.com/kazu-yamamoto/http2/pull/172)

## 5.4.3

* auxSendInformational: gate usage with CPP to http-semantics >= 0.4.1
  [#170](https://github.com/kazu-yamamoto/http2/pull/170)

## 5.4.2

* Support informational (1xx) responses, e.g. 103 Early Hints. Servers can send
  them via `auxSendInformational`; clients can observe them via the new
  `confOnInformational` callback in `Config`.
  [#168](https://github.com/kazu-yamamoto/http2/pull/168)

## 5.4.1

* Ensure sender notices when receiver has terminated.
  [#167](https://github.com/kazu-yamamoto/http2/pull/167)

## 5.4.0

* Providing `defaultConfig`.
* Except the item above, this version is identical to v5.3.11 which
 includes breaking changes and is thus deprecated.

## 5.3.11

* Implementing `auxSendPing` for client.
* Server and client terminates their threads in the right order.
* Using `copy` in frame decoders to avoid potential fragmentation of
  `ByteString`.
* Defining `confReadNTimeout` (default to `False`). If `confReadN`
  implements timeout by itself, set it to `True`.
* TCP closing is now treaated as `ConnectionIsClosed` instead of
  `ConnectionIsTimeout`.
* GOAWAY now contains a right last streamd ID.

## 5.3.10

* Introducing closure.
  [#157](https://github.com/kazu-yamamoto/http2/pull/157)

## 5.3.9

* Using `ThreadManager` of `time-manager`.

## 5.3.8

* `forkManagedTimeout` ensures that only one asynchronous exception is
  thrown. Fixing the thread leak via `Weak ThreadId` and `modifyTVar'`.
  [#156](https://github.com/kazu-yamamoto/http2/pull/156)

## 5.3.7

* Using `withHandle` of time-manager.
* Getting `Handle` for each thread.
* Providing allocSimpleConfig' to enable customizing WAI tiemout manager.
* Monitor option (-m) for h2c-client and h2c-server.

## 5.3.6

* Making `runIO` friendly with the new synchronism mechanism.
  [#152](https://github.com/kazu-yamamoto/http2/pull/152)
* Re-throwing asynchronous exceptions to prevent thread leak.
* Simplifying the synchronism mechanism between workers and the sender.
  [#148](https://github.com/kazu-yamamoto/http2/pull/148)

## 5.3.5

* Using `http-semantics` v0.3.
* Deprecating `numberOfWorkers`.
* Removing `unliftio`.
* Avoid `undefined` in client.
  [#146](https://github.com/kazu-yamamoto/http2/pull/146)

## 5.3.4

* Support stream cancellation
  [#142](https://github.com/kazu-yamamoto/http2/pull/142)

## 5.3.3

* Enclosing IPv6 literal authority with square brackets.
  [#143](https://github.com/kazu-yamamoto/http2/pull/143)

## 5.3.2

* Avoid unnecessary empty data frames at end of stream
  [#140](https://github.com/kazu-yamamoto/http2/pull/140)
* Removing unnecessary API from ServerIO

## 5.3.1

* Fix treatment of async exceptions
  [#138](https://github.com/kazu-yamamoto/http2/pull/138)
* Avoid race condition
  [#137](https://github.com/kazu-yamamoto/http2/pull/137)

## 5.3.0

* New server architecture: spawning worker on demand instead of the
  worker pool. This reduce huge numbers of threads for streaming into
  only 2. No API changes but workers do not terminate quicly. Rather
  workers collaborate with the sender after queuing a response and
  finish after all response data are sent.
* All threads are labeled with `labelThread`. You can see them by
  `listThreads` if necessary.

## 5.2.6

* Recover rxflow on closing.
  [#126](https://github.com/kazu-yamamoto/http2/pull/126)
* Fixing ClientSpec for stream errors.
* Allowing negative window. (h2spec http2/6.9.2)
* Update for latest http-semantics
  [#122](https://github.com/kazu-yamamoto/http2/pull/124)

## 5.2.5

* Setting peer initial window size properly.
  [#123](https://github.com/kazu-yamamoto/http2/pull/123)

## 5.2.4

* Update for latest http-semantics
  [#122](https://github.com/kazu-yamamoto/http2/pull/122)
* Measuring performance concurrently for h2c-client

## 5.2.3

* Update for latest http-semantics
  [#120](https://github.com/kazu-yamamoto/http2/pull/120)
* Enable containers 0.7 (ghc 9.10)
  [#117](https://github.com/kazu-yamamoto/http2/pull/117)

## 5.2.2

* Mark final chunk as final
  [#116](https://github.com/kazu-yamamoto/http2/pull/116)

## 5.2.1

* Using time-manager v0.1.0.
  [#115](https://github.com/kazu-yamamoto/http2/pull/115)

## 5.2.0

* Using http-semantics
  [#114](https://github.com/kazu-yamamoto/http2/pull/114)
* `Header` of `http-types` should be used as high-level header.
* `TokenHeader` of `http-semantics` should be used as low-level header.
* Breaking change: `encodeHeader` takes `Header` of `http-types`.
* Breaking change: `decodeHeader` returns `Header` of `http-types`.
* Breaking change: `HeaderName` as `ByteString` is removed.

## 5.1.4

* Using network-control v0.1.

## 5.1.3

* Defining SendRequest type synonym.
  [#111](https://github.com/kazu-yamamoto/http2/pull/111)

## 5.1.2

* Make ping rate limit configurable
  [#108](https://github.com/kazu-yamamoto/http2/pull/108)

## 5.1.1

* Deal with RST_STREAM in HalfClosedLocal state
  [#107](https://github.com/kazu-yamamoto/http2/pull/107)

## 5.1.0

* Drop frames after reset
  [#106](https://github.com/kazu-yamamoto/http2/pull/106)
* BREAKING CHANGE: Use String for Authority
  [#105](https://github.com/kazu-yamamoto/http2/pull/105)
* Properly close streams
  [#104](https://github.com/kazu-yamamoto/http2/pull/104)

## 5.0.1

* Allowing bytestring 0.12.

## 5.0.0

* Using the network-control package.
* The limits of resources can be specified in ServerConfig and ClientConfig.
* Open streams based on peer's MaxStreams.
* Rejecting Data if it is over the receiving limit.
* Informing MaxStreams properly.
* Informing WindowUpdate properly.
* New API: Server.Internal.runIO and Client.Internal.runIO.

## 4.2.2

* Adding rate limit for RST_STREAM to work around CVE-2023-44487.
  [#94](https://github.com/kazu-yamamoto/http2/pull/94)

## 4.2.1

* This version is identical to v4.2.0 by accident.

## 4.2.0

* Treating HALF_CLOSED_LOCAL correctly.
  [#90](https://github.com/kazu-yamamoto/http2/pull/90)
* Ensuring that GOAWAY is sent after DATA in the client side.
  [#89](https://github.com/kazu-yamamoto/http2/pull/90)
* Test uses a random port instead of 8080.
* Breaking change: adding two optional `SockAddr`s to `Config` to be copied into `Aux`.
* Close all streams on termination.
  [#83](https://github.com/kazu-yamamoto/http2/pull/83)
* Introducing `OutBodyStreamingUnmask`
  [#80](https://github.com/kazu-yamamoto/http2/pull/80)
* Introducing `KilledByHttp2ThreadManager` instead of `ThreadKilled`.
  [#79](https://github.com/kazu-yamamoto/http2/pull/79)
  [#81](https://github.com/kazu-yamamoto/http2/pull/81)
  [#82](https://github.com/kazu-yamamoto/http2/pull/82)
* Handle RST_STREAM with NO_ERROR.
  [#78](https://github.com/kazu-yamamoto/http2/pull/78)
* Internal changes:
  [#74](https://github.com/kazu-yamamoto/http2/pull/74)
* Breaking change: `Client` is generalized into `(forall b. Request -> (Response -> IO b) -> IO b) -> IO a`. The `RankNTypes` language extension is required.
  [#72](https://github.com/kazu-yamamoto/http2/pull/72)

## 4.1.3

* Using crypton instead of cryptonite.

## 4.1.2

* Removing the race of frameSender and frameReceiver in the server side.
  This fixes the loss of RST_Stream and TLS bad MAC error.
  [#67](https://github.com/kazu-yamamoto/http2/pull/67)

## 4.1.1

* Fixing memory-blow-up due to no flow control.
  [#62](https://github.com/kazu-yamamoto/http2/issues/62)
  [#66](https://github.com/kazu-yamamoto/http2/issues/66)

## 4.1.0

* Implementing streaming from the client side.
  [#41](https://github.com/kazu-yamamoto/http2/pull/41)
* Making use of SettingsMaxFrameSize
  [#44](https://github.com/kazu-yamamoto/http2/pull/44)
  [#57](https://github.com/kazu-yamamoto/http2/pull/57)
* Disabling flow control
  [#55](https://github.com/kazu-yamamoto/http2/pull/55)
* Fixing buffer overrun by trailers
  [#52](https://github.com/kazu-yamamoto/http2/pull/52)
* Proper use of settings
* Breaking change: the data structure of `Next` was changed.
  The `http3` package is influenced.

## 4.0.0

* Breaking change: `HTTP2Error` is redefined.
* Breaking change: `FrameTypeId`, `SettingsKeyId` and `ErrorCodeId` are removed.
  Use `FrameType`, `SettingsKey` and `ErrorCode` instead.
* A client can receive a concrete `HTTP2Error`.
* Catching up RFC 9113. Host: and :authority cannot disagree.
* Breaking change: `Network.HTTP2` and `Network.HTTP2.Priority` are removed.
* Breaking change: obsoleted stuff are removed.

## 3.0.3

* Return correct status messages in HTTP2 client
  [#31](https://github.com/kazu-yamamoto/http2/pull/31)
* Follow changes in Aeson 2
  [#32](https://github.com/kazu-yamamoto/http2/pull/32)
* Make sure connection preface is always sent first
  [#33](https://github.com/kazu-yamamoto/http2/pull/33)
* Avoid empty data
  [#34](https://github.com/kazu-yamamoto/http2/pull/34)

## 3.0.2

* Skip inserting entries that do not fit in the encoding table
  [#28](https://github.com/kazu-yamamoto/http2/pull/28)

## 3.0.1

* Including a necessary file for testing.

## 3.0.0

* DOS preventions.
* Providing Network.HTTP.Client.
* `Internal` modules are exported.
* Dropping the priority feature from Network.HTTP.Server.
* `Network.HTTP2.Priority` is deprecated.
* `Network.HTTP2` module is deprecated. Use `Network.HTTP2.Frame` instead.
* Adding some tokens.

## 2.0.6

* Dropping support of GHC 7.x

## 2.0.5

* Passing the correct request

## 2.0.4

* Freeing dynamic tables.

## 2.0.3

* Using shutdown instead of close in the example. This is important to
  send GOAWAY properly.

## 2.0.2

* Bug fix of flush limit.

## 2.0.1

* Bug fix for defaultReadN.
* Providing allocSimpleConfig and freeSimpleConfig.
* Deprecating makeSimpleConfig.

## 2.0.0

* Providing Network.HTTP.Server.

## 1.6.5

* Deny shrink of dynamic table to zero size
  [#17](https://github.com/kazu-yamamoto/http2/pull/17)

## 1.6.4

* checkFrameHeader for FrameHeaders.
  [#15](https://github.com/kazu-yamamoto/http2/pull/15)

## 1.6.3

* Fixing two bugs of HPACK pointed out by h2spec v2.

## 1.6.2

* Improving the performance of HPACK.
* Huffman encoding is now based on H2O's one.

## 1.6.1

* Improving the performance of HPACK.

## 1.6.0

* Reverse indices of HPACK are now based on tokens.
* New APIs: encodeTokenHeader and decodeTokenHeader.
* Deleted API: encodeHeaderBuffer -- use encodeTokenHeader instead.
* New module: Network.HPACK.Token

## 1.5.4

* Fixing a bug due to misuse of memcpy(). (#8)

## 1.5.3

* Adding debug information.

## 1.5.2

* Minor optimization for HPACK.

## 1.5.1

* Adding a missing file for testing.

## 1.5.0

* New API for HPACK. HPACK is much faster than 1.4.x (roughly x3.2).
  The default encoding is now Linear instead of LinearH.

## 1.4.5

* Removing zero reset from priority queues.

## 1.4.4

* Fixing a bug of reverse index.

## 1.4.3

* Priority benchmark is now external information versions.
* Using proper baseDeficit for deletion.

## 1.4.2

* Test files are now self-contained.

## 1.4.1

* The reverse indices for static and dynamic are combined for performance.

## 1.4.0

* Providing dequeueSTM, isEmpty and isEmptySTM. Users can compose
  their own control queue with dequeueSTM and isEmptySTM.

* Removing enqueueControl: it appeared that PriorityTree is not
  suitable for control frames. 　For example, the dependency of all
  control frames is stream 0.  So, PSQ does not contain multiple
  control frames at the same time.  We removed enqueueControl. Users
  should prepare a queue for control frames by themselves.

## 1.3.1

* Defining IllegalTableSizeUpdate.

## 1.3.0

* APIs `Network.HTTP2.Priority` are changed again. `Precedence` is introduced.

## 1.2.0

* APIs of `Network.HTTP2.Priority` are changed. `delete` is provided. Internal data structure is changed from random skew heap to priority search queue.