chore: release varnish9 v4.3.2

Author: RamazanKara

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to vmod-wasm will be documented in this file.
 
+## [4.3.2] - 2026-05-24
+
+### Fixed
+- Hardened `proxy_http_call` request parsing by rejecting malformed serialized
+  header maps, invalid methods/paths, bad upstream ports, and CRLF/control
+  injection in guest-supplied headers.
+- Fixed a response-buffer boundary bug where a full 256 KiB callout response
+  could write the trailing NUL byte one byte past the allocation.
+- Switched outbound callout writes to retry until the complete request and body
+  are sent, avoiding partial-write truncation.
+- Fail closed for oversized, malformed, incomplete, or chunked callout responses
+  instead of storing a partial response.
+- Apply private/internal IP rejection consistently through both direct HTTP
+  connections and the HTTP connection pool.
+- Return pooled callout connections for reuse only after a complete,
+  `Content-Length` framed HTTP/1.1 response.
+
+### Tests
+- Added VTC coverage for oversized auth callout responses failing closed with
+  the HTTP connection pool enabled.
+
 ## [4.3.1] - 2026-05-23
 
 ### Release Channel

README.md

@@ -119,9 +119,9 @@ make install
 
 ### Release Bundles
 
-GitHub releases use Varnish-specific tags such as `varnish9-v4.3.1` so the
+GitHub releases use Varnish-specific tags such as `varnish9-v4.3.2` so the
 supported Varnish ABI line is visible before download. The package version
-remains semantic (`4.3.1`), while the release channel identifies Varnish 9.
+remains semantic (`4.3.2`), while the release channel identifies Varnish 9.
 
 Release assets include source and convenience binary bundles for Linux `amd64`
 and `arm64` on Varnish 9. Binary bundles include `libvmod_wasm.so`,

configure.ac

@@ -1,5 +1,5 @@
 AC_PREREQ([2.69])
-AC_INIT([vmod-wasm], [4.3.1], [https://github.com/RamazanKara/vmod-wasm/issues])
+AC_INIT([vmod-wasm], [4.3.2], [https://github.com/RamazanKara/vmod-wasm/issues])
 AC_CONFIG_SRCDIR([src/vmod_wasm.vcc])
 AC_CONFIG_MACRO_DIRS([m4])
 AC_CONFIG_HEADERS([config.h])

src/vmod_wasm.c

@@ -34,7 +34,7 @@
 #include "proxy_wasm.h"
 #include "vdp_wasm.h"
 
-#define VMOD_WASM_VERSION "4.3.1"
+#define VMOD_WASM_VERSION "4.3.2"
 
 /* Global Wasm engine — shared across all VCL instances and threads */
 static struct vwasm_engine *vwasm_engine_global = NULL;

tests/basic_load.vtc

@@ -32,5 +32,5 @@ client c1 {
     rxresp
     expect resp.status == 200
     expect resp.http.X-Wasm-Result == "42"
-    expect resp.http.X-Wasm-Version == "4.3.1"
+    expect resp.http.X-Wasm-Version == "4.3.2"
 } -run