Prepare Fluxheim 1.6.30 release

eldryoth · eldryoth · commit 4d980e5c43ca · 2026-06-24T07:53:59.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -28,6 +28,11 @@ behavior when the change improves security or project direction.
 - Add live native proxy tests proving native HTTP/2 upstreams reconnect after an
   origin closes a pooled H2 connection and round-robin across multiple static
   H2 upstreams.
+- Add explicit, disabled-by-default plaintext h2c Upgrade compatibility for
+  `proxy.upstream_http_version = "http1-and-http2"` origins that implement
+  HTTP/1.1 Upgrade to `h2c`.
+- Update `base64-ng` to 1.2.2 and use its fixed-input infallible encoder for
+  native h2c `HTTP2-Settings` header construction.
 
 ### Security
 
@@ -65,6 +70,13 @@ behavior when the change improves security or project direction.
   them.
 - Share one Fluxheim-owned upstream-header stripping predicate between the
   native H1 and H2 upstream request writers.
+- Keep explicit h2c Upgrade fallback limited to refused/closed probe
+  connections, and do not downgrade/replay a request after an upstream H2
+  stream has already been opened.
+- Treat h2c probe timeouts as ambiguous and non-replayable while still allowing
+  clean HTTP/1.1 fallback for closed/reset upgrade probes.
+- Validate h2c Upgrade responses with a bounded response-head reader that
+  preserves post-upgrade H2 frames without an O(n²) terminator scan.
 
 ## 1.6.29 - 2026-06-23
 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/README.md b/README.md
@@ -344,8 +344,8 @@ Official container images are published to GitHub Container Registry and Quay:
 - `quay.io/valkyoth/fluxheim`
 
 Release tags use the same profile/OS suffixes on both registries, for example
-`v1.6.29-wolfi`, `v1.6.29-cache-wolfi`, `v1.6.29-proxy-wolfi`,
-`v1.6.29-load-balancer-wolfi`, and `v1.6.29-php-wolfi`.
+`v1.6.30-wolfi`, `v1.6.30-cache-wolfi`, `v1.6.30-proxy-wolfi`,
+`v1.6.30-load-balancer-wolfi`, and `v1.6.30-php-wolfi`.
 
 Release note for `1.5.15`: the signed git tag `v1.5.15` is the canonical code
 tag. The GitHub Release page is published under `v1.5.15-release` because the
diff --git a/crates/fluxheim-cache/Cargo.toml b/crates/fluxheim-cache/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-cache"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-common/Cargo.toml b/crates/fluxheim-common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-common"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-compression/Cargo.toml b/crates/fluxheim-compression/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-compression"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-config/Cargo.toml b/crates/fluxheim-config/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-config"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-geoip/Cargo.toml b/crates/fluxheim-geoip/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-geoip"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-headers/Cargo.toml b/crates/fluxheim-headers/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-headers"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-load-balancer/Cargo.toml b/crates/fluxheim-load-balancer/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-load-balancer"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-observability/Cargo.toml b/crates/fluxheim-observability/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-observability"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-php-fpm/Cargo.toml b/crates/fluxheim-php-fpm/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-php-fpm"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-protocol/Cargo.toml b/crates/fluxheim-protocol/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-protocol"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-runtime/Cargo.toml b/crates/fluxheim-runtime/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-runtime"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-server/Cargo.toml b/crates/fluxheim-server/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-server"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-snapshot/Cargo.toml b/crates/fluxheim-snapshot/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-snapshot"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-stream/Cargo.toml b/crates/fluxheim-stream/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-stream"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-tls/Cargo.toml b/crates/fluxheim-tls/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-tls"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/crates/fluxheim-web/Cargo.toml b/crates/fluxheim-web/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fluxheim-web"
-version = "1.6.29"
+version = "1.6.30"
 edition = "2024"
 rust-version = "1.96"
 license = "EUPL-1.2"
diff --git a/docs/build-and-podman.md b/docs/build-and-podman.md
@@ -470,15 +470,15 @@ Optional Quay repository secrets and variables:
 
 The workflow publishes OS-variant tags for the full/default image profile:
 
-- `v1.6.29-wolfi`, `v1.6.29-alpine`, `v1.6.29-suse-micro`, `v1.6.29-debian`
+- `v1.6.30-wolfi`, `v1.6.30-alpine`, `v1.6.30-suse-micro`, `v1.6.30-debian`
 - `sha-<short-sha>-wolfi`, `sha-<short-sha>-alpine`, etc.
 - `latest-wolfi`, `latest-alpine`, etc. when run from the default branch
 
 For the recommended Wolfi runtime, the full/default profile also gets short
 aliases:
 
-- `v1.6.29`
-- `v1.6.29-base`
+- `v1.6.30`
+- `v1.6.30-base`
 - `latest`
 - `latest-base`
 
@@ -487,21 +487,21 @@ automation. They point at the full/default image profile.
 
 The focused image profiles publish tags with a profile segment:
 
-- `v1.6.29-cache-wolfi`, `v1.6.29-cache-alpine`,
-  `v1.6.29-cache-suse-micro`, `v1.6.29-cache-debian`
-- `v1.6.29-proxy-wolfi`, `v1.6.29-proxy-alpine`,
-  `v1.6.29-proxy-suse-micro`, `v1.6.29-proxy-debian`
-- `v1.6.29-load-balancer-wolfi`, `v1.6.29-load-balancer-alpine`,
-  `v1.6.29-load-balancer-suse-micro`, `v1.6.29-load-balancer-debian`
-- `v1.6.29-php-wolfi`, `v1.6.29-php-alpine`,
-  `v1.6.29-php-suse-micro`, `v1.6.29-php-debian`
+- `v1.6.30-cache-wolfi`, `v1.6.30-cache-alpine`,
+  `v1.6.30-cache-suse-micro`, `v1.6.30-cache-debian`
+- `v1.6.30-proxy-wolfi`, `v1.6.30-proxy-alpine`,
+  `v1.6.30-proxy-suse-micro`, `v1.6.30-proxy-debian`
+- `v1.6.30-load-balancer-wolfi`, `v1.6.30-load-balancer-alpine`,
+  `v1.6.30-load-balancer-suse-micro`, `v1.6.30-load-balancer-debian`
+- `v1.6.30-php-wolfi`, `v1.6.30-php-alpine`,
+  `v1.6.30-php-suse-micro`, `v1.6.30-php-debian`
 - `sha-<short-sha>-cache-wolfi`, `sha-<short-sha>-proxy-wolfi`,
   `sha-<short-sha>-load-balancer-wolfi`, `sha-<short-sha>-php-wolfi`, etc.
 - `latest-cache-wolfi`, `latest-proxy-wolfi`,
   `latest-load-balancer-wolfi`, `latest-php-wolfi`, etc. when run from the
   default branch
-- Wolfi short aliases: `v1.6.29-cache`, `v1.6.29-proxy`,
-  `v1.6.29-load-balancer`, `v1.6.29-php`, `latest-cache`, `latest-proxy`,
+- Wolfi short aliases: `v1.6.30-cache`, `v1.6.30-proxy`,
+  `v1.6.30-load-balancer`, `v1.6.30-php`, `latest-cache`, `latest-proxy`,
   `latest-load-balancer`, and `latest-php`
 
 Starting with `v1.5.0`, the load-balancer image profile is part of normal tag
diff --git a/docs/modularity-exceptions.md b/docs/modularity-exceptions.md
@@ -61,6 +61,7 @@ documents why the exception is temporary and how it will be removed.
 | `crates/fluxheim-cache/src/object.rs` | 637 | Cache object envelope, plaintext disk object format, and disk index helpers were grouped during the 1.6.2 cache extraction. | Split disk object format, serialized envelope, and disk index helpers after the root cache adapter shrinks. |
 | `crates/fluxheim-cache/src/storage_bin.rs` | 627 | Storage-bin layout, manifest, allocation, and free-map helpers were moved together to preserve allocator review context. | Split manifest/layout, allocator, and index-entry helpers after the storage-bin file adapter moves out of `src/cache.rs`. |
 | `crates/fluxheim-server/src/native_http1_proxy_tests.rs` | 805 | Native HTTP/1 proxy parity tests temporarily group plain, TLS, mTLS, failover, pooling, round-robin, weighted round-robin, config-gate, compression, error-page, and forwarded-header fixtures for the native upstream cutover slices. | Split plain failover/round-robin, TLS/mTLS, pooling, compression/error-page, forwarded-header, and config-gate tests after the native proxy API stabilizes. |
+| `crates/fluxheim-server/src/native_http1_proxy_tls_tests.rs` | 615 | Native HTTP/1 proxy TLS parity tests temporarily group rustls/OpenSSL upstream TLS, ALPN HTTP/2 negotiation, SNI, CA trust, and client-auth fixtures for the native upstream H2/TLS cutover. | Split rustls, OpenSSL, ALPN/H2, SNI, CA trust, and client-auth fixtures after the native proxy TLS API stabilizes. |
 | `crates/fluxheim-server/src/native_http1_proxy.rs` | 509 | Native HTTP/1 proxy temporarily groups static upstream selection, pooling, compression, header policy, and error-page handling during the rich-proxy parity slices. | Split upstream selection, request policy, response policy/compression, and error-page handling before final native runtime cutover. |
 | `crates/fluxheim-server/src/native_http1_client.rs` | 740 | Native upstream HTTP/1 client temporarily groups connection pooling, request writing, response parsing, stale-connection retry, timeout handling, and forwarded-header-safe request construction during the final native upstream parity work. | Split pooling, request writer, response parser, retry/timeout policy, and request-construction helpers before final native runtime cutover. |
 | `crates/fluxheim-server/src/native_http1_tls.rs` | 872 | Native upstream TLS connector covers rustls/OpenSSL, trust roots, SNI, hostname policy, mTLS material, and file-safety checks during the staged `1.6.14` cutover. | Split rustls, OpenSSL, file loading, and hostname-policy helpers before production native proxy cutover. |
diff --git a/packaging/rpm/fluxheim.spec b/packaging/rpm/fluxheim.spec
