Fluxheim 1.6.30

Fluxheim 1.6.30 Release Notes

Fluxheim 1.6.30 continues the Pingora-exit work by moving plaintext upstream
HTTP/2 forwarding into the native HTTP/1 proxy path.

Highlights

• Native HTTP/1 proxy configs can now use
  proxy.upstream_http_version = "http2" with plaintext upstreams that speak
  h2c/prior-knowledge HTTP/2.
• Native upstream HTTP/2 connections are pooled instead of torn down after a
  single request. The pool keeps the h2 connection driver alive, reserves stream
  capacity with proxy.upstream_h2_max_streams, invalidates stale handles after
  h2 errors, and retries safe methods once after a pre-response pooled-handle
  failure.
• Native upstream H2 policy now receives proxy.read_timeout_secs,
  proxy.send_timeout_secs, proxy.upstream_h2_max_streams, and
  proxy.upstream_h2_ping_interval_secs.
• TLS ALPN-negotiated upstream HTTP/2 is now supported for
  proxy.upstream_http_version = "http2" with the existing upstream TLS/SNI/CA
  policy. TLS http1-and-http2 fallback now advertises h2 and http/1.1
  and dispatches each request with the protocol selected by ALPN.
• Plaintext proxy.upstream_http_version = "http1-and-http2" can now attempt
  HTTP/1.1 h2c Upgrade only when the new proxy.upstream_h2c_upgrade = true
  opt-in is set. The default remains false; refused upgrades fall back to a
  fresh HTTP/1.1 connection.
• Live native proxy tests now prove downstream HTTP/1 requests can be forwarded
  to an in-process HTTP/2 origin, and that two downstream requests reuse one
  upstream H2 connection.
• Additional native proxy tests prove H2 upstream pools reconnect after an
  origin closes a pooled H2 connection and round-robin across multiple static
  H2 upstreams.
• Native proxy live tests now also prove weighted static upstream selection
  preserves the configured slot order while forwarding every selected upstream
  request over HTTP/2.
• Native proxy live tests now prove safe-method failover works across static
  HTTP/2 upstreams and that unsafe methods are not replayed to another H2
  upstream after a failed first attempt.
• Native upstream client tests now prove explicit plaintext h2c Upgrade reaches
  a real in-process HTTP/2 origin, and that origins refusing Upgrade fall back
  to HTTP/1.1 without replaying the downstream request during the probe.

Security Notes

• Native upstream H2 handshakes are now bounded by the selected H2 policy
  timeout so an origin that accepts TCP and then stalls the HTTP/2 preface cannot
  freeze upstream setup indefinitely.
• Native upstream H2 stream-slot waits are now bounded by the read timeout so
  later downstream requests cannot wait indefinitely when all upstream H2 stream
  capacity is occupied by slow responses.
• Native upstream H2 requests and responses use the existing bounded H2 client
  policy: decoded header-count/list limits, URI/body limits, response body
  timeout, request upload lifetime, response header validation, and prohibited
  hop-by-hop response-header rejection.
• Pooled native upstream H2 requests now run the same outbound H2 validation as
  one-shot H2 requests before acquiring stream capacity or opening an upstream
  connection.
• Invalid programmatic upstream H2 stream limits now fail closed instead of
  silently reverting to the default policy.
• Native upstream H2 pool creation no longer holds the pool mutex across TCP
  connect and H2 handshake work, avoiding serialized cold-start failures when an
  origin is unavailable.
• Native upstream H2 pool creation is serialized by a dedicated setup lock, so a
  cold pool or post-invalidation retry cannot open one TCP/H2 connection per
  waiting stream slot.
• proxy.read_timeout_secs now also bounds native H2 request readiness and
  response-header waits, not only response-body reads.
• proxy.upstream_total_connection_timeout_secs now caps native H2 setup plus
  the first stream-readiness/response-header phase on a newly initialized H2
  connection.
• Stream-scoped H2 failures no longer invalidate the whole H2 pool unless the
  h2 error reports a GOAWAY/connection-level condition.
• Native plaintext upstream H2 keepalive pings run in a separate bounded task,
  wait for PONGs with the selected H2 handler timeout, and abort the connection
  driver when the peer stops acknowledging pings.
• A wire-level native upstream H2 test now observes an actual client PING frame
  through a real h2 server IO wrapper, proving configured keepalive is emitted
  instead of only accepted by config.
• A live rustls upstream test now proves the native proxy negotiates h2 with
  ALPN, forwards downstream HTTP/1.1 requests to a TLS HTTP/2 origin, and sends
  an HTTPS-scheme upstream H2 request.
• Live rustls upstream tests now prove TLS http1-and-http2 fallback selects
  HTTP/2 when the origin negotiates h2 and falls back to HTTP/1.1 when no
  HTTP/2 ALPN protocol is selected.
• Native cutover-plan tests now prove TLS http1-and-http2 upstream fallback
  is native-ready when a TLS backend is compiled, while plaintext
  http1-and-http2 remains HTTP/1.1-only unless proxy.upstream_h2c_upgrade
  is explicitly enabled.
• Native upstream H2 stream permits are now named and explicitly released after
  response conversion, keeping the lifetime visible to reviewers and avoiding
  accidental future movement of the permit guard.
• Native upstream H2 outbound request validation now has one enforcement point
  inside the H2 sender, avoiding duplicate prevalidation paths with drift-prone
  policy inputs.
• Native upstream H2 programmatic configuration now enforces the same 1-1024
  stream cap as TOML validation, with a debug assertion on pool construction.
• H2-only knobs on HTTP/1 upstream configs are rejected instead of silently
  ignored, and H1/H2 upstream request writers now share the same predicate for
  Fluxheim-owned header stripping.
• Native diagnostics now distinguish supported upstream H2 modes from invalid
  mixed-mode configurations. Plaintext http1-and-http2 does not use H2 unless
  the explicit h2c Upgrade opt-in is enabled.
• Native H2-to-HTTP/1 response conversion now strips hop-by-hop and
  proxy-owned headers such as transfer-encoding, upgrade, keep-alive,
  proxy-connection, te, and trailer, in addition to content-length,
  connection, and date.
• Native upstream H2 retry handling now releases the stream-capacity permit
  before rebuilding a failed pooled H2 connection, then reacquires capacity
  immediately before sending the retry stream.
• Non-TLS native builds now support plaintext http1-and-http2 only through
  the explicit h2c Upgrade opt-in; without it, mixed-mode plaintext fallback
  stays on HTTP/1.1.
• proxy.upstream_h2c_upgrade is rejected unless an upstream is configured,
  the upstream is plaintext, and proxy.upstream_http_version = "http1-and-http2", keeping h2c Upgrade out of TLS and prior-knowledge H2
  configurations.
• Explicit h2c Upgrade fallback now treats a closed/reset probe connection as
  an upgrade refusal and retries the original downstream request on a fresh
  HTTP/1.1 connection, while still treating probe timeouts as ambiguous and
  non-replayable.
• H2 stream-capacity closure is no longer classified as a transport-level
  broken pipe, so explicit h2c mixed-mode fallback cannot downgrade and replay
  a request after an upstream H2 stream has already been opened.
• The h2c HTTP2-Settings header now uses the infallible fixed-input encoder
  added by base64-ng 1.2.2, removing the previous local dead error branch
  while keeping Fluxheim on the hardened base64-ng dependency.
• The h2c Upgrade response-head reader now checks only the trailing terminator
  bytes while reading one byte at a time, preserving post-upgrade H2 frames
  without an O(n²) scan.

Compatibility Notes

• This release enables plaintext h2c/prior-knowledge, TLS ALPN H2 origins, and
  TLS http1-and-http2 fallback negotiation on the native path. Plaintext
  http1-and-http2 uses HTTP/1.1 by default; set
  proxy.upstream_h2c_upgrade = true only for origins known to implement
  HTTP/1.1 h2c Upgrade. This is intentionally not default because cleartext
  origins have no ALPN negotiation point and h2c Upgrade support varies by
  server.

Checksums And Signatures

• Commit: 4d980e5c43ca8367f1fe565b6fa4143851690f82
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 53af386c0d69b4e4a042e798941b5ff909d43e7e2a53425fb17a44637b716182 fluxheim-1.6.30.tar.gz
  • 6c086aaf82a2418ab85c78ec0da77bbabd5772e76230ae012c3338df5381c810 fluxheim-1.6.30.zip
• Binary checksums:
  • x86_64:
    • 177db59096d82545c62707a27c3b1dc67cb64de04c61782ca301a8ef4d7d1cf0 fluxheim-1.6.30-full-x86_64-linux.tar.gz
    • bce9ebc9861a46257a676c8ef1affff07db60ee50bbddc0be61759c41a177ab4 fluxheim-1.6.30-cache-x86_64-linux.tar.gz
    • d1d158b9f09363b3f7b40d5ef4af7b76323084bc0c3b95b2951ddcb8ec2514b1 fluxheim-1.6.30-proxy-x86_64-linux.tar.gz
    • ddfe961305d7ae080348889b77c47e6581506dc9b36025aa051c5eca5640e382 fluxheim-1.6.30-php-x86_64-linux.tar.gz
    • f4fd78ee7ed05976caf7d6a2b5d454076a4b09900795a598edcc3aade308b6c8 fluxheim-1.6.30-load-balancer-x86_64-linux.tar.gz
    • 6f3fdd89a56891c1f163a131d634e9aaade6dc26965de54b05183545ab184a91 fluxheim-1.6.30-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 7e26f2adb2acbff62b3472743fc8fd18da747d1a00c8522ee2ba12738d0df44b fluxheim-1.6.30-full-aarch64-linux.tar.gz
    • 21778a66eec1ac9dab53b74f31c93a9eed02b61b912c6b6d02e2fd62d8b59654 fluxheim-1.6.30-cache-aarch64-linux.tar.gz
    • 08cd3188228c01993219c3c42c1fa681b43139d83e3c3d68de3ab1e7085ab6fb fluxheim-1.6.30-proxy-aarch64-linux.tar.gz
    • `1a54a3603baf4d...

Fluxheim 1.6.29

Fluxheim 1.6.29 Release Notes

Fluxheim 1.6.29 continues the Pingora-exit work by moving inherited
compression, header-policy behavior, and safe forwarded-header ownership into
the native HTTP/1 proxy path.

Highlights

• Native HTTP/1 plain proxy responses can now use inherited global/vhost
  compression policy when gzip, brotli, or zstd support is compiled.
• Native HTTP/1 route proxy responses now inherit global/vhost compression
  when a route does not override compression locally.
• Native route proxy construction now merges root/vhost header policy with the
  route overlay before building native request and response header policies.
• Root and vhost header mutation policy no longer blocks native HTTP/1 proxy
  cutover when it only uses supported header set/remove/append behavior.
• Native HTTP/1 proxy handling now owns the safe forwarded-client-IP header
  modes: X-Forwarded-For = off, X-Forwarded-For = replace, X-Real-IP,
  X-Forwarded-Host, X-Forwarded-Proto, and RFC Forwarded.
• Native HTTP/1 route proxy handling now owns trusted-chain
  X-Forwarded-For = append for routes and programmatic builders, preserving
  inbound chains only when the direct peer matches configured trusted sources.
• Native HTTP/1 route proxy handling now owns regex route matching and
  path-only rewrite_template capture expansion, including exact route,
  longest-prefix route, first-regex route, and fallback precedence.
• Native HTTP/1 route proxy handling now owns IP/CIDR allow/deny access policy
  at both vhost and route scope, using trusted X-Forwarded-For client
  restoration when configured trusted sources identify the direct peer.
• Native HTTP/1 route proxy handling now owns vhost and route concurrency
  limits, including immediate rejection and bounded queued waits.
• Native HTTP/1 route proxy handling now owns vhost and route local rate
  limits, including token-bucket rejection and delay-mode admission.
• Native HTTP/1 proxy responses now carry configured downstream write timeout,
  total response timeout, and minimum send-rate policy.
• Native HTTP/1 upstream establishment now honors
  proxy.upstream_total_connection_timeout_secs across DNS, TCP connect, and
  optional TLS handshake setup.
• Native HTTP/1 upstream socket creation now honors
  proxy.upstream_tcp_recv_buffer_bytes, proxy.upstream_dscp, and the
  upstream TCP keepalive triple before connecting. On targets with
  TCP_USER_TIMEOUT, it also honors proxy.upstream_tcp_user_timeout_ms.
• Native HTTP/1 request-body parsing now honors
  proxy.downstream_read_timeout_secs selected by the matched proxy before
  forwarding to upstreams.
• Native HTTP/1 requests now carry typed optional TLS client identity and Geo
  context fields. Rustls and OpenSSL listener tests prove downstream TLS
  request context is populated with negotiated protocol, cipher, and peer
  certificate fingerprint where available.
• Native route-proxy access evaluation now enforces client-certificate
  fingerprint and Geo country/ASN rules when typed request context is present,
  so cert/Geo policy no longer blocks the native HTTP/1 cutover inventory.
• Managed local ACME HTTP-01 challenge serving now has a native route action.
  Live route-proxy tests prove direct and alias vhost challenge ownership, safe
  token-file loading, GET/HEAD handling, and 405 Allow: GET, HEAD behavior.
• Native ACME HTTP-01 challenge file loading now runs on Tokio's blocking pool
  instead of blocking the async worker thread.
• Native HTTP/1 proxy handling now supports safe-method traffic mirroring when
  the traffic-mirror feature is compiled, including recursion protection,
  sampling, forwarded-header selection, mirror response caps, and per-target
  in-flight limits.
• Native HTTP/1 proxy handling now supports proxy.auth_request when the
  auth-request server feature is compiled, including trusted context header
  synthesis, bounded blocking subrequests, response-header allowlisting, and
  deny-before-forwarding behavior.
• Native HTTP/1 route proxy handling now honors route-scoped
  [vhosts.routes.grpc] validation, rejecting non-POST requests, duplicate
  Content-Type headers, and non-gRPC content types before forwarding.
• The compatibility proxy's gRPC route Content-Type gate now matches the
  native gate by rejecting duplicate Content-Type headers and accepting
  case-insensitive gRPC media types.
• Root and vhost compression no longer blocks native HTTP/1 proxy cutover when
  a matching compression backend feature is compiled.
• Native route-proxy construction now mirrors the compatibility route order for
  vhost synthetic routes: explicit ACME HTTP-01 upstream challenge routes,
  configured routes, then vhost redirect fallback routes.
• Vhost redirects and explicit ACME HTTP-01 upstream challenge routes no longer
  block the native cutover inventory when their generated route policies are
  otherwise native-safe.
• Live native listener tests now prove plain-proxy gzip compression, inherited
  route gzip compression, inherited request-header mutation, inherited
  response-header mutation, and standard response security headers.

Security Notes

• Inherited native compression keeps the same guarded behavior as route-level
  compression: bounded input/output size, negotiated Accept-Encoding, safe
  method/status checks, and privacy-sensitive header exclusions.
• Native compression strips origin ETag and Content-Length, appends
  Vary: accept-encoding, and lets native response framing compute the final
  compressed length.
• Native route request headers are removed or overwritten before the upstream
  request is sent, matching the compatibility-path policy order for the
  supported mutation subset.
• The low-level native upstream writer no longer hardcodes client-IP forwarding;
  proxy/header policy now owns X-Forwarded-For so privacy-mode and ordinary
  builds share one explicit policy boundary.
• Native route request-header overlay builders now start from the same secure
  forwarded-header baseline as config-driven policy, so omitted overlay fields
  still strip spoofable inbound client-IP headers and synthesize owned
  forwarding context.
• Future trusted-chain append handling reads the inbound X-Forwarded-For chain
  after any configured spoofable-header stripping, so strip-plus-append degrades
  to the direct peer address instead of preserving attacker-supplied hops.
• Native route tests prove ACME challenge paths are selected before a vhost
  redirect fallback, preserving the HTTP-01 exception ordering used by the
  compatibility path for explicit upstream challenge forwarding.
• Native cutover now rejects route request-header overlays that set
  enabled = false, because disabling the request header policy would also
  disable forwarded-client-IP sanitation on that native route.
• Native vhost fallback proxy traffic now receives the merged root/vhost header
  policy, so requests that miss named routes still strip spoofable
  client-IP headers and synthesize owned forwarding context.
• Privacy-mode native route request headers are stripped after all configured
  request-header mutations, preventing operator set or append rules from
  reintroducing spoofable forwarded-client-IP fields.
• Programmatic native route constructors now start with the same safe default
  request-header policy used by config-built routes, instead of a no-op policy.
• Native trusted append uses the same effective-client-IP restoration helper as
  the compatibility path, so untrusted direct peers cannot preserve spoofed
  inbound forwarding chains.
• Native regex rewrite templates percent-encode bounded capture values and
  reject rewritten paths that would traverse or introduce unsafe forwarding
  paths before any upstream connection is opened.
• Native regex rewrite captures now encode slash characters and fail closed
  under the native safe-forward-path policy, so regex captures cannot introduce
  path hierarchy that was not present in the static rewrite template.
• Native access policy denies before redirects, static-web actions, or upstream
  proxying run, so rejected requests cannot be transformed into downstream
  effects first.
• Native vhost access policy uses the same trusted forwarded-chain restoration
  helper as forwarded-header synthesis, so allow/deny decisions see the
  effective client IP only when the direct peer is trusted.
• Native route access policy also checks a percent-decoded policy path, matching
  the compatibility path's encoded-route bypass hardening for access decisions.
• Native concurrency limits are enforced before rewrite, local static,
  redirect, or upstream proxy actions run; permits are held until the native
  response is produced.
• Native rate limits are enforced before rewrite, local static, redirect, or
  upstream proxy actions run; excess requests are rejected before the native
  upstream path is reached, and delay-mode sleeps run before concurrency permit
  acquisition so delayed requests cannot exhaust configured concurrency budgets.
• Native trusted-proxy client restoration joins duplicate inbound
  X-Forwarded-For headers before ACL and rate-limit identity decisions.
• Malformed X-Forwarded-For trusted-proxy chains now fail closed on both the
  native header crate path and the compatibility proxy path, falling back to
  the direct peer address instead of skipping poisoned hops.
• Native rate-limit table eviction sweeps are bounded so a full bucket table
  cannot trigger repeated full-table scans on every new identity.
• Native rate-limit tables are now sharded so stale-entry pruning only blocks
  one shard of identities at a time.
• Native proxy config now accepts response-side downstream policy and per-proxy
  downstream request-read timeout policy on the nati...

Fluxheim 1.6.28

Fluxheim 1.6.28 Release Notes

Fluxheim 1.6.28 continues the Pingora-exit work by moving two more rich proxy
features onto the native HTTP/1 route/proxy adapters.

Highlights

• Route-level response compression now works in the native HTTP/1 route proxy
  through the fluxheim-compression crate.
• Native compression feature mapping now reaches fluxheim-server for gzip,
  zstd, and brotli builds.
• Native route compression preserves the existing eligibility checks: GET
  only, 200 OK, compressible content type, bounded input/output size,
  Accept-Encoding negotiation, no active Content-Encoding, no Range
  response, no Set-Cookie, and no request Authorization or Cookie.
• Native route compression now ranks enabled codecs by the client's
  Accept-Encoding q-values before falling back to Fluxheim's tie-break order.
• proxy.error_pages now builds on the native HTTP/1 proxy for static 502/504
  fallback pages backed by fluxheim-web.
• Native custom proxy error pages preserve the proxy failure status while using
  the configured static error page body and headers.
• Live native HTTP/1 listener tests now prove gzip route compression and custom
  proxy error-page responses end to end.

Security Notes

• Native compression removes origin ETag and Content-Length before sending
  the compressed body, appends Vary: accept-encoding, and lets the native
  response writer own the final compressed length.
• Compression is skipped rather than forced if the encoder exceeds configured
  output bounds or cannot initialize.
• Custom proxy error pages only serve files resolved by the native static-web
  resolver; directory listings, missing files, forbidden paths, and oversized
  bodies fall back to the standard 502/504 response.
• Custom proxy error-page responses now close the downstream connection after
  the upstream failure, matching the built-in 502/504 failure responses.
• Native error-page serving uses the same symlink-safe fluxheim-web path
  validation and rooted file-open behavior as native static routes.

Compatibility

This release does not remove Pingora from normal builds yet. The remaining
compatibility-path blockers are inherited global/vhost compression, cache
lookup/fill/stale behavior, PHP-FPM routing, auth-request, traffic mirror,
forwarded-client-IP ownership shortcuts, dynamic discovery, health-aware
load-balancing, persistence, priority/backup/drain state, and hash-based
load-balancer selection.

Checksums And Signatures

• Commit: ed662cf0dfd462864256e536e87dff605cd80a45
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 17cd4345f8c91fd3991318fb56b29d25ac3e35952edd6bc7c5cb658e668e4489 fluxheim-1.6.28.tar.gz
  • e76805f02cc6ed60d1d7a174a1ecd068ed0e88962a97aa61e5766dfb707686cb fluxheim-1.6.28.zip
• Binary checksums:
  • x86_64:
    • 92d4d68d05b53dbe69a153f55f29c386cf001b03c28c6f2ad46e4c2d861caab1 fluxheim-1.6.28-full-x86_64-linux.tar.gz
    • 0a11dfd72f8a72c569143fe14cbc16e9ee25b8284cc63ecad12b20cf41069ff3 fluxheim-1.6.28-cache-x86_64-linux.tar.gz
    • b7ac7970b83742ff5d7120715810246c0660c320b49f5527c9aa423034703dd5 fluxheim-1.6.28-proxy-x86_64-linux.tar.gz
    • ff46c748eb8ebb3a9335be905c90c498aa5cbdc9c08949e56238c5df2ad7673c fluxheim-1.6.28-php-x86_64-linux.tar.gz
    • 9d15b8dc930b9b426ca981b953f6691344b66eab17307c58919180aa5f374d7e fluxheim-1.6.28-load-balancer-x86_64-linux.tar.gz
    • ef007a3031cd48c46dcd30cefa30b77bd70b02f946f3842d3fe89eb3df2d3b77 fluxheim-1.6.28-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 7206c0c2228622eaf7239490b09e21a746b1be16d8afeec3d584c3073d8303ab fluxheim-1.6.28-full-aarch64-linux.tar.gz
    • f6f28cc92af788e3bd330f94b7bafdb1f7129d83ac1d03ffdf5ac943c8e7d67e fluxheim-1.6.28-cache-aarch64-linux.tar.gz
    • fea671bd8ca1fb503ed7a10a443cd73e39f37e6f4e0410e6ed20cacfd3fd6112 fluxheim-1.6.28-proxy-aarch64-linux.tar.gz
    • 392e3e81661bd9c3d38dee618d3d791035e775ebfd3cff0cf68d45f957331e6c fluxheim-1.6.28-php-aarch64-linux.tar.gz
    • 289fd7c76bdfa409424da3568f62f72a2de03cec6ff97f1bbdaabda2f597e406 fluxheim-1.6.28-load-balancer-aarch64-linux.tar.gz
    • de1e8540eda5bb2d0d6fbf344a4611a1c171af0ecb36db0d7f4b787ccb2bb40c fluxheim-1.6.28-config-tester-aarch64-linux.tar.gz
  • macos:
    • 57f07cd9bd82f8aeb3e97413024d764d17ba6257f9c82945f794a10ffee7452d fluxheim-1.6.28-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 11a767c44a6bb8b61cd93e90f637489cbb13e17a5b8d99215f3c2b31796755dd fluxheim.spdx.json
  • fa4e2d865660e4720e6991e5a5208fd4db6bca0f6f2c004fb11c1878c70328ca fluxheim.cyclonedx.json
• Reproducible build:
  • dc4fd155af2605ce62bb11b144b0f452b311fcdd22eea5e9102c5f589e2892b5 x86_64
  • b82ddd9c3dc50b96a765c1a01e658244817573eb31e8ff0bef18586b238214f9 aarch64
  • 208e8deacf8cf5a171d742cdf6b0bd4edb7d372785d7f266b6ac35874d4ea5e8 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c61be86d2d7922fd25c665c62b4b4bc599ed8e0e9fb1a221aa6be4b84019d264
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1791fc6a63f6331e82c230823eefc5326a6932121a2438504a50fd5791bd4ab3
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8f78dcc2f3ed9d152f812473a927e8954c7512f91226ce12338454cabd1d18ef
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:4d00a11f6f1c9b2023f598086412717fe1393fddfe4d402fce4ef280788c1611
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:32f978f4280c6e93abff84bde49996966149cf692169ffbc394a3450b61e73a2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:14e897b02127af720bfd1332ddf6d48049e2f22985e0c9f2e17540ed6d1befd9
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b932b099760e39459cd8def25807419bc4274a96435131db698eaaee69db2c99
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:b86d7ff6de604b92095111e5ef696b4d7479db0d1f544ffc2ca528a15481fa78
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7329505671132d42fe1ace3fb7db330153ff4de4fd9ad64ea4e46cb3b9492696
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:049f9c1e30e476abceab7f45d72723039cf0e1db82eb8e709e2c8b5f53faa67e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:947b0e5f064b2b79770e2507dde7ca835bd6187b87edf71f423437b7491dc0b3
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c7f5d2f5f82bee55bda66278848144d66777856b2818bc22055404f7516c13db
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a6521be8c9a6976a1fc5e12ce2a6444b9a3bd572954dbf18db8c463d593bb096
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:015132ce9c5b04dddedf3c7924d10b5a4bbd71bee4c943038708abf5f617d130
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:352a3c1d9cc95d87c6a656efa94a6c69a2be8f855bc6752cd905c2e943073811
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a56fcfdd62e341f65c7cc2975de17b55109414d0214ca8de6b3f464de2c3a172
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0ca00d45019fd2f9649ccc201e65deb5f6582cf8ef46dd2a003522d5a24f8b31
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:618e3e00bea3bac82b8083f1f7b96f75e0341be8343f4988e216602e684864aa
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:208a35d62e1a163c305fb66c41d567f621a779373d8be18caca1643297a56f01
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c00fe7eaf8432e1175bb82dd1add815bfe6b4741c638ca44bccd11008ab3090e
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.27

Fluxheim 1.6.27 Release Notes

Fluxheim 1.6.27 continues the Pingora-exit work by moving route-level static
web serving onto the native HTTP/1 route adapter.

Highlights

• Native HTTP/1 route static-web adapter backed by the fluxheim-web crate.
• Native static file responses support ETags, conditional requests, byte
  ranges, HEAD, cache-control metadata, and directory listings.
• Route-level native request-header mutation overlays now apply before matched
  proxy routes are forwarded upstream.
• Multiple configured static upstreams now round-robin successful native HTTP/1
  proxy requests, with safe-method failover still available when an upstream
  fails.
• Static proxy.upstream_weights now drive native weighted round-robin without
  requiring the compatibility load-balancer runtime.
• Route-level response rewrite rules for Location, Refresh, and
  Set-Cookie now execute in the native route proxy through the shared
  fluxheim-headers rewrite helpers.
• The server crate now depends directly on fluxheim-web for pure web response
  planning instead of using the root compatibility adapter.
• Static-web, header policy, response rewrite, and weighted-upstream route
  tests run through real local native HTTP/1 listeners.

Security Notes

• Native static-web path resolution rejects decoded dot segments, NUL bytes,
  backslashes, denied dotfiles, and symlink escapes.
• Static response body reads use rooted component-by-component openat with
  no-symlink opens for every directory component and the final file, closing the
  symlink-swap window between metadata checks and body reads.
• Native route static-web handling now rejects methods other than GET and
  HEAD with 405 Method Not Allowed, even when the route method list matches
  all methods.
• Native redirect Location path validation now reuses the bounded multi-pass
  forward-path safety check, rejecting single- and double-encoded dot-segment
  or slash expansions from {query}, {path}, or {uri} templates.
• Buffered native static responses are capped at 64 MiB until the final native
  streaming body path is completed.
• Forwarded-client-IP shortcut ownership remains a compatibility-path blocker;
  only explicit request-header unset/set/append mutations are marked native
  ready in this release.
• Advanced load-balancer behavior such as health state, persistence, dynamic
  discovery, priority groups, backup/drain state, and hash-based selection
  remains on the compatibility path; this release moves static upstream
  round-robin and static weights native.

Compatibility

The remaining rich proxy integrations, including cache lookup/fill/stale
handling, PHP-FPM routing, auth-request, traffic mirror, compression, and
advanced load-balancer policy selection, remain on the compatibility path until
their native parity tests land.

Checksums And Signatures

• Commit: 6917ff1df159f9027bf4167d964fe71d83351e8a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • ff330941135a9b5ef889950642a6001589f1b01c33a3802563cf569b0e693ef4 fluxheim-1.6.27.tar.gz
  • 8c8dcd450629bd7586ffce927fe9dfd213dc0f9c8d0c47a3ebbdfde9063f957e fluxheim-1.6.27.zip
• Binary checksums:
  • x86_64:
    • 6161f2b95aba634b3db04c16afce1e1fe1f086a5eb11976f851c818062075736 fluxheim-1.6.27-full-x86_64-linux.tar.gz
    • 1f12b8392bd3178969bd7b4defd96ff6d61275f5955b09969bdacad278bb5406 fluxheim-1.6.27-cache-x86_64-linux.tar.gz
    • ab44adf7e98aec95ae403d6213d750a1b1fa0e1dc062ee3eaf97a3a95f49c231 fluxheim-1.6.27-proxy-x86_64-linux.tar.gz
    • 6f88d520b08b0bf9f977bc1606ddae8ba4f5fa31acd701f5dc7a7ebfdc24a61b fluxheim-1.6.27-php-x86_64-linux.tar.gz
    • 9908a97cd49d03d106e506119f162325f77f540687e373a9fef2ea466acec332 fluxheim-1.6.27-load-balancer-x86_64-linux.tar.gz
    • 30037b2c48d7ad0bd2687c3144a7fcf28917e41212a40dbd6494bf3b81638618 fluxheim-1.6.27-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • ecdcbb9e823a8d64b6e9ce09842b6d0b9d1046ef3b00b22ecab2006123d3f45d fluxheim-1.6.27-full-aarch64-linux.tar.gz
    • cbee31629389118ac213b4f81099f6b808735070cdbf6d9188b52b54444f063a fluxheim-1.6.27-cache-aarch64-linux.tar.gz
    • bf33281e9bd99014b5b9731c9c18bb66a9cb7f33ffb22b823bee580aebef6446 fluxheim-1.6.27-proxy-aarch64-linux.tar.gz
    • 46fc94cfea4c2117a73733f5991fb9aa8e8a9aec9df737d25703488eda6d464b fluxheim-1.6.27-php-aarch64-linux.tar.gz
    • be9ed9ca1235d7d65895bd3c6d0b319f61437b63d4c5a11a9df7f1c93a7b21e3 fluxheim-1.6.27-load-balancer-aarch64-linux.tar.gz
    • a719345dc628086ead7ebc81642e6d8191a85bda4bab87b8fc691d17be16c65d fluxheim-1.6.27-config-tester-aarch64-linux.tar.gz
  • macos:
    • abe7498a50c81b483f602083c3f20d4506d866d924b7320e46da68a9e3d112be fluxheim-1.6.27-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 731adbe62c5b71a1920e26cd5cf5e40298ed9782984d479ef3aa0d56a16d2558 fluxheim.spdx.json
  • 7878aebf2cb07f6e26b6122cd359fbfc4c7f6f7d5dff51658d401b203cad970c fluxheim.cyclonedx.json
• Reproducible build:
  • 716109c2f165ebc59a45b22d1a05e8bb6067dd321c81bdca2324372a30426e34 x86_64
  • da136da5566b507d49c20823969eaaf69def76676f55b1135f805bf1002ee9a9 aarch64
  • [MANUAL_SHA256] macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1d48b175362115366d5ccc6570ecfe64b5201db9e7e1ca318fb7657eb3546a80
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:d5fb378dfc98c61bd91a3774dd4fb147e7ffde45bfb6e9dbe2ba5a65c4a1bb70
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8bc8d8f0a0422c431a5139af0849e13e326069e98b4eefb8d0657e2f1703a072
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:79ee208abbc7ee19024961a8b78592c35eaa04b4507410fe7a980eff036f4afc
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:57d4330b37033ef2e64827605fe787149862e78b39fb9d21f83075321ce6337b
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1556263cb1f9adbcdc27eea0e2b01f3755ef4e2c40adb977f4b30a67a77c4293
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7b8c460236f2477a291e1611a5c5a3ad6762be9dd7962f7f767afe8463e548ee
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:7c3e44859c2927a089d2ec3650f94609733e79fa4f3e8f2902b9b1988c2f75a9
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1136b58490f0d19c7c4e2df43e4321a6143faca6fcc40af07e0305e3fd3bcfe8
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1be4eeafadc3b92af1180c889926d7db02f9964b6756cd95a8989009dcd966cc
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0d9a5eac48c86c1674072ed8e54690a228e78ac1e149a2ebbef362da0c6c97ca
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:168ebcba486fc6535b8404ffb791b6aea7824d515e3de429c1d4adc3d0d9aa0b
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:880f63a16a06246b5e16310ff75731bf0ae823865f196f7b3926b8d415c457b2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2a69dba2424677d2247d244360cd94094e74f9ecc9ab9f6949fcf597f5f4081d
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0fbe3d2fea08c743ab30fd2633efcc265c98ad04b7a69ac44e19880ca27e114f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:20348dcbec1d843ea8827d0d92a1e339825c76e3a0c2fb24628d259303413cc9
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:627b87ccdb632810586ae30886a124ca7609df3406ff5b68022c216b99643dc5
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:808556780483d234ed68230bffca60dff396f6e3651d334c8f6c725112cf5a29
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4568f0c3502cc80f8a5f2c736febcfe3f9f28321971577b0b328f693d9b5a4a1
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:80b9e4ced513b89d5a84eccda6406a647dcc6080f44b64effc9d77af0086f340
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.26

Fluxheim 1.6.26 Release Notes

Fluxheim 1.6.26 continues the Pingora-exit route/policy parity work. After
1.6.25 added the native HTTP/1 route proxy for ordinary proxy routes, this
release adds native route redirect actions so redirect-only routes can be
represented and tested without falling back to Pingora's ProxyHttp callback
surface. It also moves route-level response header overlays onto the native
route proxy for the already-supported native response paths.

Changed

• Add native HTTP/1 route redirect actions to NativeHttp1RouteProxyRoute.
• Support {uri}, {path}, and {query} expansion for native route redirects.
• Enforce route-level max_request_body_bytes in the native HTTP/1 route
  proxy before forwarding matched requests.
• Apply route-level native response header overlays for native route proxy
  responses, including set, append, unset, HSTS, CSP, frame-options,
  content-type-options, and referrer-policy shortcuts.
• Allow native route proxy construction from redirect-only route config without
  requiring a dummy upstream proxy.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.26.

Security

• Validate native redirect locations before writing the response.
• Reject unsafe redirect expansions containing control characters, whitespace,
  braces, backslashes, non-HTTP(S) schemes, or ambiguous double-slash request
  paths.
• Reject expanded native redirect Location URL paths containing dot segments
  or double slashes, including {query} path-position traversal attempts.
• Reject redirect templates that would place {path} or {uri} immediately
  after a literal slash in the URL path, preventing predictable // expansion.
• Exclude route proxy configs shadowed by route redirects from native proxy
  cutover candidate accounting.
• Return 413 Payload Too Large for native route-proxy requests that exceed a
  matched route-specific body limit.
• Keep regex routes, request-header mutation, response-header rewrites, access
  policy, and richer proxy integrations on the compatibility path until their
  native execution has dedicated parity tests.

Compatibility Boundary

• Normal proxy profiles still compile the Pingora compatibility runtime in this
  release. The native route proxy now covers exact/prefix/fallback proxy routes
  plus route redirects, route request-body limits, and route response header
  overlays. Request header mutation, response-header rewrites, access and
  compression policy, plus rich proxy integrations remain targeted for the next
  1.6.x slices.

Checksums And Signatures

• Commit: f724b2a5ab9b44bc285034ca771d7802882ccc6c
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 725835efb7f5e54621ce7fdab5c372c7f43992161f492ff60dc33c08c07eb9a9 fluxheim-1.6.26.tar.gz
  • 3f8c2fdc8fe14b2903db3a64bcb0eb1c3bd936123009e17f88b752e0bf7ffff0 fluxheim-1.6.26.zip
• Binary checksums:
  • x86_64:
    • 5d198f6ac31cb770b72931e84859ea69968ab1623f1954e931bd1d2490117cbd fluxheim-1.6.26-full-x86_64-linux.tar.gz
    • cd61e645d591c6d0212f6a1417cb234c427900e65d9800667a62d7ae0a8a74d0 fluxheim-1.6.26-cache-x86_64-linux.tar.gz
    • 0f95b597d797160d3e791dcf62d938c1a10c62d129c26d06cdb5885ea9319d59 fluxheim-1.6.26-proxy-x86_64-linux.tar.gz
    • d45e47579dbb6463f87ad459c76a09cef3a77eec3870f6db5bd86360e34a8792 fluxheim-1.6.26-php-x86_64-linux.tar.gz
    • 598172ce4c7fd3e2aa35853001dfc3fb640fc9a1029790bf59f40fea93dc2842 fluxheim-1.6.26-load-balancer-x86_64-linux.tar.gz
    • e7042765fa67bb9558b5504a70700862c183d369a1846df9872d9f3bf1259827 fluxheim-1.6.26-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 6dfaffacc0aab854427ffa93fe9bdf7726c311edc247f25a4b105b5dbae7a147 fluxheim-1.6.26-full-aarch64-linux.tar.gz
    • 55bb486e85ba3aee4b760ac923f8e52e8109142a048882434fc3a1eb58b24f08 fluxheim-1.6.26-cache-aarch64-linux.tar.gz
    • 356b3d122ced75114e34d217709cda717fcd849d199ae4fc05169a82d1e04b68 fluxheim-1.6.26-proxy-aarch64-linux.tar.gz
    • 97f4d79240fad8c18f53b6b163b76d82c8765123af4a1563144bff0558c461b6 fluxheim-1.6.26-php-aarch64-linux.tar.gz
    • b42fafa2c51e2449d5146fd782dfe93d0a6c88790b4decf1a1346ba751d4c083 fluxheim-1.6.26-load-balancer-aarch64-linux.tar.gz
    • 8368ce7e386bee5c8167abe4ecc32278a83690f8dc1ced76c3b63ed8b16d61e0 fluxheim-1.6.26-config-tester-aarch64-linux.tar.gz
  • macos:
    • c84ae24d0f509ba9619d7073c17333a31578ca43c89308ccdbb77ed82a948975 fluxheim-1.6.26-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • c1b0982cebb0075673c83192a2357b03e758ce5b5faff54026e1f6be28b5ea3b fluxheim.spdx.json
  • e926c0ac20010086f34b7887a24d93237de57cc06d125ff58ae6e1ed63a36c0c fluxheim.cyclonedx.json
• Reproducible build:
  • f48fda519e009905679bb0da95abc6f313df910dd96ce3107810f7f75173d19a x86_64
  • d6c95abeed38abd46a1c8ddc39019d90c3ce6dea49037444123c471ad39979c5 aarch64
  • 845cefc4900519f151d41571fd22f876d22876b1ef486b9df5261c52a17ab2b1 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:53dfe0cb1679db292a0b893ae87ea219ac267f153c66b4ea5454bc8ccbe02f5e
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:a11ecd249158a6a664468e1b41fffaa7d47a99006ad7690f7691d530e61f4400
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:41451b85a678ea43872eb3b2bc280213dd1901c0cd4b64729b4c5b95bb98a107
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:b65cd91d2836bc5c3bb9d172a1f69666128969c01dec74ec605718ab0dcfceab
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6bab87396f37afe5e2c928a09d8c28d0c3dc53fc026e809f4936603025928449
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:47a41b7a24baf3e6adb6d8b66d2cb7da8e3cad19381957f1cf04059157a8f625
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:9803a05eb7a0f569134148f846a695024d38632f6139e310ade6bdd251c0eac6
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0559a6155f1f785b19017b22d1e02a9ea386fcbb1fb0fb529af43a86f7208ce4
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:65308264c3f789d5c33bab1e8077e86c979272402069521784682a9de193c2e1
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:242c6f51b0b06778d8e5beef0218898d78e53d55baff7f9a8e4c7b7f4082271c
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0f9d3e2f465d62ec2a96abae7f2384657323eca1152760f8eb10ed25a94ac216
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2a453761dc11deed67e812dbd77fb452c47fcad600caad1323ce1720241774f7
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6ded7df854352be2d9464529318edbced2bb4cffb3ffa60272c32684429a87f4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:92e1d60c4cce01ec75f04bc0d5767564d92fe8edcefacce8baa41bebcb1547db
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:455021c1cbfacb2fefcccfae727eb3e2574e762198db4f963000a1abf439f43f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c82a6bfcb67c9f16c107d7ab0f3dda5695acc87502a2e166f532a4feeec497d0
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:896cceee3748f1b5ad5c6825a49f083ef666b3f4f187fbe322a8a09e69920caa
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:08cf1405adf9f0f8bdedcb4e43c1f481f58bc919adeda8e466f631747c33d162
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:238d8ec09bebba676e81ce2051ea93e9b4f503d73b085a2306004bbf33986314
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:6d3ba123d8c81c1c70bdf4d7af8fb51d2805ed2ca79564a4343f0de4d6a2a637
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.25

Fluxheim 1.6.25 Release Notes

Fluxheim 1.6.25 is a Pingora-exit evidence release. The previous plan placed
the final dependency deletion immediately after the HTTP/2 parity proof, but
the remaining compatibility runtime still owns rich proxy behavior such as
cache, web/PHP fallback, auth-request, traffic mirror, redirects, rewrites,
compression, and advanced load-balancer policy. This release makes those
remaining blockers visible per configured proxy scope instead of removing the
adapter before parity is finished. It also starts the route/policy parity work
inside the same release by adding a tested native HTTP/1 route-proxy primitive
for ordinary exact, prefix, and fallback proxy routes.

Changed

• Add native-http1-proxy-candidate rows to
  fluxheim-config-tester --runtime-cutover.
• Report each configured proxy scope as native-ready or
  compatibility-required with the exact native HTTP/1 proxy reason.
• Add native HTTP/1 route proxy handling for exact, prefix, and fallback
  routes with method filters, longest-prefix selection, prefix strip/rewrite,
  and query preservation.
• Re-scope remaining Pingora dependency exceptions to 1.6.28; 1.6.26 and
  1.6.27 are now the remaining native policy and rich proxy integration
  parity slices.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.25.

Security

• Keep blocker rows in the native runtime cutover evidence strictly validated
  while allowing candidate-detail rows for audit visibility.
• Reject invalid native route-proxy request targets and unsafe rewritten paths
  before forwarding.
• Reject ambiguous interior double-slash forward paths in the native
  route-proxy strip/rewrite path.
• Keep regex routes marked as compatibility-required until native regex route
  matching is implemented.
• Validate native HTTP/1 proxy candidate row shape in the runtime cutover gate
  before ignoring those rows for blocker status.
• Reject single-dot route path segments during config validation.
• Keep the dependency exception gate active so documented Pingora removal
  targets remain enforced by CI.

Compatibility Boundary

• Normal proxy profiles still compile the Pingora compatibility runtime in this
  release. That is intentional: deleting it now would either break shipped
  proxy features or make the release less honest than the evidence shows.

Checksums And Signatures

• Commit: 8abd17136836f8ca3d3f43800e121ec9d6decc3b
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • cb975aa81fb9df7d2556e50a6564758590ef8b0610d1c3431628baf7d1abf195 fluxheim-1.6.25.tar.gz
  • 2e6c9a3fa7e60bf26d1aa3d58561c2e0d801b09cec06eb0cc2a2ea64984161fb fluxheim-1.6.25.zip
• Binary checksums:
  • x86_64:
    • 68384d860cb7f65e0f9574019c36145f0020cfa063faf8c22bfcf36614bd2ceb fluxheim-1.6.25-full-x86_64-linux.tar.gz
    • cd119f1cb51c790c82f9bccc5e64ea8be7978f0433a0f5b3cfe38504a51c65bd fluxheim-1.6.25-cache-x86_64-linux.tar.gz
    • c5bf928798f898cd15083e7aeebcde0eb178cc686ee656ecd483eca5bbd5138f fluxheim-1.6.25-proxy-x86_64-linux.tar.gz
    • f360171e237e7d41c22a7d98e0da390a468e363b77a49b563d35396fc61b7dc5 fluxheim-1.6.25-php-x86_64-linux.tar.gz
    • b8b342121128e369d2d95d213d731498e16e4165d5039af50256957086decf03 fluxheim-1.6.25-load-balancer-x86_64-linux.tar.gz
    • b827f0d34afa91e73fb37fb8ebf18ed1a2e87beb4962bc9fa2aaf435d43bc762 fluxheim-1.6.25-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • a007848517d8485a4a950846ccacd798c6beac50a20bf9b586b1545f4821fdb3 fluxheim-1.6.25-full-aarch64-linux.tar.gz
    • 8194c82c2284b79d036f0a7fdfe302b3245b713b8fb2eb7b84eef3aac9e8ae56 fluxheim-1.6.25-cache-aarch64-linux.tar.gz
    • 104dd5688d8baaef7027459a937523aecadbdb0b0a59d5350dcc45b215209c3b fluxheim-1.6.25-proxy-aarch64-linux.tar.gz
    • 18021f6dbc949e5b2af67466123eab1c49c7490ac71d6af4787149a3060cb755 fluxheim-1.6.25-php-aarch64-linux.tar.gz
    • ed5801d8db6a08a05dc3af269c75520296fbc4785d737196f6b931b19b080776 fluxheim-1.6.25-load-balancer-aarch64-linux.tar.gz
    • 21d41860aef6c99ac56dd18d34de52779e1235aee527f7eac1831fa6bd11808e fluxheim-1.6.25-config-tester-aarch64-linux.tar.gz
  • macos:
    • 8db86446b3ac556c06af14ac250e92074f37907b786cfed9f275179299a27ac6 fluxheim-1.6.25-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • c34029633172f1938180103f871f536165f7219e8d5e6c5a540e161738c9eed1 fluxheim.spdx.json
  • 69dadc029a6a94b3aab347de6947916ff7280f48507b3ad5e41c7cde004086c1 fluxheim.cyclonedx.json
• Reproducible build:
  • fb41f2338a47a7a1dcd18038dea494942f3e1db3b48c0be24705e1e5cb1223ba x86_64
  • 1ca266cf6d56c57c644519d0cd564a0db9f47acf13e8fd2fa9a41ca951a97f6f aarch64
  • 8ff959f6b35bce0a049c2a639234476490ed23cc413c523145d647d8468fbce1 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:38535ba104e5470c3accb0399ac838282fc3a1f44f5cf4d76692be5dcc9723a9
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:77a7fe69c905786b16f651dab26a15bdabbb2d652bd21f88c1b9f69b1a65f4c6
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0cb4cabc377a9685032674437f3195e14cd1b92aad08c296e1f44db4fdd2f2c6
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1bebde43cadfa5dde7cb56fc018f8555de2378295a0577f440d8538ed98ed957
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5c956ba52ab37bf122158387e5c797df0bda20eff64b28a4f6d2871d061eb14f
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0fcfd1686e6ba15c2407db775fe61d63a12635d6eb72aa3a05ddf33542930a75
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:76be12ee7d5d3d3014c0ff49e6a73e79ced4c958449ef22fc84a18186ed9e0f5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:50c7b891a0c2cd9e5ead5d9a063ddec96650d915124d4de4af60e14c18f67276
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4198a35a212d23b743b10475f8571c01fbfc13077cb1377ecd46ffd965b47008
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5c9d0a31389cab40fa8054c87c9cf233d948821e5699e49dd11a6a9c9c50599f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1a293939452ccc9b5c8d686f7d455d8c82f53634f46db6dd928adc4ed2c108c5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0cc5b39f56d4465c28064e3761bf633e31b9e0d645b54c615adbb5faf558efa0
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0e9739f7baebf118790ce3669010eadcba47799993440e47f31b2ff6595193e6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4f127b3f10037b837d82725ddb16c3e507fcc1776ff36e45449a2c1542b9dc66
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0f143c4fd2382a99cfeaa785132571dd7389267674f96f264fe67537dacec44d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:69d994c4c9f4c8f80c91cf81cc38e85adfa8a9665c9b9499eb5f5f9fa0efd60f
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:b4bbc2aaafa11322e187cc31a07602d0ab2bc7c3b127595482a13edfd4c1f781
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3c1c39d1233538ec474bcf1ea640a5fce5b2da068e6a0d2823e5c12fc3455c74
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2a56927f70ccc858d5ac7a17d887e921c620dfc46567e0f6f7d3d2cae4d66e93
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:80a9eda2e0e3d93712ca991c6f6a55d80a788ce94c11c3fe510010a2d45f6922
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.24

Fluxheim 1.6.24 Release Notes

Fluxheim 1.6.24 finishes the native HTTP/2 downstream parity proof for the
Pingora-exit line. The representative native runtime cutover report is now
blocker-free for the simple HTTP/1 + HTTP/2 + admin + metrics + stream + UDP
configuration, while the remaining Pingora runtime/listener adapter crates stay
targeted for a focused 1.6.25 deletion release.

Changed

• Promote the native HTTP/2 downstream preview to cutover-ready after every
  required safety hook is represented and tested.
• Update the native runtime cutover evidence script so the representative
  config expects no blockers.
• Move remaining Pingora dependency exceptions to 1.6.25, keeping the gate
  active while avoiding a rushed mixed release that both changes HTTP/2 parity
  status and deletes the final compatibility crates.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.24.

Security

• Keep decoded HTTP/2 header-count enforcement before routing and document the
  paired decoded header-list byte bound from h2 max_header_list_size.
• Join aborted native stream and UDP listener tasks during shutdown, closing
  the short file-descriptor release window after an operator-triggered stop.
• Add an explicit zero-blocker assertion to the native runtime cutover evidence
  script for the representative config.
• Preserve native HTTP/2 tests for oversized URI rejection, oversized request
  bodies, decoded header count, request trailers, response trailers, prohibited
  HTTP/2 response headers, request flow-control release, response flow-control
  hold timeout, slow request-body timeout, and handler timeout.
• Keep the Pingora dependency policy enforceable: all remaining normal-profile
  Pingora crates must be deleted by the next dependency-removal checkpoint.

Compatibility Boundary

• Normal proxy profiles still compile the Pingora compatibility runtime in this
  release. The change in 1.6.24 is the HTTP/2 parity proof and blocker-report
  cleanup, not the final dependency deletion.

Checksums And Signatures

• Commit: 835f10614900c5b3233d3de5e22bc5c85a6ad63a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 8424d7bc90972e3870ceb15e2a36f0964c56e1dd33e82e486c729f3c9beba90b fluxheim-1.6.24.tar.gz
  • 36722dea641dbd88c472c8f88e2dfffbb68c3f26f603a85d811675d152028570 fluxheim-1.6.24.zip
• Binary checksums:
  • x86_64:
    • 0c30cde62b28f530a064af71b4624d50d757eacb6d1f8d614addf8195a7f9fc5 fluxheim-1.6.24-full-x86_64-linux.tar.gz
    • d9b7e83b59367e1b5db1f77f55a1062ecdec1946f20d646c5d0ca2c48050e65b fluxheim-1.6.24-cache-x86_64-linux.tar.gz
    • 87a9df8f1d80b77dabf2a266fcdd11aef779999c4b86519306d7fa4f1b3c41be fluxheim-1.6.24-proxy-x86_64-linux.tar.gz
    • a1de2681523396658d47a734a7b5f04bc6eec5e1a88e92489b0946ff273baa5d fluxheim-1.6.24-php-x86_64-linux.tar.gz
    • fb8cf0e0b159ee7ae66ff7e958eeb6e812c5b9327fbb21586a5e5c271fc219d4 fluxheim-1.6.24-load-balancer-x86_64-linux.tar.gz
    • ca66aa7d0fde7db94f547f583045a016d8ff1891374504cea2a0bf6114888cb6 fluxheim-1.6.24-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • d07d60e196902048aa8eeb55f3695a87681670bbc61670f8be71d391e782c8f7 fluxheim-1.6.24-full-aarch64-linux.tar.gz
    • 9be8c03ee4c0410fb12de87b5b15e95694cd377fbf8d63af6e5205ef17d2fb7c fluxheim-1.6.24-cache-aarch64-linux.tar.gz
    • 606489bae2f696072c880c4665ef2a10cda9d451d25a2eb66366a959d2e2f03a fluxheim-1.6.24-proxy-aarch64-linux.tar.gz
    • b65709aeeee99062ba70af0a407b343aa15d1ca8e42b770f7dbd2bedf7a5458f fluxheim-1.6.24-php-aarch64-linux.tar.gz
    • 016b49de6b7da29fd2a3ebcad863c293c560e4a894feb66936bd9d7e3f5d834c fluxheim-1.6.24-load-balancer-aarch64-linux.tar.gz
    • a0934b53ea7081659c29f230e814ad3669c18437c9d6e36a6db76040f18215d3 fluxheim-1.6.24-config-tester-aarch64-linux.tar.gz
  • macos:
    • d63e1de498a696015ef4d04c26ddd82e41fc3057b47abd693a5c3988dfbfa61a fluxheim-1.6.24-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 60abf900757f6fc6e77e625a8018f6e0d5283df15deff7cf838a3ddbc8ad8c38 fluxheim.spdx.json
  • 125b8d1946c0b4fb11a6252cb0350c2a89cefabb0054a77867ba861d10b1ee34 fluxheim.cyclonedx.json
• Reproducible build:
  • 7241a8c6fb791c294eadc0ecec5611eb6561abac38a5e4d9bf2413425f7f2ad2 x86_64
  • 9eaf718cbc6c0cdde58841b636510745669dc42cd549b8850860ee120b748ed5 aarch64
  • 81c712338426a7313583dd802bc039a4c96038bc2deafab9bf70e1cf23ad8812 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:491ff683e0bec7956545d97385d5993853bb22b58728fe3b1985ef3fa6d3b783
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:801974b342c8e1859ea4d14208088d4bdb09c2bd785a67534ae118154250a2b4
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:63fe11f51c3582e9d184d291d3fbc5028108ec98dc77f0683b59e24c58943b0e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1bae5153d63503ab4192e3c3b182cdf413346cae7881b12e80b25824f00db370
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4674a5276fdfc00b69c4cd863a5a8ac672380946f7ac2508a435389dd924bfb4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:48a85fa94ffc2e48f6062984be137fa05bdd3ac6c28aaab585cbd84e58d6f698
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ade330e787b5bc76882b82d0a5cca2f1e2a54b21812771fbaa8bdd3b98529872
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:5c8584cea2526fde7287999d58cd10cef763b477fd1a160e8aeb22f5354c3019
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:19429018d4bd46c2c4e1519b5ed893b42227e544626c449c4dcfd97a181062d2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:24a7106ffafeb9461b70bdb57cb5fc9ea8a4809446c6de59c2d7cdd1c922b831
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0bbbd39a324b582c9d9b70544bba1d39c0de32b291fa2d4160726cfa74998550
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:6695ab34496553816f00972545b23c4bce2a69df7f2468e4df7d15ccc1248ce1
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a78cf928fafa91426dde58b5e232f9e4153a9f7ee0ab66f9d636cfda11b19964
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2422b45eb9e3fec85b6b76750679fa52963d7519db910ff95b69d730757d486c
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:9d61382d432a5d39bbc9c0a29b915fb11da1bf1ae0d3651ac811eb5a46e5c6a7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:365f3e61191015503386a329fb2060435e9f28137771a494b9304ea0e1521527
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:19d8dff367924db4f1552a3fd5c530d0742978734956a85e2d97939dccf3bd17
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:b3598235b2aada4c8849733daad8d6b3a32baeff4f3c9c44f018b5d4c07b16bd
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:12b3e4c86daeadf63e260e0a9984c6ab0076d0152da29eb157a35004f2c13f41
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:03e10ba0843c87c3e85072e011bed80c9a27720bad1324174bac4ad7d810578a
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.23

Fluxheim 1.6.23 Release Notes

Fluxheim 1.6.23 cuts the stream and UDP proxy startup boundary over to
Fluxheim-owned native task primitives. The data paths were already Tokio-based;
this release removes the Pingora-owned accept-loop lifecycle from those
services and keeps the old runtime only as a narrow registration adapter until
the final 1.6.x cutover.

Changed

• Move stream proxy listener startup into a native FluxBackgroundTask
  boundary.
• Move UDP proxy listener startup into a native FluxBackgroundTask boundary.
• Keep Pingora service registration as a thin compatibility wrapper that
  delegates to the same native stream/UDP tasks.
• Mark config-derived stream and UDP service plans native-ready in the native
  runtime cutover summary.
• Extend native runtime cutover evidence with a representative UDP route and
  update the expected blocker report so only HTTP/2 remains for that
  representative stream/UDP config.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.23.

Security

• Add FluxShutdown::wait_for_shutdown() so native service loops can wait on
  shutdown without depending on Pingora's ShutdownWatch API.
• Make wait_for_shutdown() return immediately when shutdown was already
  requested before a task starts waiting, preventing stalled startup/shutdown
  handoff.
• Make native background-task joins abort-on-cancel, so cancelling a join()
  future cannot silently detach a task that should still be supervised.
• Make the shutdown waiter cancellation-safe for native stream/UDP
  tokio::select! loops.
• Preserve query strings on pathless absolute-form admin request targets such
  as http://admin.local?reload=true, mapping them to / plus query instead
  of dropping the query.
• Preserve live stream and UDP smoke coverage after the lifecycle change.
• Keep final HTTP proxy and HTTP/2 runtime parity as explicit blockers until
  the final Pingora-free proof release.

Compatibility Boundary

• Normal proxy profiles still retain the Pingora compatibility runtime in this
  release. Stream and UDP service startup now uses Fluxheim-native task
  boundaries, but final production runtime/listener removal remains scheduled
  for the last Pingora-exit proof release.

Checksums And Signatures

• Commit: 7bae1abe603fddb4cae63321f4260802cce86af7
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • f1f51e156407073d08371cef687bafd8fb5670c351398cf4cc47abd73d658da9 fluxheim-1.6.23.tar.gz
  • 6bcd6884570165d5189ca7892cacc1f5ad28246f33feb9d198f2be843d6cbb5b fluxheim-1.6.23.zip
• Binary checksums:
  • x86_64:
    • ce47b468571e90eed86e44d2ad228a3156753e16d7add843ecadfbbe4e5676e1 fluxheim-1.6.23-full-x86_64-linux.tar.gz
    • 59b01db1d204a0ac5c925d1d5915dd317e2a8e29b5c6b09543aec23204ca7458 fluxheim-1.6.23-cache-x86_64-linux.tar.gz
    • 950aaa49435411263d56b93935de3ea3d4548eeaf67fa00ce0185552084a69ce fluxheim-1.6.23-proxy-x86_64-linux.tar.gz
    • f6001ab164f3ec2fdd904b5c170c96d2a79ded0a5b6d1d901b409fb408fb5846 fluxheim-1.6.23-php-x86_64-linux.tar.gz
    • 437619b260ccdf2cb9460edb8bed89a3ad4bee7d32fc8224a2d08d64a96c7d16 fluxheim-1.6.23-load-balancer-x86_64-linux.tar.gz
    • cb4f008d9af302b33d5bc4eee796934e0d00d94dcf87692d9bb1088e53f298bf fluxheim-1.6.23-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 7e9c954584c8eccd8a3925c4a3722e99e822385046b2d965fbe1b31676fba33a fluxheim-1.6.23-full-aarch64-linux.tar.gz
    • 4d33bdfcf3709dc6eb9044c062509b639d80dcbdbf32216b21dfe8f6a7d495d9 fluxheim-1.6.23-cache-aarch64-linux.tar.gz
    • 5b5be03eac1e82c41b80b16666cf8f0e6afa76e458f36cc7dc3eb81ff3027e1c fluxheim-1.6.23-proxy-aarch64-linux.tar.gz
    • 2543316f71f99cca995121797a21ecbf12b93b8d3f2122b65d1b1e0407a6ea29 fluxheim-1.6.23-php-aarch64-linux.tar.gz
    • 76887478f76e0c1b76ff0b6b7098d53a40789ebd260a037ef10e94c3f53f735d fluxheim-1.6.23-load-balancer-aarch64-linux.tar.gz
    • ea7e033063762400313f4612a74d89ec545ca7933b05e610d632a914dfa1b076 fluxheim-1.6.23-config-tester-aarch64-linux.tar.gz
  • macos:
    • 8ee47edfaf3b3f7abd85bf9e0ee3c1b1ab2c4f0fc4a3b1e43db3a690454dabd9 fluxheim-1.6.23-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 385fb371fd598ececb10a5bb08453d1266adf65ab2adf85cf11871db8e6ad1fb fluxheim.spdx.json
  • 8430aa1e9be9f29565598626a7e53f53ac38f272b6369a4f5df3027b6a8854fa fluxheim.cyclonedx.json
• Reproducible build:
  • 56247a7b926b1aa8379402c02bb003835b909e93ae1808af7db974fc4f6cc681 x86_64
  • 76e9e4d366474587af77bb6a2f2cd60df1bf4a08a7cea8d22a74369046cd9943 aarch64
  • 332208267961551a8ae8fff881ce9a2578fdf543301405ad27a2ef2c71458e13 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5a092346e9bf7d22f46971df0e28e4343090b34f93355b80f802d128e19917c6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:74d67780d097fc0d8dff88a4039ca7b614449ae6b3dad402e5c088c2c444838c
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ac7298352703f57c274d6427d92b0460762c72ba556673bedba8affe7b36e47a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0c6f086c327b72bb39fcda85ca99fcc9554ccefbf108b72fc74802d8892a1e1c
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8e72241f0387e032c93de8cf4ab9a1091bad22ea51c03ba20a9aa8d7d727268a
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5ccbbd67734b55b61fcbbc08904b678436f5f7c4f8fd1c29489b32ce0e5102d0
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2b6caf64871198cefc98896c457d7777461af2822ca8f5d6f857e4b779ea1a77
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0111331495aa9a8c64066a513fb83ddb1919a95595df5ec12166e7e6e7eaf8d4
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:196a09f2fd2b3d523c73d0d6d7013fd07314d944dd0c42a5812c4b1a5851c707
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2b73e8737480c0ca2bb698f8747ae8ec736bcad11c6e6b8166ecf15a3ec3f2ff
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6d0c4f6a01d65a8fa1a95a8de1d5d36a4bf30f26e6db937fb0bd16645e176b30
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:78f7c62a56efbed4588183da438566dc63c7a950a78644976ea91f6d006f5ad1
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:378d173434da8275d8f5855cff52f068b38176868c47a5145bbdee3df294ef86
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:218f39c98b6335617d22bc46a2901856bdcb57c9545b42a1ab60524e27bc585e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5834c4773b58ca05529ebae8158fc778169a6fe6fb85237aecbb60678fe37e17
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:435f8788b10401ef6862f390f79d5a8c9192cf5cd5d64ea0129f294855ab75cc
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0ad435a18d8ffb53cba8e786d367ae237fc76bd6516aca083ee585bc6fe87e76
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:a7dcb6cd83f3f43cc06f9da47ca8a896df8f358b5a0d37770d7f7d8aacabe5e8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0d8a406f1e2032f1c9362b714d3c10bd505643d88f579b25b8d22d7f3a0c79a1
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:11f1357b521e788d8d6de791904fa61527326c7ff5e602e649afb66d6d9f06ed
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.22

Fluxheim 1.6.22 Release Notes

Fluxheim 1.6.22 starts the native admin and metrics serving slice of the
Pingora-exit line. The goal is to move control-plane HTTP behavior behind
Fluxheim-owned server primitives without weakening admin authentication or
changing production listener behavior prematurely.

Changed

• Start native admin/metrics serving work for the control-plane side of the
  remaining runtime cutover.
• Keep production admin and metrics compatibility conservative while native
  handler parity tests are introduced.
• Mark config-derived admin, ops-socket, and metrics service plans native-ready
  after proving native HTTP/1 handler parity for admin auth and Prometheus text
  responses.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.22.

Security

• Preserve the auth-first admin contract as the required behavior for native
  admin/control-plane serving.
• Harden native background task handles so accidental handle drops abort tasks
  instead of silently detaching them, while documenting that aborting a watched
  critical handle triggers supervisor shutdown.
• Mark native supervisor shutdown results as #[must_use] so callers cannot
  silently ignore whether they initiated shutdown or joined an existing
  shutdown.
• Reject newline-bearing paths in native runtime cutover evidence generation
  before interpolating them into TOML fixtures.
• Document that native admin target matching intentionally uses raw,
  percent-encoded paths to avoid normalization-bypass regressions.
• Keep native runtime cutover evidence active for stream, UDP, HTTP/2, and
  final proxy-runtime blockers until those services are wired to native
  listeners.

Compatibility Boundary

• Normal proxy profiles still retain the Pingora compatibility runtime in this
  release. The admin and metrics cutover is staged so response shape, auth, and
  local smoke behavior can be proven before flipping production service
  registration.

Checksums And Signatures

• Commit: 1cfb0ac23c418ef2d6226bf0026f7cc3ab5c1b66
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 7e9e5839097f36a4963054c77b53006440cc080a3c5c8240d6022aeaa5a3a175 fluxheim-1.6.22.tar.gz
  • 3970ec5e2824e8ed2f06aeb30a0d08d849284df79c6f90f9b795ecc7b28372da fluxheim-1.6.22.zip
• Binary checksums:
  • x86_64:
    • 8fbdd44b567060c84e3997b260514f86c668f3860f1673a394d4384b4eb98592 fluxheim-1.6.22-full-x86_64-linux.tar.gz
    • 86bd8831b8eef0b4de00d0706613e04fee70c59bee103f4863daa88a26e0a617 fluxheim-1.6.22-cache-x86_64-linux.tar.gz
    • 39c7005a3973f3d0224f138273d1205899745208f03d3aae259c95faac95a4c6 fluxheim-1.6.22-proxy-x86_64-linux.tar.gz
    • 75a4197c52fbf8947ca0cb2f415cc7790c795152fa65df878779a9f36980eeb4 fluxheim-1.6.22-php-x86_64-linux.tar.gz
    • 121a1633a9e245922a6f3673b4f5253afbd866738dbc0d284acaf55c0136ba47 fluxheim-1.6.22-load-balancer-x86_64-linux.tar.gz
    • c30fcf292191d182732c0cedfb24b13fadf1bbfa26be195bc92ed5db4c1d38f3 fluxheim-1.6.22-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 421e5a32afb7cd5c52e41aaa1d942ad07071c66e3cc15fb2fab8e05081c5505b fluxheim-1.6.22-full-aarch64-linux.tar.gz
    • 0a67c5a878c684daf8c1e7745a85956c25c4c856ae7fc268c06fbfa747a0930f fluxheim-1.6.22-cache-aarch64-linux.tar.gz
    • fa70e1221dfc0014e6e40d49855ef76c4f5b84cf8b4daf50cb69136af07a737b fluxheim-1.6.22-proxy-aarch64-linux.tar.gz
    • 456475b64d570400fc350bd175b6f07ef24669b1cda2a93180df9f8f8c39c8c9 fluxheim-1.6.22-php-aarch64-linux.tar.gz
    • 4a5be65883e45f7b32fcf0477ca120421d055ca1c7ef377adee15252ac9b357c fluxheim-1.6.22-load-balancer-aarch64-linux.tar.gz
    • 8cbc96e7f276adc96fa725e08cd0501cf400fa8460c33d3d277000bfcf6a4a79 fluxheim-1.6.22-config-tester-aarch64-linux.tar.gz
  • macos:
    • 5d4bef7c196f3fe6b9fee65a59264f4d20a88d04868b0f682509c2893b3abce7 fluxheim-1.6.22-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 70c8cdbcde7ef65fa363cd512950ba96dd336186cd334de06693b025d189ee33 fluxheim.spdx.json
  • 48fbbc9d7db5897dc2579f24a05981da537bbc0bb930201dbc40e9251950da2b fluxheim.cyclonedx.json
• Reproducible build:
  • 3a9e7ed5b38122f1be1a705e10a32c5a002fd383bd51b8dcdeaf934b0fe77be7 x86_64
  • a7b087242e89f82b2da633c8be50865241a47414b1e9ed01d401ed2d63394bb1 aarch64
  • a83fb3d87d63715bb71d2797e43185542656e6aa9de476855b944116bdbe128d macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:17cc37795971aaa2c1615f1f06a164cc318c779b4b7ef41802eda63119807f8a
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:09a4ac9ea761a56c0d8306c2a2aedd6cdd4a5c56ca3982f61e63a90f5c3087b9
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8d0566cad1a71ba80d635b7e9030f0ed939c79c20edd7f578c38cfa4b3ecde2c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:081d513c1e70199fd3c1945d8781117ae8f70f09c8fec5765e59eb928776d6ad
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2eba360b2a031dc04f943b4c97969dacd9c5ab0aae83a97b2fde636a4fc3c934
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:57ae58f51113608cfc778125118c9bc48e2f2c2b4475475793d54acd296eac18
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2148fc61fd80b1999861423064f9d822d0ad74a5e516303da4e80fa655de9bf2
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1d2d91af39784267969600b505790f96b487a1ef648f4a9d4095c51eb243ab2b
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:31f056084830a927a41ddb087f33398e11fc00b8ad1aaa641a8f6261d514f9b3
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4ef4a2c4ad073bd3b10c923ad13834d3019828636336d7ea40eb84d7d847c9ba
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:76702267048afb72b5f136600755b4a930e427bc729ead32dab5d42c5eebebdd
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:73dfb10cf36f900c9e07a6de743987459a44547647e4f59bbdb7aca6d8390cf5
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4da923e7d634fda477f40ebdca7130a9861b291cef0212fc6deddb21a1acee4a
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:588c10f7d0963ef5ef7a561584b9c458599d439ed97bf2077a6427704b047477
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:34e33efa2e66651f3f42f0aefcf3fa554ab162ec062f249c41d496932b454a4c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3bbf4ee644dbe46b657476b7f00a7c497467e3b005699ab0d46564d29f3b7c30
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:d07ae1e8784dd3de3ef032283bad2ce324195aac945016f2e732444a83308d96
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:7caaffee9a211eab4ea6587ea881ca8026b6b1bdb580173361aead565361b514
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:05d83659dc90a2df8c5533327345c2d304026224c9e69af6d4cdf749f97e5aee
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3292fc0bfb48ea7031b38286a3abbe7e3993108755f21fad8e5ee5e64d5c04bc
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

Fluxheim 1.6.21

Fluxheim 1.6.21 Release Notes

Fluxheim 1.6.21 continues the staged Pingora-exit line by moving internal
background task orchestration toward Fluxheim-owned runtime supervision while
keeping production listener behavior conservative.

Changed

• Start the native background-service orchestration slice for certificate
  reload, ACME renewal, cache maintenance, observability export, and
  load-balancer refresh tasks.
• Add fluxheim_runtime::NativeBackgroundSupervisor for Pingora-free
  background service spawning, readiness callbacks, shutdown fan-out, and
  join/abort supervision.
• Keep the final Pingora-free proof target at 1.6.24 while this release focuses
  on task-supervision boundaries rather than listener/runtime replacement.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.21.

Security

• Preserve the pingora-compat runtime boundary and dependency-policy gates
  while adding the Fluxheim-owned supervision primitive that internal
  background tasks will use during the remaining runtime/listener cutover.
• Add native critical background-task watchdog support so critical task exits can
  trigger supervisor shutdown before production task wiring moves off Pingora.
• Fix native supervisor shutdown delivery for pre-spawn shutdown, last-handle
  drop, and clone-drop edge cases.
• Harden the native runtime cutover evidence script against unsafe TOML path
  interpolation and missing expected blocker rows in the representative report.
• Mark background-service threads() as Pingora compatibility-only; the native
  supervisor does not treat it as a per-service thread-pool contract.
• Keep the first-party zeroize to sanitization migration planned for the
  post-Pingora stabilization release so secret-container API changes are tested
  as a focused hardening pass.

Compatibility Boundary

• Normal proxy profiles still retain the Pingora compatibility runtime in this
  release. The goal of 1.6.21 is to shrink internal task orchestration
  dependency, not to flip production traffic to a new runtime in one step.

Checksums And Signatures

• Commit: f2e5b797440247cf6bcae8b5a68c823219c7acf7
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 419919e2ffcafdb9f39e104ffe53c32230c5bc4a8b5f9324a3f80f3bd4ff5aa4 fluxheim-1.6.21.tar.gz
  • d8a932b997342509b342a24c123273644274b194fb2b88f0627edb023c15be32 fluxheim-1.6.21.zip
• Binary checksums:
  • x86_64:
    • 50f64aecefd62c7301e98827cab3723e5dc0b725bfbbb856380e04ddb42a2cfa fluxheim-1.6.21-full-x86_64-linux.tar.gz
    • f046452ef3aa57a4be9c8e10140001158c02aea5e5621ee93398234066d4ef4b fluxheim-1.6.21-cache-x86_64-linux.tar.gz
    • 0319d36aeada3c36710e154e2785c0343f5a676558cccb31c64f2d591cf4ac1b fluxheim-1.6.21-proxy-x86_64-linux.tar.gz
    • 44c6657b62a928bad08cdcb563e2408a4d360b54d45a5a9ede14d3012ab236c3 fluxheim-1.6.21-php-x86_64-linux.tar.gz
    • be8b0ef231dc6d2eb1b50e02ecc984f65dc85315bbda452cbbb4783b07a062da fluxheim-1.6.21-load-balancer-x86_64-linux.tar.gz
    • 0effc9f05c093a8dd92a13fff6319026ad5dfd11511916419ab58a6b6f9032e7 fluxheim-1.6.21-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 6b905523f62de6567718cc094729967aa8f2889eedad534cd61dfed75641163a fluxheim-1.6.21-full-aarch64-linux.tar.gz
    • c9d30f52712b361e933fc1084e1938ca5d7be0052d70698652a018fa63cb328f fluxheim-1.6.21-cache-aarch64-linux.tar.gz
    • 716e52318b6ca78054737280f1e0c73d9df7a5145c48af9c0b7267b7eb19899a fluxheim-1.6.21-proxy-aarch64-linux.tar.gz
    • 2b886ef32f257c9156c2baddb67ff0d6ec096fc40ab2dcaf46f7208a1c281a7a fluxheim-1.6.21-php-aarch64-linux.tar.gz
    • 8aa3dd2b0ef584d79fc25f206778d50c1174530b506014199219dcc393112271 fluxheim-1.6.21-load-balancer-aarch64-linux.tar.gz
    • f0f7e55e6332ee7766c0e700019f96e1838b5b6f42d62792b3864d19a155c862 fluxheim-1.6.21-config-tester-aarch64-linux.tar.gz
  • macos:
    • 4481a03c119b8c7d4c87de92ee5ca099118a471d2bad3619f24c626292a21755 fluxheim-1.6.21-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 1bfd955bfa2476e0541c88e604993840bd0fb34bb5742d8ee84b19ccb8736650 fluxheim.spdx.json
  • 59bc32fdb7d48a7258b569be3e5fc6f1cb12cf3637b491025857ea321a04197c fluxheim.cyclonedx.json
• Reproducible build:
  • c18e1d3bda8f047b91016bd3a206f308b65585bc1be7b8025ee326ec3ca82057 x86_64
  • 4b3ef83ad22f9e717fea65b2d10e69daa9b0ebef08d3d1a8c9e9a8ce7621b46a aarch64
  • 7aae16a2f58a98952262f473e78c83d8f52edba87402ae78f3d798f2a916595c macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0b1c599809d861d2477e28a3b90b0a9087676b7e17a4c85b33aa306cb1a77a80
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:d60820841d817097f771d8099caa7dd17a32529e91a163a37245972bb4aaed21
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:488a9798bdb2ea672c21ff63cb56fb2cb4564097ceecb2d0644b59719ed2e435
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a7d4e084a32beabbf6c5e6f1af6410ae335ce5b3567811cb5d05933a1243a4b4
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2514d7fc3367c745c73fe3b8abd0ea64454325e4894c51e49c5acf0964e2edfe
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:72571e7525e9bee3993422fe7ce457bfd8417e92b3c4249e8b59ed2c11a81e16
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ba64191559b5622288411a1b5ceeba64954b93ae13707e90e4ba669befd1796d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:273e2e045e7635d175868812fe285d3452bf18495f45b10f3d8ff9070d6f15f1
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:644baf8bc7cfdf914f206205031c00b110002dddf2b83fe58725aee49e731018
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:bd9dd712570a1a4b8631bc990a3fbafb915d4c801d106f39bd9cbccde8baf67f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1e7dadb120b173935fb4e30b26cd1cfc1c34927abefde4a51320c089e73f3978
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:7e1c38b0baf604c6ecd69230d96b06c6153391b46763fa14c962460723e3e919
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:709425a1892d550c01406d754867263178e1b551e26a41b613505d9b8a440d1c
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4ffd126c5a1fd4b218a7bddd4568bd0c361ce1aaa3d9882c95b3bbdc6195168b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6c5f53e98c7eb8012b2dc63ec3715b46d19d8bf3ca5b8f199f3e9a9563198ce0
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0287d53c2cbefc5e7fc2ca4211ce3d8a4c9ca7eb0601b13c51c06b5cdede21d5
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:9497ab6a93211b10d5269e428dd1f24af4f4610f6352fcce395e90235a374c85
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:609de3a902d5e90df9d0f8602b9fa2f6e25de8457a84ffee96a306f22f9118de
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2f174de96bbb2b23775cd7c72fd4a51786489d0ff657bde15da20be89b5780e7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:41e0801edeac66870f2ceb9520a6676179478e37f940824c121fddf17d536ffa
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4