-
4c8e5d5 protect 1.5.x and enable CI (#1367) by PJ Fanning · 7 hours ago main
-
8f36c20 Update jackson-databind to 3.2.4 (#1362) by Scala Steward · 3 days ago
-
27545c3 build(deps): Bump actions/setup-java from 6.0.1 to 6.1.0 (#1361) by dependabot[bot] · 4 days ago
-
cb936b9 build(deps): Bump coursier/cache-action from 8.1.1 to 8.2.0 (#1360) by dependabot[bot] · 4 days ago
-
b4fb6ca build(deps): Bump sbt/setup-sbt from 1.5.11 to 1.5.12 (#1359) by dependabot[bot] · 4 days ago
-
6f14a60 fix: escape control characters in parse-error details and document the raw request target (#1294) by PJ Fanning · 4 days ago
-
4265d80 perf: copy ASCII bytes with the bulk String.getBytes instead of a charAt loop (#1299) by PJ Fanning · 4 days ago
-
6f845e4 perf: Huffman decode HPACK string literals into reusable scratch arrays (#1302) by PJ Fanning · 4 days ago
-
db91db1 Update jackson-databind to 2.22.4 (#1357) by Scala Steward · 5 days ago
-
8aa98a6 Update classgraph to 5.0.0 (#1355) by Scala Steward · 7 days ago
-
fc6106e Update classgraph to 4.8.199 (#1353) by Scala Steward · 9 days ago
-
a5445d8 Update caffeine to 3.3.1 (#1352) by Scala Steward · 9 days ago
-
04db009 release notes for 1.4.2 (#1345) by PJ Fanning · 9 days ago
-
265a6ce fix: reject control bytes in the request line and malformed HTTP/2 :scheme and field names (#1341) by PJ Fanning · 10 days ago
-
0808b90 fix: send ':scheme' and ':authority' for a relative URI over HTTP/2 (#1342) by PJ Fanning · 10 days ago
-
d81fa58 fix: stop public Scala APIs requiring a private JavaMapping implicit (#1340) by PJ Fanning · 10 days ago
-
9a138ba Drop chunk extensions containing NUL, not only CR or LF (#1344) by PJ Fanning · 11 days ago
-
8086242 build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1347) by dependabot[bot] · 11 days ago
-
6759710 Update classgraph to 4.8.198 (#1348) by Scala Steward · 11 days ago
-
64752d4 fix: reject uppercase HTTP/2 field names and values with surrounding whitespace (#1343) by PJ Fanning · 12 days ago
-
8b90944 build(deps): Bump sbt/setup-sbt from 1.5.8 to 1.5.11 (#1321) by dependabot[bot] · 12 days ago
-
179ea04 docs: fix and add release note milestone links (#1339) by PJ Fanning · 12 days ago
-
5954bdf Re-pin the threat model to b1de40b, absorb what merged, and trim it to what a triager needs (#1295) by PJ Fanning · 13 days ago
-
b1de40b Update classgraph to 4.8.197 (#1336) by Scala Steward · 2 weeks ago
-
cf02338 Fail Scala 3.8+ builds on warnings again (#1333) by PJ Fanning · 2 weeks ago
-
ef1eca7 release notes for 1.4.1 (#1277) by PJ Fanning · 2 weeks ago
-
7448e89 2.0.0-M2 release notes (#1326) by PJ Fanning · 2 weeks ago
-
243329f build(deps): Bump coursier/setup-action from 3.0.3 to 3.0.4 (#1331) by dependabot[bot] · 2 weeks ago
-
561929f feat: add client-side max connection age for HTTP/2 (#1320) by Rayan-and-beyond · 3 weeks ago v2.0.0-M2 v2.0.0-M2-RC1
-
9c63776 Follow-up to max-connection-age: infinite grace test, docs, and FOREVER round-trip in Java setters (#1323) by PJ Fanning · 3 weeks ago
-
958943d Update sbt-paradox, sbt-paradox-theme to 0.11.1 (#1325) by Scala Steward · 3 weeks ago
-
5c7e50f Update sbt-java-formatter to 0.14.0 (#1324) by Scala Steward · 3 weeks ago
-
478c58b feat: add max-connection-age setting for HTTP/2 server connections (#1316) by Anders Kreinøe · 3 weeks ago
-
638a214 feat: bound the size of an incoming HTTP/2 frame (#1264) by PJ Fanning · 3 weeks ago
-
ff919e1 improvement: Use code for silencing warning (#1322) by Tomasz Godzik · 3 weeks ago
-
7d3ae9a Use 1.4.1 in @since tags for max-header-list-size settings (#1318) by PJ Fanning · 4 weeks ago
-
fae3e0b Update classgraph to 4.8.196 (#1315) by Scala Steward · 4 weeks ago
-
0799595 Update sbt-mima-plugin to 1.2.1 (#1313) by Scala Steward · 4 weeks ago
-
cbc4206 perf: encode HPACK header blocks from byte arrays into an unsynchronized ByteStringOutputStream (#1301) by PJ Fanning · 4 weeks ago
-
b82adfc Update jackson-databind to 2.22.3 (#1310) by Scala Steward · 4 weeks ago
-
d7c59aa Update sbt-scalafix, scalafix-core to 0.14.9 (#1309) by Scala Steward · 4 weeks ago
-
459cb1f Update sbt-api-mappings to 3.1.0 (#1312) by Scala Steward · 4 weeks ago
-
2fd621d Update jackson-databind to 3.2.3 (#1314) by Scala Steward · 4 weeks ago
-
84a1061 Update caffeine to 3.3.0 (#1311) by Scala Steward · 4 weeks ago
-
0ed79fd build(deps): Bump coursier/setup-action from 3.0.2 to 3.0.3 (#1308) by dependabot[bot] · 5 weeks ago
-
f5c2bb5 build: replace external dependency graph plugin #452 (#1307) by Matthias Kurz · 5 weeks ago
-
e697e54 fix: reject a request-line part that cannot be sent as given (#1296) by PJ Fanning · 5 weeks ago
-
d9a5eb1 chore: add SPDX license headers to project-info.conf and paradox .htaccess (#1306) by PJ Fanning · 5 weeks ago
-
da54f5e fix: fail instead of throw when a transform on a completed FastFuture throws (#1305) by PJ Fanning · 5 weeks ago
-
f462427 build(deps): Bump actions/setup-java from 6.0.0 to 6.0.1 (#1304) by dependabot[bot] · 6 weeks ago
-
f019432 chore: replace immutable.Seq with Seq, drop Scala 2.12-era imports (#1298) by PJ Fanning · 6 weeks ago
-
40b07a2 http/2: reject a header field carrying CR, LF or NUL, and answer a malformed field with a 400 (#1297) by PJ Fanning · 6 weeks ago
-
dc22225 fix: start each multipart part with its own header state (#1279) by PJ Fanning · 6 weeks ago
-
524a557 hpack: decode header blocks from any InputStream, without copying (#1251) by PJ Fanning · 6 weeks ago
-
7f71b13 perf: avoid copying WebSocket deflate/inflate output (#1235) by PJ Fanning · 6 weeks ago
-
a63fd46 perf: hand ByteBuffers to Inflater and CRC32 in the coding stages (#1228) by PJ Fanning · 6 weeks ago
-
7dc416d add warnings about limitations of idle-timeout (#1194) by PJ Fanning · 6 weeks ago
-
9bbb67c give ParsingErrorHandler access to the request that was rejected (#1245) (#1246) by PJ Fanning · 6 weeks ago
-
e202ffd perf: decode parser byte ranges in bulk instead of char by char (#1229) by PJ Fanning · 6 weeks ago
-
eed92b0 feat: honour Raw-Request-URI as the HTTP/2 :path (#1280) by PJ Fanning · 6 weeks ago
-
f4dbeea Use lazy log templates instead of string interpolation (#1292) by PJ Fanning · 6 weeks ago
-
83eb948 fix: release buffered data accounting when an incoming HTTP/2 stream is shut down (#1281) by PJ Fanning · 6 weeks ago
-
9861865 fix: cancel the pending slot state timeout when a pool slot is shut down (#1283) by PJ Fanning · 6 weeks ago
-
5b9a02e fix: cancel open request timeouts when the server connection stage stops (#1284) by PJ Fanning · 6 weeks ago
-
20fb738 fix: fail requests still queued in a pool interface that stops (#1282) by PJ Fanning · 6 weeks ago
-
a35e11f fix: filter the ParserSettingsImpl accessors shifted by max-part-count (#1293) by PJ Fanning · 6 weeks ago
-
ff9f88e feat: bound the number of parts in a multipart entity (#1266) by PJ Fanning · 6 weeks ago
-
7e39060 fix: reject whitespace between chunk-size digits (#1257) by PJ Fanning · 6 weeks ago
-
c428fed Add a draft threat model and wire it for discoverability (#1242) by Jarek Potiuk · 6 weeks ago
-
e2a096d Fix typo in reference.conf comment (#1289) by PJ Fanning · 6 weeks ago
-
6740cbd Update sbt-mima-plugin to 1.2.0 (#1286) by Scala Steward · 6 weeks ago
-
2c5b6f7 Update sbt-scalafix, scalafix-core to 0.14.8 (#1285) by Scala Steward · 6 weeks ago
-
6649288 Update scala-xml to 2.5.0 (#1288) by Scala Steward · 6 weeks ago
-
bc5af65 Update classgraph to 4.8.195 (#1287) by Scala Steward · 6 weeks ago
-
c7655e1 docs: modernize HTTP/2 ALPN and h2c guidance (#1253) by Samuele Resca · 7 weeks ago
-
def9e1b fix: ignore the reserved bit of an incoming HTTP/2 stream identifier (#1261) by PJ Fanning · 7 weeks ago
-
2dc91fe fix: release connection-level flow control accounting for discarded buffered data (#1259) by PJ Fanning · 7 weeks ago
-
28def88 fix: require every Origin to be allowed on a CORS request (#1262) by PJ Fanning · 7 weeks ago
-
44b01c3 fix: reject a message whose Transfer-Encoding value cannot be parsed (#1267) by PJ Fanning · 7 weeks ago
-
9876344 fix: honour the Materializer passed to Java DSL Route.flow (#1276) by PJ Fanning · 7 weeks ago
-
08b65ed Update scala-library to 3.9.0 (#1274) by Scala Steward · 7 weeks ago
-
aa0225c Update munit to 1.3.6 (#1275) by Scala Steward · 7 weeks ago
-
6cd9e7b fix: drop rendered headers containing NUL as well as CR and LF (#1260) by PJ Fanning · 7 weeks ago
-
b9a6a41 fix: prevent CRLF injection through chunk trailers and extensions (#1256) by PJ Fanning · 7 weeks ago
-
46d2ffc fix: drop HTTP/2 header fields containing CR, LF or NUL (#1258) by PJ Fanning · 7 weeks ago
-
2bb837f Compare path elements when checking that a served file is below the base directory (#1218) by PJ Fanning · 7 weeks ago
-
4fab7d6 fix: count repeated Connection headers towards max-header-count (#1255) by PJ Fanning · 7 weeks ago
-
2f88aae fix: do not send a response body to HTTP/2 HEAD requests (#1239) by PJ Fanning · 7 weeks ago
-
f985997 perf: find SSE line terminators with ByteString.indexOf (#1226) by PJ Fanning · 7 weeks ago
-
c7f3b45 Avoid reopening jars per resource request and deleteOnExit per upload (#1217) by PJ Fanning · 7 weeks ago
-
98fd100 test: cover Locale.ROOT lowercasing paths from #1086 (#1225) by PJ Fanning · 7 weeks ago
-
b67759c stop parsing chunks once the chunk count limit is reached (#1220) by PJ Fanning · 8 weeks ago
-
ef8a03f build(deps): Bump actions/setup-java from 5.7.0 to 6.0.0 (#1254) by dependabot[bot] · 8 weeks ago
-
4638cdd chore: fold Http2JDKAlpnSupport into Http2AlpnSupport (#1232) by PJ Fanning · 8 weeks ago
-
85d7243 Document Opentelemetry dependencies (#1240) by PJ Fanning · 8 weeks ago
-
09213dd test: add HTTP/2 coverage for the HEAD method (#1238) by PJ Fanning · 8 weeks ago
-
0d8bed1 chore: replace deprecated String constructor in StringTools (#1230) by PJ Fanning · 8 weeks ago
-
9eb283e fix: read HPACK string literals with readNBytes (#1231) by PJ Fanning · 8 weeks ago
-
dfd5b18 http/2: bound incoming header blocks with max-header-list-size (#1216) by PJ Fanning · 8 weeks ago
-
dd0a4a3 fix: render Content-Length for HEAD responses with a declared length (#1237) by PJ Fanning · 8 weeks ago