Upgrade pingora to 0.8.0 (resolves 3 pingora-* CVEs)#3

Merged

raffaelschneider merged 39 commits into

mainfrom

May 25, 2026

Commits on Feb 10, 2026

add gitlab-ci yml to bleeper ignore

gumpt
authored and
johnhurt
committed
feat: add support for client certificate verification in mTLS configuration

fabian4
authored and
johnhurt
committed
Fix a bug with the ketama load balancing where configurations were not persisted after updates
johnhurt
committed
Add upstream_write_pending_time to Session for upload diagnostics

schunduri-blip
authored and
johnhurt
committed
Upgrade body mode on 101

drcaramelsyrup
authored and
johnhurt
committed
Prevent v1 reuse on body overread (pipeline)

drcaramelsyrup
authored and
johnhurt
committed
Send RST_STREAM CANCEL on application read timeouts for h2 client

andrewhavck
authored and
johnhurt
committed
Pipe subrequests utility

gumpt
authored and
johnhurt
committed
Handle UpgradedBody in more filters

drcaramelsyrup
authored and
johnhurt
committed
Ignore msrv in lockfile for audit

drcaramelsyrup
authored and
johnhurt
committed

Commits on Mar 2, 2026

transfer-encoding parsing robustness

duke8253
authored and
johnhurt
committed
Avoid close delimit mode on http/1.0 req

drcaramelsyrup
authored and
johnhurt
committed
Upgrade body mode on subrequest

drcaramelsyrup
authored and
johnhurt
committed
Reject invalid content-length v1 requests

drcaramelsyrup
authored and
johnhurt
committed
Add the ability limit the number of times an upstream connection can be reused
johnhurt
committed
Add a builder for pingora proxy service to avoid parameter combination explosiion
johnhurt
committed
Add is_upgrade_req() and was_upgraded() to custom server Session trait

Al Riddoch
authored and
johnhurt
committed
Reject non-chunked transfer-encoding

drcaramelsyrup
authored and
johnhurt
committed
Disable CONNECT method proxying by default

drcaramelsyrup
authored and
johnhurt
committed
Correct the custom protocol code for shutdown

Al Riddoch
authored and
johnhurt
committed
Handle custom ALPNs in s2n impl of ALPN::to_wire_protocols() (#1)

varunravi98
authored and
johnhurt
committed
Add a system for specifying and using service-level dependencies
johnhurt
committed
remove `CacheKey::default` impl

gumpt
authored and
johnhurt
committed
Check fd match in h2 connector

drcaramelsyrup
authored and
johnhurt
committed
Fix upgrade handling if body not init

drcaramelsyrup
authored and
johnhurt
committed
Validate invalid content-length on v1 resp by default

drcaramelsyrup
authored and
johnhurt
committed
fix(windows): add missing `RawStream::Virtual` match arm in `AsRawSocket` impl

authored and
johnhurt
committed
Add Windows support and block until main loop returns

danechitoaie
authored and
johnhurt
committed
fix invalid CL option on ALPN fallbacks

drcaramelsyrup
authored and
johnhurt
committed
Recognize dcb/dcz in compression handling

schunduri-blip
authored and
johnhurt
committed
fix: don't use all for socket

justinrubek
authored and
johnhurt
committed
don't consider "bytes=" a valid range header

gumpt
authored and
johnhurt
committed
strip {content, transfer}-encoding from 416s

gumpt
authored and
johnhurt
committed
Allow server bootstrapping to take place in the context of services with dependents and dependencies
johnhurt
committed
Bump pingora to version 0.8.0
johnhurt
committed
Update changelog for 0.8.0
johnhurt
committed

Commits on Mar 5, 2026

fix(deps): disable prometheus default features to remove protobuf vulnerability
raffaelschneider
committed

Commits on May 25, 2026