AHC v3.0.12 Release

What's Changed

• Release v3.0.11 by @hyperxpro in #2198
• Reduce per-request allocation in ThreadSafeCookieStore.get() by @hyperxpro in #2201
• escape quote and crlf in multipart content-disposition values by @jmestwa-coder in #2203
• Avoid Uri reallocation in UriEncoder.encode() on the no-op path by @hyperxpro in #2204
• Reuse a per-thread UriParser scratch to avoid per-parse allocation by @hyperxpro in #2205
• Intern known request header names to static AsciiString by @hyperxpro in #2206
• Match HTTP/2 content-encoding with AsciiString constants instead of toLowerCase by @hyperxpro in #2207
• Improve CI Release Workflow by @hyperxpro in #2208
• Fall back to NIO instead of throwing when no native transport is available by @hyperxpro in #2209
• fail websocket handshake on invalid sec-websocket-accept by @jmestwa-coder in #2211
• Localize tests that depended on public endpoints by @hyperxpro in #2215
• [Performance] Raise default HTTP/2 initial window size to 16 MiB by @hyperxpro in #2213
• Add LoadBalance.ROUND_ROBIN for per-request IP round-robin by @pavel-ptashyts in #2202
• Bump the dependencies group with 5 updates by @dependabot[bot] in #2222
• Bump actions/checkout from 6 to 7 in the actions group by @dependabot[bot] in #2223
• use SecureRandom for digest auth cnonce by @jmestwa-coder in #2220
• skip origin Authorization on CONNECT proxy request by @madib06ops in #2234
• escape quoted-string params in Digest Authorization header by @madib06ops in #2236
• stop config realm leaking to a cross-origin redirect target by @jmestwa-coder in #2224
• fail SCRAM exchange on invalid ServerSignature by @madib06ops in #2235
• normalize the scheme case in the Uri constructor by @madib06ops in #2239
• Fix LICENSE file for Apache 2.0 by @hyperxpro in #2242
• Enable HTTPS endpoint identification in JsseSslEngineFactory by @hyperxpro in #2243
• Reject CR/LF in raw multipart part-header fields by @hyperxpro in #2244
• Read InputStream bodies straight into the buffer, no staging array by @pavel-ptashyts in #2233
• Bind origin Kerberos/SPNEGO token to the origin service, not the proxy by @hyperxpro in #2245
• Avoid per-connect lock on shared Bootstrap options map (#2218) by @pavel-ptashyts in #2219
• Make idle-channel pool cleaner reap in a single O(n) pass by @pavel-ptashyts in #2225
• Mirror Netty option-failure semantics in applyChannelOptions by @hyperxpro in #2247
• Round robin issue (#2214) by @pavel-ptashyts in #2217
• Release the round-robin HTTP/2 permit when a connection starts draining by @hyperxpro in #2248
• Harden the O(n) idle-pool reap tests: stable idle window + kept-after-removed coverage by @hyperxpro in #2249
• Wait for a sibling HTTP/2 connection without blocking the caller thread by @pavel-ptashyts in #2227
• Generalize failed-IP cooldown across all LoadBalance modes and make it configurable by @pavel-ptashyts in #2221
• Never block the event loop acquiring a connection permit by @pavel-ptashyts in #2226
• Harden the HTTP/2 connection-waiter registry against waiter failures and shutdown races by @hyperxpro in #2251
• No blocking acquire on event loop by @hyperxpro in #2252
• Schedule the round-robin request timeout once, not twice by @pavel-ptashyts in #2229
• Harden failed-IP cooldown config and add DEFAULT-mode test by @hyperxpro in #2253
• Fail fast on empty round-robin address resolution by @hyperxpro in #2254
• Signal STOP on the finishing multipart chunk, not an extra empty read by @pavel-ptashyts in #2232
• Reuse the per-request partition key instead of recomputing it by @pavel-ptashyts in #2231
• Document that BodyState.STOP may carry the final bytes by @hyperxpro in #2255
• Avoid the per-request rotation copy in round-robin address selection by @pavel-ptashyts in #2230
• Cap cookies retained per domain (RFC 6265 5.3) by @pavel-ptashyts in #2256
• Mark the round-robin RotatedView RandomAccess and cover its bounds check by @hyperxpro in #2257
• Add AI Agent Guidelines to AGENTS.md by @hyperxpro in #2268
• Support HTTP/2 after proxy CONNECT by @rampreeth in #2250
• strip userinfo from the absolute-form proxy request target by @madib06ops in #2258
• Avoid unused promise allocation in address resolution by @pavel-ptashyts in #2259
• Skip empty channel pool partitions during reap by @pavel-ptashyts in #2262
• use SecureRandom for the multipart boundary and websocket key by @madib06ops in #2282
• Avoid duplicate preemptive Digest hashing by @pavel-ptashyts in #2276
• Prune idle per-host connection semaphores by @pavel-ptashyts in #2277
• Optimize client stats collection by @pavel-ptashyts in #2270
• Intern common Train-Case header names by @pavel-ptashyts in #2266
• Guard per-host semaphore pruning against unbalanced releases by @hyperxpro in #2283
• Release throttle permits only once by @pavel-ptashyts in #2280
• Soften overstated complexity claim in stats javadoc by @hyperxpro in #2285
• Cache Basic auth header on Realm by @pavel-ptashyts in #2267
• Document Basic auth header caching, guard against stale copies by @hyperxpro in #2286
• Add regression tests for throttle permit release edge cases by @hyperxpro in #2287
• create the resumable index store with owner-only permissions by @madib06ops in #2281
• Avoid rebuilding clean query strings by @pavel-ptashyts in #2265
• Fix per-host connection permit leak on the connect path by @hyperxpro in #2288
• Use HPACK spelling for HTTP/2 compression by @pavel-ptashyts in #2271
• Redact sensitive headers from debug logs by @pavel-ptashyts in #2279
• Trim dead sensitive-logging wrappers and document scope by @hyperxpro in #2290
• Validate converted HTTP/2 headers and trailers by @pavel-ptashyts in #2275
• Bump io.netty:netty-codec-compression from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #2292
• Bump io.netty:netty-codec-http from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #2293
• Run HTTP/2 stream openers outside lock by @pavel-ptashyts in #2274
• Correct drainPendingOpeners javadoc and document SETTINGS-raise test scope by @hyperxpro in #2295
• Batch HTTP/2 upload flushes and prevent duplicate endStream by @pavel-ptashyts in #2264
• Bump the dependencies group with 3 updates by @dependabot[bot] in #2296
• Bump actions/setup-java from 5 to 5.6.0 in the actions group by @dependabot[bot] in #2297
• Claim exact idle generation before closing pooled channels by @hyperxpro in #2298
• Improve CI Stability by @hyperxpro in #2299
• Auto-detect native transport by default when its library is available by @hyperxpro in #2216
• Guard debug logs in pollPooledChannel by @pavel-ptashyts in #2300
• Skip redirect set lookup for non-3xx responses by @pavel-ptashyts in #2301
• Read only when the channel does not auto-read by @pavel-ptashyts in #2302
• Decode a lone response body part in place by @pavel-ptashyts in #2303
• Pin the read count on both autoRead paths by @hyperxpro in #2304
• Bump Netty from 4.2.16.Final to 4.2.17.Final by @hyperxpro in #2305
• [chore] Cleanup docs by @hyperxpro in #2307
• Release v3.0.12 by @hyperxpro in #2306

Security

• GHSA-v9f2-7rw2-gr2x - Origin credentials sent in cleartext to a proxy that rejects the CONNECT
• GHSA-x5w6-vm3f-pp6f - SOCKS proxy credentials sent to the origin server over plaintext HTTP
• GHSA-7grg-jcf7-rpmx - Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
• GHSA-f8m2-889x-vw4x - Client-wide realm credentials re-sent to a cross-origin redirect target
• GHSA-gcmv-gr82-6m8v - Connection permit leak on TLS handshake failure causes per-host denial of service
• GHSA-xr57-gcx8-52hf - Origin credentials sent to the proxy on the plaintext CONNECT request
• GHSA-cf59-3jcr-vfhw - Resumable download index store is created world-readable and follows a planted symlink
• GHSA-qpfv-56x8-xgx4 - URL userinfo credentials sent to the HTTP proxy in the request line
• GHSA-3wp9-xfwm-rjjf - WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
• GHSA-mfj3-87qq-382v - Digest authentication cnonce generated with a non-cryptographic random source
• GHSA-fj9w-c36g-h5x8 - SCRAM and Digest mutual-authentication responses are not verified
• GHSA-rwhr-j9rv-85f8 - WebSocket handshake continues after a failed Sec-WebSocket-Accept check

New Contributors

• @rampreeth made their first contribution in #2250

Full Changelog: async-http-client-project-3.0.11...async-http-client-project-3.0.12