v0.6.2

neva 0.6.2 is a security release. It fixes a denial of service in the Streamable HTTP server transport (GHSA-v789-mrvh-rj42): a client that went away before its response was ready stopped the whole server. Every release since 0.1.0 is affected, on both protocol profiles. If you serve over HTTP, upgrade. stdio servers are not affected.

Compatible with 0.6.1: nothing in the public API was added, removed or changed.

Security

A caller that gives up no longer stops the HTTP server (GHSA-v789-mrvh-rj42)

When a POST's connection closed before its handler had finished -- a client timeout shorter than a slow tool, a proxy idle timeout, or a client doing it on purpose -- the response had nowhere to go, and the transport treated that as fatal: it cancelled itself and App::run returned. One such request was enough.

• A response whose caller has gone away is now dropped, and the server goes on serving.
• A POST that goes away releases its slot for the response at once, instead of holding it until the response arrives -- or forever, if it never does.

There is no workaround short of upgrading. with_auth limits who can trigger it to authenticated clients, and a supervisor that restarts the process limits the outage. A CVE has been requested and will be added to the advisory once assigned.

Fixed

• A request whose handler panics is answered with InternalError. Nothing caught the panic, so no reply was ever sent: over stdio the caller waited out its timeout, and over HTTP its POST stayed open until the caller gave up. This covers the handler, its on_commit effects and the request state store, batched requests included. The panic message goes to the server log, not to the caller. A panic in your own middleware wrapped around next is still not answered.