Skip to content

v2.8.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@dev-embedthis dev-embedthis released this 06 Nov 03:27
· 97 commits to main since this release
v2.8.1
97fb74f

Ioto Device Agent v2.8.1 Release Notes

Release Date: November 5, 2025

Recommended Action

  • Optional Upgrade -- Upgrade only if convenient
  • Recommended Upgrade -- Upgrade recommended but not essential
  • Essential Upgrade -- All users strongly advised to upgrade

Overview

Version 2.8.1 is an important maintenance release addressing multiple security issues discovered through fuzzing, resource management improvements, and stability fixes. This release includes fixes for resource leaks, and enhanced error handling throughout the web server and runtime libraries.

Major Features

New Runtime APIs

  • Socket Linger Control - New APIs for fine-grained socket connection control and graceful shutdown
    • rSetSocketLinger() - Configure socket linger behavior
    • urlAlloc(URL_NO_LINGER) - URL client socket linger control
  • Fiber Block Management - New rStartFiberBlock() API for managing fiber execution blocks

Security Hardening (Fuzzing Results)

  • Fixed invalid reference in JSON parser discovered through fuzzing
  • Fixed potential null dereference in HTTP method parsing (fuzzing)
  • Enhanced error handling and boundary condition checks

Resource Management

  • Fixed file descriptor leak in putFile operation
  • Fixed premature memory free in web getFile operation
  • Improved fiber exhaustion handling with better error reporting

Bug Fixes

Critical Fixes

  • Fixed hang in webSendFile - Resolved deadlock condition when sending large files
  • Fixed fiber exhaustion handling - Improved resource management when fiber pool is depleted
  • Fixed file descriptor leak - Prevents descriptor exhaustion in long-running applications
  • Fixed premature free in web getFile - Resolved use-after-free condition
  • Fixed upload forms - Resolved issues with file upload form handling
  • Fixed keep-alive timeout - Corrected HTTP keep-alive connection timeout behavior

Security Fixes

  • Fixed invalid reference in JSON parser (discovered via fuzzing)
  • Fixed null dereference in parseMethod (discovered via fuzzing)
  • Enhanced input validation throughout web server

Build System

  • Hardened configure phase to handle missing build/.app file gracefully
  • Refactored app selection mechanism for cleaner, more maintainable builds
  • Fixed conditional compilation when building without cloud support (SERVICES_CLOUD)
  • Fixed Windows build preparation with improved prep.nmake
  • Removed obsolete webserver.vcxproj from Visual Studio projects

Compiler & Warnings

  • Fixed compiler warning in cryptSha1Process function

Testing & CI/CD

  • Enabled complete test suite for all platforms
  • Fixed test setup and isolation issues
  • Fixed web temporary file handling in tests
  • Enhanced CI/CD pipeline reliability with better timeout handling

Configuration

  • Fixed initialization to use default 'unit' app when build/.app doesn't exist
  • Improved cloud service conditional compilation with proper #if SERVICES_CLOUD guards

API Changes

New APIs

  • rSetSocketLinger(socket, enable, timeout) - Configure socket linger behavior
  • urlAlloc(URL_NO_LINGER) - URL client socket linger control
  • rStartFiberBlock() - Manage fiber execution blocks for better control flow

Enhanced Error Handling

  • Improved fiber exhaustion error messages
  • Better diagnostics when fiber pool is depleted
  • Enhanced error reporting in web file operations

Platform Support

Same as v2.8.0:

  • Linux (x86, x64, ARM, ARM64, RISC-V)
  • macOS (Intel, Apple Silicon)
  • Windows 11 (Native with VS2022, WSL)
  • ESP32 (ESP-IDF)
  • FreeRTOS
  • VxWorks (experimental)

Security Considerations

This release includes important security fixes discovered through comprehensive fuzzing:

  • JSON parser boundary condition fixes
  • HTTP method parsing null pointer protection
  • Resource leak prevention (file descriptors, memory)
  • Enhanced input validation in web server

Recommendation: Users running web services exposed to untrusted input should upgrade promptly.

Package Updates

Updated embedded packages (paks):

  • r/ - Runtime library with new fiber and socket APIs (rStartFiberBlock, rSetSocketLinger)
  • json/ - JSON parser with fuzzing fixes
  • crypt/ - Cryptographic library with compiler warning fixes
  • url/ - URL client with linger control support
  • web/ - Web server with hang fix, resource leak fixes, upload forms fix, keep-alive timeout fix, and security improvements

Upgrade Instructions

  1. Backup: Backup your current configuration and state directory
  2. Review Security Fixes: Note the fuzzing-discovered security fixes
  3. Update Source: Update to v2.8.1 source code
  4. Rebuild: Rebuild with your application configuration
  5. Test: Verify build and run comprehensive tests, especially:
    • Web file serving operations
    • Long-running applications (to verify leak fixes)
    • Fiber-intensive workloads

No breaking API changes from v2.8.0. New APIs are additions only.

Known Issues

None identified in this release.

Download

Download from the Builder Site

Documentation

Full documentation available at: https://www.embedthis.com/doc/

Support

For support, please visit:

Note: This release includes 15+ commits with critical security and stability fixes discovered through fuzzing. Upgrade recommended for all production deployments.

Assets 2
Loading