httpjet v0.0.3

httpjet v0.0.3 — security and hot-path fixes

This release fixes several ways static or precompressed file serving could expose script source, blocks proxied responses from setting internal cache controls, and restores local purge handling when a rewrite proxy route is disabled. It also tightens the page-cache file tier and reduces work in HTTP/3 deadlines, cache hits and startup, PHP suffix routing, LSAPI dispatch, and client throttling.

The page-cache file tier now opens files beneath a pinned root with openat2 where available and uses a secure descriptor walk elsewhere. The new HJPC v3 format discards older v2 cache entries once at startup; expect a cold cache immediately after upgrading if the persistent file tier is enabled.

HTTP/3 load clients are included in the public source so the benchmark suite can exercise QUIC even without an HTTP/3-capable h2load. The standalone fuzz lockfile is updated for 0.0.3.

The deployed x86_64 PGO build passed config, cache-isolation, purge, HTTP/2, HTTP/3, live member, and restart-persistence checks. Paired old/new loopback benchmarks completed with identical bytes and zero request failures. Throughput did not show a repeatable slowdown, although host I/O contention made the measurements too variable to resolve small differences reliably. Public CI, protocol interoperability, and bounded fuzzing were run against this source snapshot.