v0.23.18

This is a security hardening release. Upgrade as soon as possible if you:

• are behind an unhardened proxy
• expose websocket endpoints
• are exposed to HTTP/1 trailers

Security fixes

• GHSA-mhvj-jhpq-885v: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
• GHSA-46q4-43ph-c6fr: Chunked-body trailer fields promoted into Request.headers in blaze-server
• GHSA-9gfg-7jp2-g7jf: HTTP/1.0 keep-alive + streaming response emits body with no status line or headers
• GHSA-7ppr-r889-mcf2: Unbounded WebSocket message aggregation in http4s-blaze-server

User-facing dependency updates

• http4s-0.23.36

Changes

• Deprecate HTTP/2 implementation by @rossabaker in #1056

Behind the scenes

• Update sbt-buildinfo to 0.13.1 in series/0.23 by @http4s-steward[bot] in #924
• Update sbt, scripted-plugin to 1.10.6 in series/0.23 by @http4s-steward[bot] in #929
• Update http4s-circe, http4s-client, ... to 0.23.30 in series/0.23 by @http4s-steward[bot] in #932
• Update sbt, scripted-plugin to 1.10.7 in series/0.23 by @http4s-steward[bot] in #935
• Update sbt-http4s-org to 0.17.6 in series/0.23 by @http4s-steward[bot] in #936
• Update scala-library to 2.13.16 in series/0.23 by @http4s-steward[bot] in #939
• Update scala3-library to 3.3.5 in series/0.23 by @http4s-steward[bot] in #942
• Update sbt, scripted-plugin to 1.10.10 in series/0.23 by @http4s-steward[bot] in #944
• Update sbt, scripted-plugin to 1.10.11 in series/0.23 by @http4s-steward[bot] in #947
• Update async-http-client to 3.0.2 in series/0.23 by @http4s-steward[bot] in #952
• Update munit-cats-effect to 2.1.0 in series/0.23 by @http4s-steward[bot] in #950
• Update circe-generic to 0.14.13 in series/0.23 by @http4s-steward[bot] in #956
• Update scala3-library to 3.3.6 in series/0.23 by @http4s-steward[bot] in #957
• Update sbt-http4s-org to 0.17.7 in series/0.23 by @http4s-steward[bot] in #940
• Update sbt, scripted-plugin to 1.11.0 in series/0.23 by @http4s-steward[bot] in #959
• Update sbt-http4s-org to 0.18.0 in series/0.23 by @http4s-steward[bot] in #961
• Update sbt, scripted-plugin to 1.11.1 in series/0.23 by @http4s-steward[bot] in #964
• Update sbt-http4s-org to 2.0.0 in series/0.23 by @http4s-steward[bot] in #966
• Update sbt, scripted-plugin to 1.11.2 in series/0.23 by @http4s-steward[bot] in #967
• Update circe-generic to 0.14.14 in series/0.23 by @http4s-steward[bot] in #969
• Update sbt, scripted-plugin to 1.11.3 in series/0.23 by @http4s-steward[bot] in #970
• Update sbt, scripted-plugin to 1.11.4 in series/0.23 by @http4s-steward[bot] in #974
• Update sbt, scripted-plugin to 1.11.5 in series/0.23 by @http4s-steward[bot] in #977
• Update sbt, scripted-plugin to 1.11.6 in series/0.23 by @http4s-steward[bot] in #979
• Update async-http-client to 3.0.3 in series/0.23 by @http4s-steward[bot] in #980
• Update http4s-circe, http4s-client, ... to 0.23.31 in series/0.23 by @http4s-steward[bot] in #981
• Update http4s-circe, http4s-client, ... to 0.23.32 in series/0.23 by @http4s-steward[bot] in #984
• Update circe-generic to 0.14.15 in series/0.23 by @http4s-steward[bot] in #985
• Update kind-projector to 0.13.4 in series/0.23 by @http4s-steward[bot] in #986
• Update sbt-http4s-org to 2.0.1 in series/0.23 by @http4s-steward[bot] in #989
• Update sbt, scripted-plugin to 1.11.7 in series/0.23 by @http4s-steward[bot] in #990
• Update sbt-http4s-org to 2.0.2 in series/0.23 by @http4s-steward[bot] in #993
• Update http4s-circe, http4s-client, ... to 0.23.33 in series/0.23 by @http4s-steward[bot] in #995
• Update async-http-client to 3.0.4 in series/0.23 by @http4s-steward[bot] in #994
• Update scala3-library to 3.3.7 in series/0.23 by @http4s-steward[bot] in #997
• Update sbt-http4s-org to 2.0.3 in series/0.23 by @http4s-steward[bot] in #998
• Update scala-library to 2.13.18 in series/0.23 by @http4s-steward[bot] in #996
• Update scala-library to 2.12.21 in series/0.23 by @http4s-steward[bot] in #1001
• Update async-http-client to 3.0.5 in series/0.23 by @http4s-steward[bot] in #1003
• Update async-http-client to 3.0.6 in series/0.23 by @http4s-steward[bot] in #1007
• Update sbt, scripted-plugin to 1.12.0 in series/0.23 by @http4s-steward[bot] in #1008
• Update sbt, scripted-plugin to 1.12.1 in series/0.23 by @http4s-steward[bot] in #1011
• Update sbt, scripted-plugin to 1.12.4 in series/0.23 by @http4s-steward[bot] in #1016
• Update sbt-http4s-org to 2.0.5 in series/0.23 by @http4s-steward[bot] in #1015
• Update async-http-client to 3.0.7 in series/0.23 by @http4s-steward[bot] in #1013
• Update munit-cats-effect to 2.2.0 in series/0.23 by @http4s-steward[bot] in #1019
• Update sbt, scripted-plugin to 1.12.5 in series/0.23 by @http4s-steward[bot] in #1018
• Update sbt, scripted-plugin to 1.12.6 in series/0.23 by @http4s-steward[bot] in #1023
• Update sbt, scripted-plugin to 1.12.7 in series/0.23 by @http4s-steward[bot] in #1025
• Update sbt, scripted-plugin to 1.12.8 in series/0.23 by @http4s-steward[bot] in #1026
• Update async-http-client to 3.0.8 in series/0.23 by @http4s-steward[bot] in #1027
• Update async-http-client to 3.0.9 in series/0.23 by @http4s-steward[bot] in #1032
• Update sbt, scripted-plugin to 1.12.9 in series/0.23 by @http4s-steward[bot] in #1030
• Update http4s-circe, http4s-client, ... to 0.23.34 in series/0.23 by @http4s-steward[bot] in #1031
• Update sbt, scripted-plugin to 1.12.10 in series/0.23 by @http4s-steward[bot] in #1035
• Update sbt, scripted-plugin to 1.12.11 in series/0.23 by @http4s-steward[bot] in #1036
• Update async-http-client to 3.0.10 in series/0.23 by @http4s-steward[bot] in #1037
• Update sbt-http4s-org to 2.0.6 in series/0.23 by @http4s-steward[bot] in #1039
• Update sbt, scripted-plugin to 1.12.12 in series/0.23 by @http4s-steward[bot] in #1041
• Update scala3-library to 3.3.8 in series/0.23 by @http4s-steward[bot] in #1040
• Update async-http-client to 3.0.11 in series/0.23 by @http4s-steward[bot] in #1042
• Update sbt, scripted-plugin to 1.12.13 in series/0.23 by @http4s-steward[bot] in #1045
• Update circe-generic to 0.14.16 in series/0.23 by @http4s-steward[bot] in #1047
• Upgrade to http4s-0.23.36 by @rossabaker in #1050
• Update sbt-http4s-org to 2.0.7 in series/0.23 by @http4s-steward[bot] in #1054
• Use the maintained Nix flake instead of the archaic shell by @rossabaker in #1055
• Update sbt, scripted-plugin to 1.12.14 in series/0.23 by @http4s-steward[bot] in #1057

Full Changelog: v0.23.17...v0.23.18