v1.0.0-M42

This is a security hardening release. Upgrade as soon as possible if you:

• are behind an unhardened proxy
• expose websocket endpoints
• are exposed to HTTP/1 trailers

Security fixes

• GHSA-mhvj-jhpq-885v: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
• GHSA-46q4-43ph-c6fr: Chunked-body trailer fields promoted into Request.headers in blaze-server
• GHSA-9gfg-7jp2-g7jf: HTTP/1.0 keep-alive + streaming response emits body with no status line or headers
• GHSA-7ppr-r889-mcf2: Unbounded WebSocket message aggregation in http4s-blaze-server

User-facing dependency updates

• http4s-1.0.0-M47

Changes

• Deprecate HTTP/2 implementation by @rossabaker in #1056

Behind the scenes

• Update sbt, scripted-plugin to 1.10.6 in series/0.23 by @http4s-steward[bot] in #929
• Update http4s-circe, http4s-client, ... to 0.23.30 in series/0.23 by @http4s-steward[bot] in #932
• flake.lock: Update by @http4s-steward[bot] in #931
• flake.lock: Update by @http4s-steward[bot] in #934
• Update sbt, scripted-plugin to 1.10.7 in series/0.23 by @http4s-steward[bot] in #935
• Update sbt-http4s-org to 0.17.6 in series/0.23 by @http4s-steward[bot] in #936
• flake.lock: Update by @http4s-steward[bot] in #937
• Update scala-library to 2.13.16 in series/0.23 by @http4s-steward[bot] in #939
• flake.lock: Update by @http4s-steward[bot] in #938
• flake.lock: Update by @http4s-steward[bot] in #941
• Update scala3-library to 3.3.5 in series/0.23 by @http4s-steward[bot] in #942
• flake.lock: Update by @http4s-steward[bot] in #943
• Update sbt, scripted-plugin to 1.10.10 in series/0.23 by @http4s-steward[bot] in #944
• Update sbt, scripted-plugin to 1.10.11 in series/0.23 by @http4s-steward[bot] in #947
• flake.lock: Update by @http4s-steward[bot] in #948
• flake.lock: Update by @http4s-steward[bot] in #949
• Update async-http-client to 3.0.2 in series/0.23 by @http4s-steward[bot] in #952
• Update munit-cats-effect to 2.1.0 in series/0.23 by @http4s-steward[bot] in #950
• flake.lock: Update by @http4s-steward[bot] in #953
• Update munit-cats-effect to 2.1.0 in main by @http4s-steward[bot] in #951
• flake.lock: Update by @http4s-steward[bot] in #955
• Update circe-generic to 0.14.13 in series/0.23 by @http4s-steward[bot] in #956
• Update scala3-library to 3.3.6 in series/0.23 by @http4s-steward[bot] in #957
• Update sbt-http4s-org to 0.17.7 in series/0.23 by @http4s-steward[bot] in #940
• flake.lock: Update by @http4s-steward[bot] in #958
• Update sbt, scripted-plugin to 1.11.0 in series/0.23 by @http4s-steward[bot] in #959
• Update sbt-http4s-org to 0.18.0 in series/0.23 by @http4s-steward[bot] in #961
• Update sbt, scripted-plugin to 1.11.1 in series/0.23 by @http4s-steward[bot] in #964
• Update sbt-http4s-org to 2.0.0 in series/0.23 by @http4s-steward[bot] in #966
• flake.lock: Update by @http4s-steward[bot] in #965
• Merge series/0.23 into main by @danicheg in #963
• Update sbt, scripted-plugin to 1.11.2 in series/0.23 by @http4s-steward[bot] in #967
• Update circe-generic to 0.14.14 in series/0.23 by @http4s-steward[bot] in #969
• flake.lock: Update by @http4s-steward[bot] in #968
• Update log4cats-slf4j to 2.7.1 in main by @http4s-steward[bot] in #960
• Update sbt, scripted-plugin to 1.11.3 in series/0.23 by @http4s-steward[bot] in #970
• flake.lock: Update by @http4s-steward[bot] in #971
• flake.lock: Update by @http4s-steward[bot] in #972
• flake.lock: Update by @http4s-steward[bot] in #973
• Update sbt, scripted-plugin to 1.11.4 in series/0.23 by @http4s-steward[bot] in #974
• flake.lock: Update by @http4s-steward[bot] in #975
• flake.lock: Update by @http4s-steward[bot] in #976
• Update sbt, scripted-plugin to 1.11.5 in series/0.23 by @http4s-steward[bot] in #977
• Update sbt, scripted-plugin to 1.11.6 in series/0.23 by @http4s-steward[bot] in #979
• Update async-http-client to 3.0.3 in series/0.23 by @http4s-steward[bot] in #980
• flake.lock: Update by @http4s-steward[bot] in #978
• Update http4s-circe, http4s-client, ... to 0.23.31 in series/0.23 by @http4s-steward[bot] in #981
• Update http4s-circe, http4s-client, ... to 1.0.0-M45 in main by @http4s-steward[bot] in #982
• flake.lock: Update by @http4s-steward[bot] in #983
• Update http4s-circe, http4s-client, ... to 0.23.32 in series/0.23 by @http4s-steward[bot] in #984
• Update circe-generic to 0.14.15 in series/0.23 by @http4s-steward[bot] in #985
• Update kind-projector to 0.13.4 in series/0.23 by @http4s-steward[bot] in #986
• Update kind-projector to 0.13.4 in main by @http4s-steward[bot] in #987
• Update sbt-http4s-org to 2.0.1 in series/0.23 by @http4s-steward[bot] in #989
• Update http4s-circe, http4s-client, ... to 1.0.0-M46 in main by @http4s-steward[bot] in #988
• Update sbt, scripted-plugin to 1.11.7 in series/0.23 by @http4s-steward[bot] in #990
• Update sbt-http4s-org to 2.0.2 in series/0.23 by @http4s-steward[bot] in #993
• flake.lock: Update by @http4s-steward[bot] in #992
• Update http4s-circe, http4s-client, ... to 0.23.33 in series/0.23 by @http4s-steward[bot] in #995
• Update async-http-client to 3.0.4 in series/0.23 by @http4s-steward[bot] in #994
• Update scala3-library to 3.3.7 in series/0.23 by @http4s-steward[bot] in #997
• Update sbt-http4s-org to 2.0.3 in series/0.23 by @http4s-steward[bot] in #998
• Update scala-library to 2.13.18 in series/0.23 by @http4s-steward[bot] in #996
• flake.lock: Update by @http4s-steward[bot] in #999
• flake.lock: Update by @http4s-steward[bot] in #1000
• Update scala-library to 2.12.21 in series/0.23 by @http4s-steward[bot] in #1001
• flake.lock: Update by @http4s-steward[bot] in #1002
• Update async-http-client to 3.0.5 in series/0.23 by @http4s-steward[bot] in #1003
• flake.lock: Update by @http4s-steward[bot] in #1005
• flake.lock: Update by @http4s-steward[bot] in #1006
• Update async-http-client to 3.0.6 in series/0.23 by @http4s-steward[bot] in #1007
• Update sbt, scripted-plugin to 1.12.0 in series/0.23 by @http4s-steward[bot] in #1008
• flake.lock: Update by @http4s-steward[bot] in #1009
• Update sbt, scripted-plugin to 1.12.1 in series/0.23 by @http4s-steward[bot] in #1011
• flake.lock: Update by @http4s-steward[bot] in #1012
• Update sbt, scripted-plugin to 1.12.4 in series/0.23 by @http4s-steward[bot] in #1016
• Update sbt-http4s-org to 2.0.5 in series/0.23 by @http4s-steward[bot] in #1015
• Update async-http-client to 3.0.7 in series/0.23 by @http4s-steward[bot] in #1013
• flake.lock: Update by @http4s-steward[bot] in #1017
• Update munit-cats-effect to 2.2.0 in series/0.23 by @http4s-steward[bot] in #1019
• flake.lock: Update by @http4s-steward[bot] in #1021
• Update sbt, scripted-plugin to 1.12.5 in series/0.23 by @http4s-steward[bot] in #1018
• Update sbt, scripted-plugin to 1.12.6 in series/0.23 by @http4s-steward[bot] in #1023
• flake.lock: Update by @http4s-steward[bot] in #1024
• Update sbt, scripted-plugin to 1.12.7 in series/0.23 by @http4s-steward[bot] in #1025
• Update sbt, scripted-plugin to 1.12.8 in series/0.23 by @http4s-steward[bot] in #1026
• Update async-http-client to 3.0.8 in series/0.23 by @http4s-steward[bot] in #1027
• flake.lock: Update by @http4s-steward[bot] in #1028
• Update async-http-client to 3.0.9 in series/0.23 by @http4s-steward[bot] in #1032
• Update sbt, scripted-plugin to 1.12.9 in series/0.23 by @http4s-steward[bot] in #1030
• Update http4s-circe, http4s-client, ... to 0.23.34 in series/0.23 by @http4s-steward[bot] in #1031
• Update sbt, scripted-plugin to 1.12.10 in series/0.23 by @http4s-steward[bot] in #1035
• flake.lock: Update by @http4s-steward[bot] in #1033
• Update sbt, scripted-plugin to 1.12.11 in series/0.23 by @http4s-steward[bot] in #1036
• Update async-http-client to 3.0.10 in series/0.23 by @http4s-steward[bot] in #1037
• flake.lock: Update by @http4s-steward[bot] in #1038
• Update sbt-http4s-org to 2.0.6 in series/0.23 by @http4s-steward[bot] in #1039
• Update sbt, scripted-plugin to 1.12.12 in series/0.23 by @http4s-steward[bot] in #1041
• Update scala3-library to 3.3.8 in series/0.23 by @http4s-steward[bot] in #1040
• Update async-http-client to 3.0.11 in series/0.23 by @http4s-steward[bot] in #1042
• flake.lock: Update by @http4s-steward[bot] in #1044
• Update sbt, scripted-plugin to 1.12.13 in series/0.23 by @http4s-steward[bot] in #1045
• Update circe-generic to 0.14.16 in series/0.23 by @http4s-steward[bot] in #1047
• flake.lock: Update by @http4s-steward[bot] in #1046
• Merge 0.23 -> main by @rossabaker in #1049
• flake.lock: Update by @http4s-steward[bot] in #1051

Full Changelog: v1.0.0-M41...v1.0.0-M42