v0.2.10

• Discarded DATA returns connection flow-control credit. A frame on a
  retired stream, a frame that exceeds the stream receive window, or DATA
  after the peer sent END_STREAM is counted against the connection window
  and answered with WINDOW_UPDATE (RFC 9113 §6.9). A retired stream whose
  frame exceeds the connection window is a FLOW_CONTROL_ERROR. Previously
  the peer's connection send window shrank on every cancelled call and the
  connection could stall.
• One stream-slot predicate (StreamState.occupies_slot) now backs
  open_stream, the server's peer MAX_CONCURRENT_STREAMS check,
  live_stream_count, and retire_stream. The server no longer frees a
  peer stream's slot when only its own side has sent END_STREAM.
• queue_rst_stream marks a known stream reset once the frame is queued.
  Readiness-driven resets now free the slot, and send_rst_stream keeps
  the stream reset when its flush fails with the frame still queued.
• A peer SETTINGS_INITIAL_WINDOW_SIZE change that pushes a stream's send
  window above 2^31 - 1 is now a FLOW_CONTROL_ERROR connection error
  (RFC 9113 §6.9.2). Streams we have reset or finished sending on are
  exempt.
• A request content-length must be one or more digits (RFC 9110 §8.6).
  A non-digit value is a stream PROTOCOL_ERROR. Previously Int() accepted
  signs, whitespace, and digit separators, and -1 matched the
  absent-header sentinel, so the body-length check was skipped.

v0.2.9

Pin mojo-net 0.2.7 and mojo-tls 0.3.3. Security-limit docs and connection limits. Install: pixi add mojo-http2

mojo-http2 0.2.7

Configurable SETTINGS_INITIAL_WINDOW_SIZE on Http2Connection.

• Http2Connection(initial_window_size=...) advertises SETTINGS_INITIAL_WINDOW_SIZE and sizes new stream receive windows. Values above 65,535 also send a connection-level WINDOW_UPDATE.
• Preface SETTINGS and the companion WINDOW_UPDATE are reserved as one unit. Servers reserve that startup output before accepting any client preface byte.
• Blocking process_next_frame flushes startup output before reading the first peer frame.
• Pins source, recipe, and package tests to mojo-net v0.2.4 (write_some).

mojo-http2 0.2.6

Caller-driven keepalive, graceful GOAWAY helpers, and safer output flushing.

• flush_output uses write_some and drops any prefix the transport accepted, so a failed flush can be retried without duplicating bytes. Requires mojo-net v0.2.3.
• touch_keepalive / maybe_keepalive_ping queue a PING after an idle interval. The first call starts the clock without sending.
• begin_graceful_shutdown queues GOAWAY with NO_ERROR; live_stream_count reports streams that are still open or half-closed. Locally opened streams are refused after GOAWAY.
• Applies the peer SETTINGS_HEADER_TABLE_SIZE to the HPACK encoder, including the shrink-then-grow update.
• Refuses locally opened streams that would exceed the peer SETTINGS_MAX_CONCURRENT_STREAMS.

mojo-http2 0.2.5

mojo-http2 0.2.5 accepts mojo-tls 0.3 packages while retaining compatibility with mojo-tls 0.2 releases.

The source and installed-package checks now use mojo-net 0.2.2 and mojo-tls 0.3.0. The release passed 30/30 differential checks and h2spec 146/146 in both cleartext and TLS modes on macOS and Linux.

mojo-http2 v0.2.4

Adds an optional per-call frame dispatch budget to feed_input, with ordered empty-input resume and unchanged unlimited behavior by default.

mojo-http2 v0.2.3

This release adds bounded lifetime management for completed HTTP/2 stream state.

• retire_stream releases a reset or bidirectionally closed stream after buffered DATA is consumed
• Retired stream IDs remain classified as closed under RFC 9113
• Retirement validates live stream bookkeeping before changing connection state
• A 4,096-stream sequence against hyper-h2 verifies bounded live state and closed handling for late frames
• Full test, compliance, example, benchmark, and package gates pass on macOS and Linux
• h2spec passes 146/146 in cleartext and 146/146 over TLS
• The compiled package is versioned and tested as 0.2.3

mojo-http2 v0.2.2

This release adds readiness-driven HTTP/2 connection integration and tightens endpoint role handling.

• process_frame, feed_input, queue_*, and take_pending_output support caller-driven event loops without hidden transport I/O
• Fragmented header blocks and outbound bytes remain bounded, with behavior checked against hyper-h2
• Clients advertise SETTINGS_ENABLE_PUSH=0 and reject server-sent ENABLE_PUSH values
• A live h2spec badge links to the published compliance report
• The incremental h2c loopback example demonstrates startup, request, and response handling
• Full test, compliance, example, benchmark, and package gates pass on macOS and Linux
• h2spec passes 146/146 in cleartext and 146/146 over TLS
• The compiled package is versioned and tested as 0.2.2

mojo-http2 v0.2.1

This release adds bounded incremental frame decoding and hardens HTTP/2 over TLS verification.

• Incremental decoding accepts split and coalesced transport input with bounded retained memory
• Differential checks compare fragmented decoding against hyperframe
• TLS functional shutdown now drains required HTTP/2 control frames before transport close
• Full test, compliance, and package gates run on macOS and Linux
• h2spec passes 146/146 in cleartext and 146/146 over TLS
• The compiled package is versioned and tested as 0.2.1

v0.2.0

This release adds verified HTTP/2 over TLS and a directly installable compiled package.

• H2TLSContext requires the h2 ALPN token for both client and server roles
• TLS behavior is checked against CPython ssl and hyper-h2
• h2spec passes all 146 cases in both cleartext and TLS modes
• The package contains compiled hpack and h2 modules
• Clean-prefix package checks run on macOS and Linux

The full compatibility suite passes 15/15 checks.