Fluxheim 1.6.34

[eldryoth]

Fluxheim 1.6.34 Release Notes

Fluxheim 1.6.34 is the final Pingora-free proof release in the 1.6 runtime
exit line.

This checkpoint removes the remaining Pingora compatibility runtime from
normal Fluxheim builds after the native listener, TLS, HTTP/1, HTTP/2,
WebSocket, load-balancer, cache, admin, metrics, stream, and background-service
paths have reached parity coverage.

Highlights

• Remove the final Pingora runtime/listener/TLS adapter crates from normal
  Fluxheim build profiles.
• Keep the native HTTP/1 and HTTP/2 proxy runtime as the normal runtime path
  for supported route, cache, load-balancer, TLS, WebSocket, admin, and metrics
  configurations.
• Wire native admin cache purge, stale disk-cache purge, cache object lookup,
  and live load-balancer stats/mutation handlers to Fluxheim-owned runtime
  handles instead of compatibility shims.
• Align native cache-key/cache-lookup previews with runtime cache routing for
  route-scoped cache policies, preserve the documented HEAD temporary-bypass
  reason, and emit disk-cache purge activity metrics from native admin purge
  paths.
• Update the Pingora dependency policy so default, full, cache-edge,
  proxy-edge, load-balancer-edge, PHP, privacy, source, RPM, and container
  release gates fail if a normal build still compiles Pingora crates.
• Refresh the OWASP Top 10 2025 release-gate test inventory so it points at
  the native HTTP/1 controls that replaced the legacy Pingora-era tests.
• Make the historical pingora-compat feature marker inert: enabling the
  feature no longer compiles legacy Pingora source paths now that the
  dependency is removed from the manifest.
• Preserve the native runtime cutover evidence and compatibility reporting so
  unsupported configurations fail closed with explicit blockers instead of
  silently falling back to a Pingora adapter.
• Harden native admin cache-preview and cache-purge paths so host matching uses
  the same normalization as runtime routing, regex routes are represented in
  previews, stale disk purges do not hold the registry mutex while doing disk
  I/O, poisoned live config state fails closed, and the root cache API exposes
  only deliberate symbols.
• Refactor native route-proxy construction around typed build contexts so
  clippy release profiles keep the native proxy/server boundary maintainable.

Compatibility Notes

• Pingora is no longer part of normal Fluxheim builds. If a configuration uses
  a feature that the native runtime still reports as unsupported, Fluxheim
  rejects that cutover path with an explicit native-runtime blocker.
• The pingora-compat feature name remains only as a historical compatibility
  marker for older build scripts; it has no dependency payload and does not
  re-enable the removed runtime.
• The 1.6.35 follow-up is reserved for stabilization, soak testing,
  performance comparison, and security-only cleanup after the Pingora-free
  runtime lands.
• The 1.6.36 cleanup follow-up will remove the temporary native proxy shim
  and move cache-preview route matching onto the same precompiled route
  structures used by the serving path.

Verification

• scripts/validate-pingora-dependency-policy.sh
• scripts/validate-native-runtime-cutover.sh
• scripts/stable_release_gate.sh check
• scripts/podman_smoke.sh

Checksums And Signatures

• Commit: db22927fac3572cc2ee77b2b7719acb195824996
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 5e1451618521f77c5ee4d669c785dcf4b1d0ee759d7396e7e0ba84168ef92c42 fluxheim-1.6.34.tar.gz
  • 89eae06f1854138a75945f8f746363f5ab6d62f10a5483237b991cf16fa22fcf fluxheim-1.6.34.zip
• Binary checksums:
  • x86_64:
    • eb1c731ea42d3ea3012725a6d1fafc9fe0c581fef3d9f9e90dd0f2095a86e616 fluxheim-1.6.34-full-x86_64-linux.tar.gz
    • 48405e8c209864fb96bc086d9aa58b70db2316e4be5541d105d7097b63a831e3 fluxheim-1.6.34-cache-x86_64-linux.tar.gz
    • a0cd438cdc814abdab98d6460946d619f43ca789397dadf76b42a13b95ac5b28 fluxheim-1.6.34-proxy-x86_64-linux.tar.gz
    • 5859cc3caa0a824d841368e75292bd50844980704c1be685d8db33082b84fd0f fluxheim-1.6.34-php-x86_64-linux.tar.gz
    • 8e1b922e78a92957ce2febb17b8e843fb0109ae1155358d675e15fa98924359b fluxheim-1.6.34-load-balancer-x86_64-linux.tar.gz
    • a44370a910e9a8dffd43886b569d6d7fc1daa35a72a72eb82fd2e01cd5831411 fluxheim-1.6.34-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 876afe051a7934d4777e32d1d784debe413efa2631a2d29b5b58a9188315f91d fluxheim-1.6.34-full-aarch64-linux.tar.gz
    • 5e28ecc53745c44f1e432bf9a4e7d3debc5f201a02d720cacf1b21bc9f17ca83 fluxheim-1.6.34-cache-aarch64-linux.tar.gz
    • b995ae0ccc43ca7ea995cdb651b3313c68caa176066f30c4ecc22918ef4d01e6 fluxheim-1.6.34-proxy-aarch64-linux.tar.gz
    • 8da9b1f9bf27f8108af05db41307393a16baf2f067c6cff85022ae2c029ef6e6 fluxheim-1.6.34-php-aarch64-linux.tar.gz
    • e5fe4f2d65d06c53f1336190d36178c3b518b27d366ec1313acfda9bcc56bcbe fluxheim-1.6.34-load-balancer-aarch64-linux.tar.gz
    • 16e1c7fe29246b31aee54672dc7b736387d4fb1e7d443547def2fec2f59fd61c fluxheim-1.6.34-config-tester-aarch64-linux.tar.gz
  • macos:
    • 14e60964f81c4681994f551c55712c6d0dde1272ea7f2aa7d1f4154a76c71fe0 fluxheim-1.6.34-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • c7ba0f8a1e0d2447d5b2636a2b1138604f481d35763ed5369e005d576e3b5b3c fluxheim.spdx.json
  • f2ed00bfca6abea1c00b83fd24d51fb056857e08968262d71ab6c6e2380bedcc fluxheim.cyclonedx.json
• Reproducible build:
  • 35480e3be71c25d8331476a6c9b769c8e710822a86238f2a1a5122efa03c4f83 x86_64
  • 9df6d11301997a763d26e88e628a8852afcfafbf3cca4447b17c23c80077b52f aarch64
  • 9b68db7e503039d20bd77d36baa5aeb5e20514e9345605ab9ef51d9b2a989806 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2d18fec00526b331d1e83a440b5e4df6e25f75d38dd72a346b8ef46ab4e3f7de
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8a52d0f7f5f578dad4976b2c3341425373ccb12f61728e11764155d74e405a5b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5f24fb66ca5d17c5ee72092eab2847520b9b129861be90ade4cfad1e08d04bcf
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:13a53b838c50a0e400d16a039df941c6fbb3a44042704a15b76cf0b8ac7e7cb6
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:54bac38782d660aa9648fb8fb23cb0c4624ec2dbc993cdc14195026f06718532
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c68d98d01b18ed6cd667dfa2f92d5cab0aef64d00acbccdcea07a34ad79396ad
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1ebc842ec0f2ae8127526ecf0a4b6c2941a4c43a9485a91cf223d82d76f51bd3
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:02b42825ecc654495b2f9883c62dbd6ce04bb66945fb80a48972101b8bd61a4a
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2d55a7471907e058a7294c71f359af49ebf29d226a3c49df0d217cf65a6f1780
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:59145eed7656232006b15f439c0947ff05c48ad2ff5f33219a4ee49d0b498a4f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:d5c89de159bb746510ecda66d0b4b53fc0cf2e1f9cf462eabbd15fbe24934e0f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:349b37d6144862e741c0dc91adab996ea00e10597b270d6c8177e062ba16fc71
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7da62a36fe4099b05676a7c0f772f6cde07acc521c4a437ed53ff24bf3ea81ca
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5fff383f9886e638805c9aa721ff32b7b6e550807f61564181221cfce749b3f5
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ac54744aa5b28fea1d2bc0a2b07cd7b5582af2104294cc1cac7f6b140eaf5fe7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:7ee1818034fabc05ef02da551f601749ab5611518aaf5de47c6a99de74eca751
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:012e6b94902efe859fc8d8cca503d8e91e40a0c59db9797ccb5976e9cceda0c1
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1c418ac77defebb561c2590be5f82ac6a67bbdac2938d8906a301fb85d01bd03
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4441ab528a3fcf77d9442233d7238e22e324726657e6f5f36fbca2ab49651c0c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:00d3a25e9db2fa5bb8b11fb7f8965a014021d6def93c0b3a7b67bb6e820ee6a6
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.34.