Fluxheim 1.7.4

[eldryoth]

Fluxheim 1.7.4 Release Notes

Fluxheim 1.7.4 starts the VCL-like cache-policy part of optional WebAssembly
extensibility. The first live cache hook is intentionally constrained: plugins
can decide whether cache lookup proceeds, passes through origin, bypasses
cache, skips storage after an origin response, or denies, but cannot yet mutate
raw keys, TTLs, tags, response headers, or stored metadata.

Highlights

• Add live native HTTP/1 cache-lookup Wasm hook execution for vhost and route
  attachments.
• Add live native HTTP/1 cache-store Wasm hook execution after origin
  response and before memory/disk cache writes.
• Add a bounded fluxheim_cache_lookup() -> i32 preview ABI under the existing
  fluxheim_policy_v1 host-call namespace.
• Add cache lookup outcomes:
  • 0: continue normal cache lookup and storage;
  • 1: pass through origin without lookup or storage;
  • 2: bypass cache lookup and storage;
  • 3: deny with 403.
• Add cache store outcomes:
  • 0: continue normal cache storage;
  • 1: serve the origin response but skip storage;
  • 2: deny with 403.
• Apply cache-lookup hooks before native proxy-cache slice lookup, normal
  lookup, peer-fill, request collapsing, origin-fill protection, and store
  admission.
• Thread selected route/vhost Wasm hooks into route-proxy cache paths so cache
  decisions use the same attachment model as access, header, and route hooks.
• Add wasm.max_total_cache_concurrent_executions as a separate process-wide
  admission ceiling for cache-lookup and cache-store hooks.
• Add live listener tests proving a plugin can pass /api/* without storing
  while normal cacheable paths still produce MISS then HIT.
• Add live listener tests proving a plugin can skip storage after an origin
  response and deny before cache write/client delivery.
• Add live listener coverage proving a later cache-store deny wins over an
  earlier skip.
• Add fail-closed live coverage for cache-lookup deny behavior.

Security Notes

• The cache-policy hooks are constrained to integer outcomes and coarse path or
  response-status context. They do not expose raw headers, bodies, filesystem,
  network, admin APIs, private keys, cache-key bytes, or cached object bodies.
• Built-in access policy, rate limits, concurrency limits, route selection, and
  header policy keep their normal order; the cache hook cannot bypass them.
• Cache hooks use their own process-wide cache admission ceiling so hot
  cache-policy routes cannot starve access-decision, route-decision, or header
  hooks on unrelated vhosts.
• Cache-store hook chains are most-restrictive-wins: every hook runs unless a
  hook returns deny, and deny wins over an earlier skip.
• Plugin execution failures still follow the configured fail mode:
  fail-closed denies with 503, while fail-open continues normal cache
  behavior.
• The wasm feature remains optional and is still rejected with
  privacy-mode.
• The release gate updates crossbeam-epoch to 0.9.20 to clear
  RUSTSEC-2026-0204.

Operator Notes

• Plugins that use cache-lookup export fluxheim_cache_lookup() -> i32.
• Plugins that use cache-store export fluxheim_cache_store() -> i32.
• pass and bypass outcomes report x-cache-status: BYPASS with
  x-cache-reason: wasm-pass or wasm-bypass when cache status headers are
  enabled.
• pass and bypass share the external BYPASS cache status but record
  distinct cache-policy activity as pass and bypass.
• Richer cache-policy hooks for bounded cache-key components, TTL override,
  tag assignment, store-admission mutation, and safe response-header mutation
  remain staged for later 1.7.x slices.

Checksums And Signatures

• Commit: befc640024b3718e490ba5b5744d1726371f6acf
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 73c21bd501c6067477b7478a8d2147133646763dc743a07b81694bd0b8308763 fluxheim-1.7.4.tar.gz
  • 7dd086c160f49b1ca7b59149f916ece9d0c29fe4cd7a592e4669c12cbac23900 fluxheim-1.7.4.zip
• Binary checksums:
  • x86_64:
    • c24bfda56df17a3b0fea6c5d7984d5234d2985f98d97836209bccb62876d033a fluxheim-1.7.4-full-x86_64-linux.tar.gz
    • ae310dcaae7873b337d12eafeeabb5445fe9ae1a37b5ab9230895e60188d4753 fluxheim-1.7.4-cache-x86_64-linux.tar.gz
    • cb2683a7e29a5ce4a990b5f0bce216a518ff687624c0575e3fc7739f7fbf95a4 fluxheim-1.7.4-proxy-x86_64-linux.tar.gz
    • c608addb563b38e729e31c7e6d8b3be0e68a2976a61e7b17137dbf0d406c06d7 fluxheim-1.7.4-php-x86_64-linux.tar.gz
    • 33feefe76ab7082c5b19581d2c3525dce4b6a48c22c87430fd12bb4a5eabcf91 fluxheim-1.7.4-load-balancer-x86_64-linux.tar.gz
    • b28007bbf0778a023141c5de7a2faaa865031890a5ea6d3e710c4493f2199da3 fluxheim-1.7.4-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • a0c62b041b7f261dbcf4d23f507c36e87305439ba661894952c4afc97c9871cb fluxheim-1.7.4-full-aarch64-linux.tar.gz
    • 3ea635b2ff883a84dd453521a51445f1651151152b9e14082cad0192ce29d744 fluxheim-1.7.4-cache-aarch64-linux.tar.gz
    • 9ede717945867b9edabda103b81b701ff589484b9128ef00372adec5d9f98531 fluxheim-1.7.4-proxy-aarch64-linux.tar.gz
    • d4ccdf264d72b0811d56513eef244015fd9550b6e5e517662d2915a4999f2e80 fluxheim-1.7.4-php-aarch64-linux.tar.gz
    • 666ca2a57fb51716b532cd642a84f5964f7c68a47141205135a76193a5593b27 fluxheim-1.7.4-load-balancer-aarch64-linux.tar.gz
    • a728616b18ff81e86cf4c3bb4135e357cb9bb2fb0feb922110e1af6c701800a6 fluxheim-1.7.4-config-tester-aarch64-linux.tar.gz
  • macos:
    • 5131694028fe19c4d4918745814f9d8e35ec8ff176ab24c6bec9d3c7b58c4ddf fluxheim-1.7.4-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 621d1868a28d782a439c252d1a4bb7b1511b3e5c5e88b1527a32594fb0010e41 fluxheim.spdx.json
  • 6a0a727a2814c6ddf91d965d38ede300e51c6d168e8dbbcd8d37e770ee84ddc6 fluxheim.cyclonedx.json
• Reproducible build:
  • cb13c979cb1fcf036cab9a69bdee22949946d9bceb85f966b12844fd174bdbd1 x86_64
  • f5f6b2338628c3ef525a3b0ae7c0da8fe9ae4d0948247510a685b1ca2a185d01 aarch64
  • 8ef32281b2227cf23e337d5e00344b14a80be8505d51e6ea0013250fa4e5c465 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:398d019d80aa15cfe26506506dba67f67b3e1a3583a17bb894af2288945e76b9
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:634cab1db3054b01750a25c65f9c7baa244ec93240ee0b90081d67f1c37f4981
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b3221a2d5910ec08a779cd024920defe715fbc9643ca653592d239e46ac71f1d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c220b2c6b58561f43f391b964a1226a1b9cc31ff859195a01beed4dc4a8d6091
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5e7475427223812a04e54ea72517ffc97a2b3fce88f91341f34e0e93641b0b34
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:ed9222cc22773ca54a6517d6701ab90b991ca017651a66d56e904c2f29125320
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6e6fcb4d88f0ee0470c61bd68622f9728db1a33b1271a1c07ff934c034e27426
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:284f65e27589ecf6e3b9f4d41c342749b53ce09405d2f813bce70ad075f300bc
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:541a33fa75070779d397a6befe950d869c2cdc842658ebe0ec5039ff0c766231
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:19b648c78277770a13e7366ebdee181334b9dcfcd22e30a8295f81986168cc89
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1bf0212048daa4fbda4479fffd526b66797a5cb3875d68834aeb03bb678be0f5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:cd5fc3880948367dec623b3133e150f324faf141d23147d5b1906399618b41f4
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:bf1c533b2ba75bca8b97d2d94b6b73f72f62d3a3e99c161b287b35b1a18c6d96
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:65a3452a111107c81d6253cbab35e616fee5c4be48ced1a5ca4b71671b22eb44
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:bbeafeb00f8303d593e8f7b1145b54b52b935d8bad6a61bf42f121d76d30f3c5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:81a159f9bc07df0302aa2a588e057eaf9ee4b9f57c5d8eac7d8c26972ac9d527
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1cc26ae633ed681f9c8ae2d56285fdeeecbcea956a3129aa9e78d2f4decc02d4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:09521f3c366001644bb81fffd85fe41b62e604e83095038936ee918edfd45006
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:457f2783d0c2d0272557646935b0a43f9ef3c8378fab9a5754956342305efe46
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:171e2b339403aca700a857af40f573b9d94cb30045d9c4c9588da3dac4d3eda5
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.4.