Fluxheim 1.6.11

[eldryoth]

Fluxheim 1.6.11 Release Notes

Fluxheim 1.6.11 continues the 1.6 Pingora-exit line by adding a native HTTP/2
runtime preview gate in fluxheim-server. This release does not cut production
traffic over to the native HTTP/2 path. Instead, it makes the remaining safety
hooks explicit and proves the first bounded HTTP/2 request handling path with
focused tests.

Added

• Added a native HTTP/2 preview gate that records required safety hooks and
  keeps cutover blocked until every hook is implemented and covered by parity
  fixtures.
• Added a native HTTP/2 stack probe using the Rust h2 stack with bounded
  header-list size, decoded header count, URI length, request body size,
  request body timeout, concurrent streams, frame size, send buffer size, and
  rapid-reset policy settings.
• Added downstream HTTP/1.0 socket tests for missing Host, default
  connection close, and explicit Connection: keep-alive.
• Added scripts/smoke_native_http2_preview.sh and registered it in
  docs/runtime-parity-fixtures.tsv.

Hardened

• Native HTTP/2 cutover remains blocked on three explicit hooks:
  pre-routing HPACK/header-count allocation proof, absolute response-write
  lifetime, and trailer/gRPC pass-through parity.
• Native HTTP/2 request-body draining now releases flow-control capacity after
  consumed DATA frames and keeps the h2 connection driven while bodies drain.
• Native HTTP/2 now enforces [server.limits].max_uri_bytes against the request
  URI, matching the HTTP/1 request-target budget.
• Native HTTP/2 post-shutdown streams are logged at debug level instead of
  being silently discarded.

Tests

• Added HTTP/2 preview tests for successful responses, decoded header-count
  rejection, oversized URI rejection, bounded request bodies, oversized request
  bodies, slow request-body timeout, and request-body flow-control release.
• Added real downstream HTTP/1.0 socket coverage for hostless requests,
  close-by-default behavior, and explicit keep-alive.

Verification

• cargo fmt --all --check
• cargo test --locked -p fluxheim-server native_http1
• cargo test --locked -p fluxheim-server native_http2
• cargo test --locked -p fluxheim-server downstream_http2
• scripts/smoke_native_http1_proxy.sh
• scripts/smoke_native_http2_preview.sh
• RUSTFLAGS='-D warnings' cargo check --locked -p fluxheim-server
• scripts/validate-runtime-fixtures.sh check
• cargo check --locked --workspace --all-targets

Checksums And Signatures

• Commit: 124f3921c59e962c0ab789b6eb5ae014f6f4f965
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • b7ce7f256c1599ef348cacf8183673dfaf9ae31bca0105548d45a6c2786c9f0a fluxheim-1.6.11.tar.gz
  • aa6ef4641657933353aea2ef5d97fe305521644a62b9e2f78475686dd3f51508 fluxheim-1.6.11.zip
• Binary checksums:
  • x86_64:
    • 67351d9db19d9c19f315794ccc891d1eb93622ec626c5535f02f66979bcc5bd2 fluxheim-1.6.11-full-x86_64-linux.tar.gz
    • a2443d83f489e9c656b9ec4dc945d48dcad4db63be2570e104d22634a97a1b7b fluxheim-1.6.11-cache-x86_64-linux.tar.gz
    • be4ce8f6706095791bcd8b886ddf0e8343e17d50ba58b059b43d7753829d16f7 fluxheim-1.6.11-proxy-x86_64-linux.tar.gz
    • 6f8d1cf37fd7eae6365be88415cb3da317136bf6413084cba191f1847f7f421b fluxheim-1.6.11-php-x86_64-linux.tar.gz
    • cb128fa3331677d6f31b1b25549e1dcda3b9bb4e2a5a897fc078928437b3e32d fluxheim-1.6.11-load-balancer-x86_64-linux.tar.gz
    • 7677aa0b5a81ab08554ab224eba0048639269d889ee00302ebb61276cc1ce239 fluxheim-1.6.11-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 666fbdde6837da4edb274c604549825d06929f0733897f6fbd062a6358a134f7 fluxheim-1.6.11-full-aarch64-linux.tar.gz
    • 3b7e3e7c95588156afeff6988235b54b53da69144adbc58a0dfb9fd9951df216 fluxheim-1.6.11-cache-aarch64-linux.tar.gz
    • e3e985f26c82ba7da68a6889da29f7b4c6abe415cf7bb908f9b0b435cbdafa19 fluxheim-1.6.11-proxy-aarch64-linux.tar.gz
    • 8b54a0d80967da3d03b99f203474b0af5e6bb5a00a915cc01ff9d79062e5e9f7 fluxheim-1.6.11-php-aarch64-linux.tar.gz
    • 3fc60c17c296d9f3eab045d6ed868055ab5a2bb0174920afc015c0429d811fbc fluxheim-1.6.11-load-balancer-aarch64-linux.tar.gz
    • f4cf76863ca4b9ed4c91e22ef11d70926afb35bdd651cb0cc48fd2bff64bc213 fluxheim-1.6.11-config-tester-aarch64-linux.tar.gz
  • macos:
    • 0d171c52f13fcb7245eca02e54e245938ad0b0536a60b9557f9571b3ac7b68cb fluxheim-1.6.11-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 1315ce046b114a978d802e5c63abcadb5a90ca25046d20bc92d87c903eeadba3 fluxheim.spdx.json
  • f4b547d2664af0708d7f0e255614cf63e71ee932b7421fb03b6483d5c250972d fluxheim.cyclonedx.json
• Reproducible build:
  • ffe01ddc5f061e3a4012742bd2c307ad393e4cce15e7c2cb6891c3cecdf9057e x86_64
  • b2e46eb11a784eecb8ce87da160df5ee3fd33df3a10aa42656ffcae251bd5a98 aarch64
  • 5bbb5e2a2541edf2cd5c3737ae696e0018200fa1f350ddeb0eff7a518ca8ad32 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:15bfc58387b951acb108825af2d8d0d363c7b2397213d08ef9603f48de7bb7b5
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6a0413a786ad9207347777a3651f8cd7f28a9daaeaf57543ed276c55bcfcc6c5
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2ae3d358a4f2770d90fd1a57d8bf1a359c3a742c390a77e49eeba680bf54ef1d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2f058b2176a2750a6f0b34d36059834cce93e255d4cc8e3e4ecd02aba38de894
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1e7f7f327ed6126dc3e2ddba2f05c43e596174d3563ae05f074e4769eda1e06e
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6b584dc6a56848e949a4881301f39a334244241da4a476ae99514df9932b324d
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:75a84d8df1ef6ff4bf9982e03bed1329d46d090945028ea60e58753b232528cc
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1cc245761259d508a784df7551ece451de9dede5fdccf16f9c3ef23e25edf214
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1a5803fa9857172a2699d24a92894e8fbbef3c6780a325524a06d6256f42b035
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:89699e85420635681e04222ecc70c0403d9ee7f82fa24b596cd1be914ee142f8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2b4cda4407a799e4341b2460d56ce1ea05d9c77f4b3535df0df4cafab941e5a0
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:862a938c95add65652c355c6d5bb7815c16f83bb250a7dc07bde9d664e76e3f7
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6f73eae93dd745c70a727ab8c2d03656d88f4dae2d3f9e14dbb36165e1a1b188
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1098956a4eb1d82929de6e9cdd8f1ac69a54dfba78e2cd2741e54eda0183e8a3
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:a3c6b372f9671e1ead7bc6e84f9823016919fe3d3caf0ae7c52a85bb57987a10
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:5dddc18c0e70d0a6078dcf6b6574a2b596f58a2d4636750ef295f9988d38141d
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c0c43e8cef78986df7a45589a6c21564fd956417ca9935b0d30cd16250b89472
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0909c13154752321d9c17d56bc1f46909860098bc952d03b0382bc8baaca84f8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2b83d9627a507cbe0a85bd4f693a93b13f7b51b3f96b2753f4cb52dbfb7322aa
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:920bfd2f6e1aeb39cbffe580b0395f98e826665e13b0e7e0e1a3fb8351967396
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.11.