Fluxheim 1.6.18

[eldryoth]

Fluxheim 1.6.18 Release Notes

Fluxheim 1.6.18 continues the Pingora-exit line. The goal for this release is
to expand the native cutover toward every official profile while preserving the
1.6.17 proof that the fluxheim-load-balancer crate itself remains
Pingora-free.

Security and Correctness

• Start from the 1.6.17 native load-balancer health-check hardening baseline:
  HTTP/1.1 health probes reject CR/LF in request path and Host values, gRPC
  health probes release h2 flow-control capacity, and h2 driver tasks are
  aborted on all exit paths.
• Harden native health probes after the 1.6.18 split: gRPC health requests now
  guard frame-length conversion, reject @ userinfo in configured health hosts,
  require grpc-status: 0 trailers, and reject overlarge protobuf varints;
  HTTP/1.1 health responses now use an 8 KiB response-header cap; exec health
  checks re-enforce exec_allowed_commands at runtime.
• Split native HTTP/1.1 and gRPC/h2 health-check helper code into focused
  private modules under fluxheim-load-balancer. This keeps the protocol
  serialization/parsing paths reviewable without changing the public
  load-balancer API.
• Split Redis, MySQL, and PostgreSQL active health probes into a private
  database health module. The wire-format parsers, request constants, and
  timeout handling remain unchanged, but database probe review no longer shares
  a large file with HTTP/gRPC orchestration.
• Split exec active health checks into a private exec module so command launch,
  environment scrubbing, timeout handling, and exit-status interpretation have a
  smaller dedicated review surface.
• Split TCP health checks, TCP/TLS handshake setup, ALPN selection, and shared
  HTTP health-stream connection handling into a private transport module. The
  bounded handshake behavior from 1.6.17 remains covered by the same tests.

Compatibility

• The root compatibility runtime may still compile Pingora while this release
  is in progress. The release target is to remove Pingora proxy/cache/pool
  crates from normal official profiles only when the native replacement paths
  pass the same release gates and smoke tests.
• Keep root-profile Pingora dependency exceptions targeted at 1.6.19 while
  1.6.18 finishes the load-balancer health split. The dedicated
  fluxheim-load-balancer crate remains covered by the stricter Pingora-free
  gate.

Checksums And Signatures

• Commit: f02b555fa7dbd1b76aeba8c49ffcbdeada6394cc
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 989106f725cdc1f2e5682076939a128bd83af383c14f1253c5b40ef6c4ec7c2b fluxheim-1.6.18.tar.gz
  • d47095a85370a5a7c2c5fc34c99fa3908cf9b4044a705804702719e1ca94c4c3 fluxheim-1.6.18.zip
• Binary checksums:
  • x86_64:
    • d6a5a7d0781b87aae7eee81bdf04c336e2847666c9ffdb4cb38fca439ac4c2ce fluxheim-1.6.18-full-x86_64-linux.tar.gz
    • d17364ad752ad8db531bd778c308ad5f9a367a6ac96c54f7fcec1968a20d9fa5 fluxheim-1.6.18-cache-x86_64-linux.tar.gz
    • 9f8d0ba7d8665013c18b26f7398a981db2ad41e2671f66204055f5e956f1e4bb fluxheim-1.6.18-proxy-x86_64-linux.tar.gz
    • 31dfc4ac4fd68716ffcbfcba9326f644ff8151977c30795d810daf7a35ac85c9 fluxheim-1.6.18-php-x86_64-linux.tar.gz
    • 1f75be5590d6d2b93f1591c23f2f301abef831f013912e05dfe1c6cc9d73f3e7 fluxheim-1.6.18-load-balancer-x86_64-linux.tar.gz
    • 438c69e94e122b815b495f689a587586f820af3300ccbcf416b632dedaef8635 fluxheim-1.6.18-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • bf34a6a3b8a72cb01efef09b08cae0d93b5fa1d1078f54324dabf3a6ecd50df3 fluxheim-1.6.18-full-aarch64-linux.tar.gz
    • 5102a6e301f0b1e6b0a8509b0ad57139fa31663f607d840efbb9b9346ffb58ed fluxheim-1.6.18-cache-aarch64-linux.tar.gz
    • f88b9d15dcb73c78d316a309fabe4849d176b2f2360fda6da10ed9924ce85487 fluxheim-1.6.18-proxy-aarch64-linux.tar.gz
    • 63f591e07550b7d4ddbdf8e92e8595a177e67db8d4f51e9b6268a676d956d189 fluxheim-1.6.18-php-aarch64-linux.tar.gz
    • b37d32f5fdb3b0cd51e62c36979cb509730fef6225cc5e90377a3949278776f4 fluxheim-1.6.18-load-balancer-aarch64-linux.tar.gz
    • 1177de949412172c09eed20de3e355f2119b400e42f365b8073cd249cf6b12d3 fluxheim-1.6.18-config-tester-aarch64-linux.tar.gz
  • macos:
    • 4c8638b15137a740cbdca0c9603f821ee74093aa013c92b672dbc6cfa35c5fc8 fluxheim-1.6.18-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • c0efbfb253e93f0deb5f4e08ea71432ad68ab4f9a28ce6794da5f6e999924f4d fluxheim.spdx.json
  • 41f6cf8b5d7450c186bc1060f86ea6d88694c27a57db69cbbf36038a76199e7e fluxheim.cyclonedx.json
• Reproducible build:
  • 381cc59a09d01f2be67a049c60289bb7fe0c27d6c430ee64897f9a029877c799 x86_64
  • 8e7a0c738f77cfd17c391f1ed728010666cd0611b5a61159707a84f47f956d5e aarch64
  • 4dd6ab726716b129f4cb52bb84f08764869ccb1ffcde571736d741287f494bd3 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1e845d3bc281990427d6521a087ec85472910a83390ed652b98c8b164c5d95ad
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6a2fe588d48a763f85427c417759d49d9c94019dd39c22775d8e9172dbdc69ac
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:24821c753c382210df143d4a40797f139c9207d1ae17bd0cf42fdc3679256c6a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:459abd6a28250f6921d086ea2b534993e074784d43b993fc3b2f0dc8889cabe1
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:18af3332ef4095c4d247b0be437d428a9ced11265107b590cbc37d26f674059f
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:491eb46667aa33d52a773cd551693dcb70f10a30cf76fde844de23846066874c
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4568cc693f6270d93fe8c01cc3cf7a93f233cf0041b4951f87413a5a41c5b16b
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:b805ed9563f5d05aad5e7131a9e611ec84285caf616caf884887a465f0810a5e
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:473d94db3799df599d2dd0b170ad5a1170f409cd86f4f4751973b237ba889417
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8eaa28d2e730d1e26c466dec8a6d555d66c3381f43f03981e2ef58072da51811
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:189a9e9cf4e8c3407d1716f1b728828542af85672cd8cfeb65ce38b83ee4911b
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3f192ccd248137f77aed3924295a78470a84c16f25f849dc9321b1df1e1c849f
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7b040440ea102e4642ff59100abcccf9edc53bde86970fe86b38347480feef75
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:27fdccdc6b23832baf14b46aa2ab3fb5304996546d57f2f8caa2ac6fc228d3d7
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5d1ab0dad4891e87990d9acd6186264c72ebd996cf7a60ff795cbecd3b7a4edb
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:19a0930d2e7020e4ad3c8fe36fafe6a04a0851709e962039ae9b32f27e4b5c52
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:879d9ab6902f7c04aba7360bc7a7a18cb7ea005df52f830640767f7175e545e7
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:52ccd008bbcc605dfd48e85220fda5d534b90cf16ff8cf53576e927f9a1b1a44
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:215bfebfd92dbae312e10befafa045d7810adcd0188235c94174ab0b2233dadd
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:9aae2a661ff9d433f83da82490c5911eefd8ca0d8ae7bf976ba314974cadf811
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.18.