Fluxheim 1.6.25

[eldryoth]

Fluxheim 1.6.25 Release Notes

Fluxheim 1.6.25 is a Pingora-exit evidence release. The previous plan placed
the final dependency deletion immediately after the HTTP/2 parity proof, but
the remaining compatibility runtime still owns rich proxy behavior such as
cache, web/PHP fallback, auth-request, traffic mirror, redirects, rewrites,
compression, and advanced load-balancer policy. This release makes those
remaining blockers visible per configured proxy scope instead of removing the
adapter before parity is finished. It also starts the route/policy parity work
inside the same release by adding a tested native HTTP/1 route-proxy primitive
for ordinary exact, prefix, and fallback proxy routes.

Changed

• Add native-http1-proxy-candidate rows to
  fluxheim-config-tester --runtime-cutover.
• Report each configured proxy scope as native-ready or
  compatibility-required with the exact native HTTP/1 proxy reason.
• Add native HTTP/1 route proxy handling for exact, prefix, and fallback
  routes with method filters, longest-prefix selection, prefix strip/rewrite,
  and query preservation.
• Re-scope remaining Pingora dependency exceptions to 1.6.28; 1.6.26 and
  1.6.27 are now the remaining native policy and rich proxy integration
  parity slices.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.25.

Security

• Keep blocker rows in the native runtime cutover evidence strictly validated
  while allowing candidate-detail rows for audit visibility.
• Reject invalid native route-proxy request targets and unsafe rewritten paths
  before forwarding.
• Reject ambiguous interior double-slash forward paths in the native
  route-proxy strip/rewrite path.
• Keep regex routes marked as compatibility-required until native regex route
  matching is implemented.
• Validate native HTTP/1 proxy candidate row shape in the runtime cutover gate
  before ignoring those rows for blocker status.
• Reject single-dot route path segments during config validation.
• Keep the dependency exception gate active so documented Pingora removal
  targets remain enforced by CI.

Compatibility Boundary

• Normal proxy profiles still compile the Pingora compatibility runtime in this
  release. That is intentional: deleting it now would either break shipped
  proxy features or make the release less honest than the evidence shows.

Checksums And Signatures

• Commit: 8abd17136836f8ca3d3f43800e121ec9d6decc3b
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • cb975aa81fb9df7d2556e50a6564758590ef8b0610d1c3431628baf7d1abf195 fluxheim-1.6.25.tar.gz
  • 2e6c9a3fa7e60bf26d1aa3d58561c2e0d801b09cec06eb0cc2a2ea64984161fb fluxheim-1.6.25.zip
• Binary checksums:
  • x86_64:
    • 68384d860cb7f65e0f9574019c36145f0020cfa063faf8c22bfcf36614bd2ceb fluxheim-1.6.25-full-x86_64-linux.tar.gz
    • cd119f1cb51c790c82f9bccc5e64ea8be7978f0433a0f5b3cfe38504a51c65bd fluxheim-1.6.25-cache-x86_64-linux.tar.gz
    • c5bf928798f898cd15083e7aeebcde0eb178cc686ee656ecd483eca5bbd5138f fluxheim-1.6.25-proxy-x86_64-linux.tar.gz
    • f360171e237e7d41c22a7d98e0da390a468e363b77a49b563d35396fc61b7dc5 fluxheim-1.6.25-php-x86_64-linux.tar.gz
    • b8b342121128e369d2d95d213d731498e16e4165d5039af50256957086decf03 fluxheim-1.6.25-load-balancer-x86_64-linux.tar.gz
    • b827f0d34afa91e73fb37fb8ebf18ed1a2e87beb4962bc9fa2aaf435d43bc762 fluxheim-1.6.25-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • a007848517d8485a4a950846ccacd798c6beac50a20bf9b586b1545f4821fdb3 fluxheim-1.6.25-full-aarch64-linux.tar.gz
    • 8194c82c2284b79d036f0a7fdfe302b3245b713b8fb2eb7b84eef3aac9e8ae56 fluxheim-1.6.25-cache-aarch64-linux.tar.gz
    • 104dd5688d8baaef7027459a937523aecadbdb0b0a59d5350dcc45b215209c3b fluxheim-1.6.25-proxy-aarch64-linux.tar.gz
    • 18021f6dbc949e5b2af67466123eab1c49c7490ac71d6af4787149a3060cb755 fluxheim-1.6.25-php-aarch64-linux.tar.gz
    • ed5801d8db6a08a05dc3af269c75520296fbc4785d737196f6b931b19b080776 fluxheim-1.6.25-load-balancer-aarch64-linux.tar.gz
    • 21d41860aef6c99ac56dd18d34de52779e1235aee527f7eac1831fa6bd11808e fluxheim-1.6.25-config-tester-aarch64-linux.tar.gz
  • macos:
    • 8db86446b3ac556c06af14ac250e92074f37907b786cfed9f275179299a27ac6 fluxheim-1.6.25-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • c34029633172f1938180103f871f536165f7219e8d5e6c5a540e161738c9eed1 fluxheim.spdx.json
  • 69dadc029a6a94b3aab347de6947916ff7280f48507b3ad5e41c7cde004086c1 fluxheim.cyclonedx.json
• Reproducible build:
  • fb41f2338a47a7a1dcd18038dea494942f3e1db3b48c0be24705e1e5cb1223ba x86_64
  • 1ca266cf6d56c57c644519d0cd564a0db9f47acf13e8fd2fa9a41ca951a97f6f aarch64
  • 8ff959f6b35bce0a049c2a639234476490ed23cc413c523145d647d8468fbce1 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:38535ba104e5470c3accb0399ac838282fc3a1f44f5cf4d76692be5dcc9723a9
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:77a7fe69c905786b16f651dab26a15bdabbb2d652bd21f88c1b9f69b1a65f4c6
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0cb4cabc377a9685032674437f3195e14cd1b92aad08c296e1f44db4fdd2f2c6
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1bebde43cadfa5dde7cb56fc018f8555de2378295a0577f440d8538ed98ed957
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5c956ba52ab37bf122158387e5c797df0bda20eff64b28a4f6d2871d061eb14f
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0fcfd1686e6ba15c2407db775fe61d63a12635d6eb72aa3a05ddf33542930a75
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:76be12ee7d5d3d3014c0ff49e6a73e79ced4c958449ef22fc84a18186ed9e0f5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:50c7b891a0c2cd9e5ead5d9a063ddec96650d915124d4de4af60e14c18f67276
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4198a35a212d23b743b10475f8571c01fbfc13077cb1377ecd46ffd965b47008
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5c9d0a31389cab40fa8054c87c9cf233d948821e5699e49dd11a6a9c9c50599f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1a293939452ccc9b5c8d686f7d455d8c82f53634f46db6dd928adc4ed2c108c5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0cc5b39f56d4465c28064e3761bf633e31b9e0d645b54c615adbb5faf558efa0
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0e9739f7baebf118790ce3669010eadcba47799993440e47f31b2ff6595193e6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4f127b3f10037b837d82725ddb16c3e507fcc1776ff36e45449a2c1542b9dc66
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0f143c4fd2382a99cfeaa785132571dd7389267674f96f264fe67537dacec44d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:69d994c4c9f4c8f80c91cf81cc38e85adfa8a9665c9b9499eb5f5f9fa0efd60f
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:b4bbc2aaafa11322e187cc31a07602d0ab2bc7c3b127595482a13edfd4c1f781
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3c1c39d1233538ec474bcf1ea640a5fce5b2da068e6a0d2823e5c12fc3455c74
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2a56927f70ccc858d5ac7a17d887e921c620dfc46567e0f6f7d3d2cae4d66e93
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:80a9eda2e0e3d93712ca991c6f6a55d80a788ce94c11c3fe510010a2d45f6922
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.25.