Fluxheim 1.6.17

Fluxheim 1.6.17 Release Notes

Fluxheim 1.6.17 continues the Pingora-exit line by removing the direct Pingora
dependency from the fluxheim-load-balancer crate. The root compatibility
runtime still uses Pingora in this release, but the load-balancer core and its
active health-check client path are now Fluxheim-owned.

Security and Correctness

• HTTP health checks now use a bounded native HTTP/1.1 probe instead of
  Pingora's HTTP health session. The probe enforces response header/body caps,
  configured connect/read timeouts, configured request headers, expected status
  and header checks, body substring checks, JSON field checks, and degraded
  health-weight headers.
• gRPC health checks now use a native h2 client probe with the existing
  Fluxheim gRPC health request/response framing validation.
• TLS health-check connections use the Fluxheim-owned TCP/TLS connector path,
  including handshake timeout enforcement and protocol-specific ALPN for
  HTTP/1.1 or h2.
• HTTP/1.1 health-check request paths and Host values now reject CR/LF before
  request serialization, closing a native health-probe header-injection gap.
• gRPC health-check response reads now release h2 flow-control capacity and use
  an abort-on-drop driver task guard so error paths cannot leave orphaned h2
  driver tasks behind. h2 driver errors are logged at warning level.
• scripts/validate-pingora-dependency-policy.sh now checks
  cargo tree -p fluxheim-load-balancer directly, so release gates fail if
  Pingora is reintroduced into the load-balancer crate.

Tests

• Added a real TCP listener-backed HTTP/1.1 health-check test proving request
  header forwarding, JSON response validation, and health-derived weight
  updates.
• Added a real h2 server-backed gRPC health-check test proving Fluxheim sends
  the standard gRPC health request body and accepts a SERVING response.
• The load-balancer container smoke now uses HTTP active health checks and
  fails if cargo tree -p fluxheim-load-balancer contains any Pingora crate.
• Verified cargo test -p fluxheim-load-balancer --locked passes with 125
  tests.

Compatibility

• The root runtime adapter remains PingoraCompatibility in this release.
  Normal Fluxheim builds may still compile Pingora through the root proxy
  runtime until the next native HTTP/runtime cutover releases.
• reuse_connection remains accepted in load-balancer health-check
  configuration for compatibility, but the native HTTP/gRPC health-check client
  currently opens a fresh bounded connection per probe.

Checksums And Signatures

• Commit: 5ad994c255d5b1b62e75f88a1f5b7313c3385e3b
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 6ebd8e7665bc042c9edef04c148b322b0a475f4007be06c7f8704ab60d2af054 fluxheim-1.6.17.tar.gz
  • da960df4b677dad05349e2fbc23fcfba90ad436e621ba323abde1e35114fb2ed fluxheim-1.6.17.zip
• Binary checksums:
  • x86_64:
    • 3a6dd3e342edc96c1eb3559e753d855c850cb1b4db474a0b00f7dfb7eb1e00b3 fluxheim-1.6.17-full-x86_64-linux.tar.gz
    • f27b0fea15514ae2a0aad683e477ce9121ab394063b7300bb837a70cc9b260a9 fluxheim-1.6.17-cache-x86_64-linux.tar.gz
    • 562d589b16269986c13e021ebf49a74c3d70e3d0f46e8a2327992c17ecaad137 fluxheim-1.6.17-proxy-x86_64-linux.tar.gz
    • 586a8f5f069253da030c989a264316e3486b1fd3e056860763c42ff108494bd6 fluxheim-1.6.17-php-x86_64-linux.tar.gz
    • 661da3d67b7b776ce529c1360eae037918327643f485f138149b844e60b657bd fluxheim-1.6.17-load-balancer-x86_64-linux.tar.gz
    • 7a10a837eb65a15d273bf7598edbe09324246c93d69bb3b1515ed9160c137fd4 fluxheim-1.6.17-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 4d4ec89c39adb5dd6ccd9aaa45fef685105f7366f9623e7d836456f0c9d75229 fluxheim-1.6.17-full-aarch64-linux.tar.gz
    • e580892b80b738d5c2bca9801ffe97ee23a05cccac2fe41b5c7fb91e792fc0fa fluxheim-1.6.17-cache-aarch64-linux.tar.gz
    • ffdbc59fa90263d650c95e281923360e2f05ce50d6868cb925b6b9ecd878fc68 fluxheim-1.6.17-proxy-aarch64-linux.tar.gz
    • 02f4a0f3a51af09b1d60d7fd22da81697a92cf223b4283300714d5a829b592c8 fluxheim-1.6.17-php-aarch64-linux.tar.gz
    • eb9190a85a7b1b633ba8e3cbb7bcf46591a5fe6dcb21187917e029464f46f52f fluxheim-1.6.17-load-balancer-aarch64-linux.tar.gz
    • 3a2e97627b56a369a2e017cc026479e11061f9688216e827a38d4fbcebd7fef1 fluxheim-1.6.17-config-tester-aarch64-linux.tar.gz
  • macos:
    • a7752cce41472d9923834cbb99164575a83f7c674d05001ee48215d9ebf0151a fluxheim-1.6.17-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • e9af157dc9cf6341026cd584116eda63836bac363565d3d60784ed5eaf10ab20 fluxheim.spdx.json
  • f47685bbd9e52003642e2cfe01bf942e5e24f38e4db64f16d67bbc31328f9650 fluxheim.cyclonedx.json
• Reproducible build:
  • ac7b5f2c1b842e660afa9b663e75e4e0a74d1c14f2e3236d04b9de18935fc886 x86_64
  • 0c636b65dcafdbbd3da2d73c135578ba28d850508af11ac9e3ba298f6161d166 aarch64
  • 9f2f9a35f65403ba58434516e7da679f48464ccc0971b7618519847bf8c5f0da macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:95273b20ac32730d35b2e261ebdf7d7daf90af41632c0ee1c2eb81f87baa8cdc
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0d74430fc11a498e8c789ba67319d38c2c1dd7250edad7f572318d75ef2c708f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2b243cc011e18cc145779628bfca4a0d604f1d3a0db3d7f3a550f7e6950e4498
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:8d7b8d0416e7d6779f70391193dc2b2ae42c657ff5806552933af9aaffe70322
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:02d757d098c98434a68425a742d11f21a073d183fb6c8b93bfa1e13e229a81b5
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:595db5feebd1f45abc5d6b1c4a23ecae552b9d05ae8f3b591e1735fe2743a49f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7e5a9ada350d82be25bb80e42a88d18a2b9e156ba5d0b0e999c33921fc5506d5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a60eac70d4702e594b5440efba9d25f5bdf43bd21ae9334c53bcbe221518beb1
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a89cb378ad92495181f59a0e6fa0871f723dfea608c207a3afbe0be15fcacb08
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:844d5e6796ae38dddbf0fde6543051e84306e7b365211a2dafe4587a4c419c8b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8d55bc481b05661f807bfbf373c183afb1ee53d248d4c1b67185516f612c414a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:30d5db05e677b895cd564f93de41c6221b1d53b373203ebfcbd8fa1ffc3621b2
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8317bf8f72f46a6c1c01e4435d4d6436bd8261b940bd2ad9b2fd42e2ad59cbcc
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4b0075e2c35fb6c2960b82c924da85b2d71bc938710fa01fca321cda4f46bc05
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1c8b6adce56d310d771f2be6dbc09ef7fc7cec97963b27cec2954b1a4067716b
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:651a46a9b25db65eba8f9a58021d44f722f24f11ef412449049d463ceea6da59
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:09f5cdd06f4e124d6cf6d9aab39fedc8d63d9cb37a6eedf5eab2cd4b883f04d4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8a25d34f9a812439c8798cfc8c09e46856e3daf916dfb28c5eb440dd223284d7
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:71ab1e4ad2e90562a3dd47ce8527d57d751423765ed61c48e733c58994fcdf53
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a687ac06b041b0e0c90d23d37c68cff5386fc721b8f9d78d4571a46340e596f4
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4