Fluxheim 1.6.28

Fluxheim 1.6.28 Release Notes

Fluxheim 1.6.28 continues the Pingora-exit work by moving two more rich proxy
features onto the native HTTP/1 route/proxy adapters.

Highlights

• Route-level response compression now works in the native HTTP/1 route proxy
  through the fluxheim-compression crate.
• Native compression feature mapping now reaches fluxheim-server for gzip,
  zstd, and brotli builds.
• Native route compression preserves the existing eligibility checks: GET
  only, 200 OK, compressible content type, bounded input/output size,
  Accept-Encoding negotiation, no active Content-Encoding, no Range
  response, no Set-Cookie, and no request Authorization or Cookie.
• Native route compression now ranks enabled codecs by the client's
  Accept-Encoding q-values before falling back to Fluxheim's tie-break order.
• proxy.error_pages now builds on the native HTTP/1 proxy for static 502/504
  fallback pages backed by fluxheim-web.
• Native custom proxy error pages preserve the proxy failure status while using
  the configured static error page body and headers.
• Live native HTTP/1 listener tests now prove gzip route compression and custom
  proxy error-page responses end to end.

Security Notes

• Native compression removes origin ETag and Content-Length before sending
  the compressed body, appends Vary: accept-encoding, and lets the native
  response writer own the final compressed length.
• Compression is skipped rather than forced if the encoder exceeds configured
  output bounds or cannot initialize.
• Custom proxy error pages only serve files resolved by the native static-web
  resolver; directory listings, missing files, forbidden paths, and oversized
  bodies fall back to the standard 502/504 response.
• Custom proxy error-page responses now close the downstream connection after
  the upstream failure, matching the built-in 502/504 failure responses.
• Native error-page serving uses the same symlink-safe fluxheim-web path
  validation and rooted file-open behavior as native static routes.

Compatibility

This release does not remove Pingora from normal builds yet. The remaining
compatibility-path blockers are inherited global/vhost compression, cache
lookup/fill/stale behavior, PHP-FPM routing, auth-request, traffic mirror,
forwarded-client-IP ownership shortcuts, dynamic discovery, health-aware
load-balancing, persistence, priority/backup/drain state, and hash-based
load-balancer selection.

Checksums And Signatures

• Commit: ed662cf0dfd462864256e536e87dff605cd80a45
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 17cd4345f8c91fd3991318fb56b29d25ac3e35952edd6bc7c5cb658e668e4489 fluxheim-1.6.28.tar.gz
  • e76805f02cc6ed60d1d7a174a1ecd068ed0e88962a97aa61e5766dfb707686cb fluxheim-1.6.28.zip
• Binary checksums:
  • x86_64:
    • 92d4d68d05b53dbe69a153f55f29c386cf001b03c28c6f2ad46e4c2d861caab1 fluxheim-1.6.28-full-x86_64-linux.tar.gz
    • 0a11dfd72f8a72c569143fe14cbc16e9ee25b8284cc63ecad12b20cf41069ff3 fluxheim-1.6.28-cache-x86_64-linux.tar.gz
    • b7ac7970b83742ff5d7120715810246c0660c320b49f5527c9aa423034703dd5 fluxheim-1.6.28-proxy-x86_64-linux.tar.gz
    • ff46c748eb8ebb3a9335be905c90c498aa5cbdc9c08949e56238c5df2ad7673c fluxheim-1.6.28-php-x86_64-linux.tar.gz
    • 9d15b8dc930b9b426ca981b953f6691344b66eab17307c58919180aa5f374d7e fluxheim-1.6.28-load-balancer-x86_64-linux.tar.gz
    • ef007a3031cd48c46dcd30cefa30b77bd70b02f946f3842d3fe89eb3df2d3b77 fluxheim-1.6.28-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 7206c0c2228622eaf7239490b09e21a746b1be16d8afeec3d584c3073d8303ab fluxheim-1.6.28-full-aarch64-linux.tar.gz
    • f6f28cc92af788e3bd330f94b7bafdb1f7129d83ac1d03ffdf5ac943c8e7d67e fluxheim-1.6.28-cache-aarch64-linux.tar.gz
    • fea671bd8ca1fb503ed7a10a443cd73e39f37e6f4e0410e6ed20cacfd3fd6112 fluxheim-1.6.28-proxy-aarch64-linux.tar.gz
    • 392e3e81661bd9c3d38dee618d3d791035e775ebfd3cff0cf68d45f957331e6c fluxheim-1.6.28-php-aarch64-linux.tar.gz
    • 289fd7c76bdfa409424da3568f62f72a2de03cec6ff97f1bbdaabda2f597e406 fluxheim-1.6.28-load-balancer-aarch64-linux.tar.gz
    • de1e8540eda5bb2d0d6fbf344a4611a1c171af0ecb36db0d7f4b787ccb2bb40c fluxheim-1.6.28-config-tester-aarch64-linux.tar.gz
  • macos:
    • 57f07cd9bd82f8aeb3e97413024d764d17ba6257f9c82945f794a10ffee7452d fluxheim-1.6.28-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 11a767c44a6bb8b61cd93e90f637489cbb13e17a5b8d99215f3c2b31796755dd fluxheim.spdx.json
  • fa4e2d865660e4720e6991e5a5208fd4db6bca0f6f2c004fb11c1878c70328ca fluxheim.cyclonedx.json
• Reproducible build:
  • dc4fd155af2605ce62bb11b144b0f452b311fcdd22eea5e9102c5f589e2892b5 x86_64
  • b82ddd9c3dc50b96a765c1a01e658244817573eb31e8ff0bef18586b238214f9 aarch64
  • 208e8deacf8cf5a171d742cdf6b0bd4edb7d372785d7f266b6ac35874d4ea5e8 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c61be86d2d7922fd25c665c62b4b4bc599ed8e0e9fb1a221aa6be4b84019d264
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1791fc6a63f6331e82c230823eefc5326a6932121a2438504a50fd5791bd4ab3
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8f78dcc2f3ed9d152f812473a927e8954c7512f91226ce12338454cabd1d18ef
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:4d00a11f6f1c9b2023f598086412717fe1393fddfe4d402fce4ef280788c1611
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:32f978f4280c6e93abff84bde49996966149cf692169ffbc394a3450b61e73a2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:14e897b02127af720bfd1332ddf6d48049e2f22985e0c9f2e17540ed6d1befd9
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b932b099760e39459cd8def25807419bc4274a96435131db698eaaee69db2c99
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:b86d7ff6de604b92095111e5ef696b4d7479db0d1f544ffc2ca528a15481fa78
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:7329505671132d42fe1ace3fb7db330153ff4de4fd9ad64ea4e46cb3b9492696
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:049f9c1e30e476abceab7f45d72723039cf0e1db82eb8e709e2c8b5f53faa67e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:947b0e5f064b2b79770e2507dde7ca835bd6187b87edf71f423437b7491dc0b3
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c7f5d2f5f82bee55bda66278848144d66777856b2818bc22055404f7516c13db
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a6521be8c9a6976a1fc5e12ce2a6444b9a3bd572954dbf18db8c463d593bb096
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:015132ce9c5b04dddedf3c7924d10b5a4bbd71bee4c943038708abf5f617d130
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:352a3c1d9cc95d87c6a656efa94a6c69a2be8f855bc6752cd905c2e943073811
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a56fcfdd62e341f65c7cc2975de17b55109414d0214ca8de6b3f464de2c3a172
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0ca00d45019fd2f9649ccc201e65deb5f6582cf8ef46dd2a003522d5a24f8b31
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:618e3e00bea3bac82b8083f1f7b96f75e0341be8343f4988e216602e684864aa
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:208a35d62e1a163c305fb66c41d567f621a779373d8be18caca1643297a56f01
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c00fe7eaf8432e1175bb82dd1add815bfe6b4741c638ca44bccd11008ab3090e
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4