HTTP.jl Files

HTTP v2.13.3

Diff since v2.13.2

• A request whose server_name is pinned (do! or roundtrip! with server_name) no longer reuses an idle TLS connection to the same address that was verified for a different server name; the pinned name is part of the connection pool key.
• With a Transport whose tls_config sets server_name, HTTP/2 connections now verify the server's certificate against that name, as HTTP/1 connections do, instead of the request's host.
• After an HTTP/2 connection error, the server half-closes the connection and drains the client's input (up to 500 ms) before closing, so clients receive the GOAWAY and its error code.
• An HTTP/2 client that advertises a small SETTINGS_MAX_HEADER_LIST_SIZE no longer makes the server log an error per oversized response head (the stream is reset), and a refused response no longer keeps up to 16 KiB of the connection's send window, which after a few such responses stalled every later one. A listen! handler's oversized head is reset the same way instead of answered with 500.
• A WebSocket server no longer answers a client that hung up without a close frame, or a read idle timeout, with 1002 invalid close status code; close code 1006 is never sent.

(Release notes generated via AI.)

Merged pull requests:

• Reset an HTTP/2 stream over the client's header list limit without logging (#1531) (@quinnj-bot[bot])
• Half-close and drain before closing an HTTP/2 connection after its error GOAWAY (#1532) (@quinnj-bot[bot])
• Send no WebSocket close frame for code 1006 (#1533) (@quinnj-bot[bot])
• Keep pooled TLS connections to the server name they were verified for (#1534) (@quinnj-bot[bot])
• Verify the transport's TLS server_name on HTTP/2 connections (#1535) (@quinnj-bot[bot])
• Release HTTP 2.13.3 (#1536) (@quinnj-bot[bot])