Security

• GHSA-rqf5-2wxv-rjf4 - Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
• GHSA-jmqq-x5g9-9p2w - Replay to a different host sends the original host's request and credentials to the new host
• GHSA-vvp4-63h8-v5pm - Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
• GHSA-f9m8-cv68-674w - Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
• GHSA-qhv6-3pmh-95q4 - Digest mutual authentication is switched off by a peer offering qop=auth-int

Behaviour changes

• A Digest challenge carrying no nonce now selects Digest rather than Basic. Such an exchange previously appeared to work because the client answered in Basic, and it will now fail. It was sending the password in the clear.
• A server offering qop="auth-int" and nothing else now falls back to the qop-less digest of RFC 2069, which has weaker replay protection. The client logs a warning when this happens.
• Realm.Builder.matchParam keeps a backslash that precedes any character other than a quote or another backslash. This repairs a 3.0.12 regression that corrupted DOMAIN\Users to DOMAINUsers and broke Digest against those realms.
• NTLM and Negotiate connections are pooled per principal, so an application authenticating as several identities against one host holds more connections than before.
• A cookie whose Domain names a public suffix is refused. A host whose own name is a public suffix, such as the short names Docker Compose and Kubernetes hand out, can still set a cookie for itself.

Known issues

• Over HTTP/2, an intercepted 401 or a redirect completes the caller's future exceptionally even though the exchange succeeds on the wire. Use HTTP/1.1 where authentication or redirects are involved.

What's Changed

• Release v3.0.11 by @hyperxpro in #2198
• Reduce per-request allocation in ThreadSafeCookieStore.get() by @hyperxpro in #2201
• escape quote and crlf in multipart content-disposition values by @jmestwa-coder in #2203
• Avoid Uri reallocation in UriEncoder.encode() on the no-op path by @hyperxpro in #2204
• Reuse a per-thread UriParser scratch to avoid per-parse allocation by @hyperxpro in #2205
• Intern known request header names to static AsciiString by @hyperxpro in #2206
• Match HTTP/2 content-encoding with AsciiString constants instead of toLowerCase by @hyperxpro in #2207
• Improve CI Release Workflow by @hyperxpro in #2208
• Fall back to NIO instead of throwing when no native transport is available by @hyperxpro in #2209
• fail websocket handshake on invalid sec-websocket-accept by @jmestwa-coder in #2211
• Localize tests that depended on public endpoints by @hyperxpro in #2215
• [Performance] Raise default HTTP/2 initial window size to 16 MiB by @hyperxpro in #2213
• Add LoadBalance.ROUND_ROBIN for per-request IP round-robin by @pavel-ptashyts in #2202
• Bump the dependencies group with 5 updates by @dependabot[bot] in #2222
• Bump actions/checkout from 6 to 7 in the actions group by @dependabot[bot] in #2223
• use SecureRandom for digest auth cnonce by @jmestwa-coder in #2220
• skip origin Authorization on CONNECT proxy request by @madib06ops in #2234
• escape quoted-string params in Digest Authorization header by @madib06ops in #2236
• stop config realm leaking to a cross-origin redirect target by @jmestwa-coder in #2224
• fail SCRAM exchange on invalid ServerSignature by @madib06ops in #2235
• normalize the scheme case in the Uri constructor by @madib06ops in #2239
• Fix LICENSE file for Apache 2.0 by @hyperxpro in #2242
• Enable HTTPS endpoint identification in JsseSslEngineFactory by @hyperxpro in #2243
• Reject CR/LF in raw multipart part-header fields by @hyperxpro in #2244
• Read InputStream bodies straight into the buffer, no staging array by @pavel-ptashyts in #2233
• Bind origin Kerberos/SPNEGO token to the origin service, not the proxy by @hyperxpro in #2245
• Avoid per-connect lock on shared Bootstrap options map (#2218) by @pavel-ptashyts in #2219
• Make idle-channel pool cleaner reap in a single O(n) pass by @pavel-ptashyts in #2225
• Mirror Netty option-failure semantics in applyChannelOptions by @hyperxpro in #2247
• Round robin issue (#2214) by @pavel-ptashyts in #2217
• Release the round-robin HTTP/2 permit when a connection starts draining by @hyperxpro in #2248
• Harden the O(n) idle-pool reap tests: stable idle window + kept-after-removed coverage by @hyperxpro in #2249
• Wait for a sibling HTTP/2 connection without blocking the caller thread by @pavel-ptashyts in #2227
• Generalize failed-IP cooldown across all LoadBalance modes and make it configurable by @pavel-ptashyts in #2221
• Never block the event loop acquiring a connection permit by @pavel-ptashyts in #2226
• Harden the HTTP/2 connection-waiter registry against waiter failures and shutdown races by @hyperxpro in #2251
• No blocking acquire on event loop by @hyperxpro in #2252
• Schedule the round-robin request timeout once, not twice by @pavel-ptashyts in #2229
• Harden failed-IP cooldown config and add DEFAULT-mode test by @hyperxpro in #2253
• Fail fast on empty round-robin address resolution by @hyperxpro in #2254
• Signal STOP on the finishing multipart chunk, not an extra empty read by @pavel-ptashyts in #2232
• Reuse the per-request partition key instead of recomputing it by @pavel-ptashyts in #2231
• Document that BodyState.STOP may carry the final bytes by @hyperxpro in #2255
• Avoid the per-request rotation copy in round-robin address selection by @pavel-ptashyts in #2230
• Cap cookies retained per domain (RFC 6265 5.3) by @pavel-ptashyts in #2256
• Mark the round-robin RotatedView RandomAccess and cover its bounds check by @hyperxpro in #2257
• Add AI Agent Guidelines to AGENTS.md by @hyperxpro in #2268
• Support HTTP/2 after proxy CONNECT by @rampreeth in #2250
• strip userinfo from the absolute-form proxy request target by @madib06ops in #2258
• Avoid unused promise allocation in address resolution by @pavel-ptashyts in #2259
• Skip empty channel pool partitions during reap by @pavel-ptashyts in #2262
• use SecureRandom for the multipart boundary and websocket key by @madib06ops in #2282
• Avoid duplicate preemptive Digest hashing by @pavel-ptashyts in #2276
• Prune idle per-host connection semaphores by @pavel-ptashyts in #2277
• Optimize client stats collection by @pavel-ptashyts in #2270
• Intern common Train-Case header names by @pavel-ptashyts in #2266
• Guard per-host semaphore pruning against unbalanced releases by @hyperxpro in #2283
• Release throttle permits only once by @pavel-ptashyts in #2280
• Soften overstated complexity claim in stats javadoc by @hyperxpro in #2285
• Cache Basic auth header on Realm by @pavel-ptashyts in #2267
• Document Basic auth header caching, guard against stale copies by @hyperxpro in #2286
• Add regression tests for throttle permit release edge cases by @hyperxpro in #2287
• create the resumable index store with owner-only permissions by @madib06ops in #2281
• Avoid rebuilding clean query strings by @pavel-ptashyts in #2265
• Fix per-host connection permit leak on the connect path by @hyperxpro in #2288
• Use HPACK spelling for HTTP/2 compression by @pavel-ptashyts in #2271
• Redact sensitive headers from debug logs by @pavel-ptashyts in #2279
• Trim dead sensitive-logging wrappers and document scope by @hyperxpro in #2290
• Validate converted HTTP/2 headers and trailers by @pavel-ptashyts in #2275
• Bump io.netty:netty-codec-compression from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #2292
• Bump io.netty:netty-codec-http from 4.2.15.Final to 4.2.16.Final by @dependabot[bot] in #2293
• Run HTTP/2 st...

Security

• GHSA-3wp9-xfwm-rjjf - WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
• GHSA-7grg-jcf7-rpmx - Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
• GHSA-cf59-3jcr-vfhw - Resumable download index store is created world-readable and follows a planted symlink
• GHSA-f8m2-889x-vw4x - Client-wide realm credentials re-sent to a cross-origin redirect target
• GHSA-f9m8-cv68-674w - Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
• GHSA-jmqq-x5g9-9p2w - Replay to a different host sends the original host request and credentials to the new host
• GHSA-mfj3-87qq-382v - Digest authentication cnonce generated with a non-cryptographic random source
• GHSA-qpfv-56x8-xgx4 - URL userinfo credentials sent to the HTTP proxy in the request line
• GHSA-rqf5-2wxv-rjf4 - Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
• GHSA-rwhr-j9rv-85f8 - WebSocket handshake continues after a failed Sec-WebSocket-Accept check
• GHSA-v9f2-7rw2-gr2x - Origin credentials sent in cleartext to a proxy that rejects the CONNECT
• GHSA-vvp4-63h8-v5pm - Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
• GHSA-x5w6-vm3f-pp6f - SOCKS proxy credentials sent to the origin server over plaintext HTTP
• GHSA-xr57-gcx8-52hf - Origin credentials sent to the proxy on the plaintext CONNECT request

Behaviour changes

• A Digest challenge carrying no nonce now selects Digest rather than Basic. Such an exchange previously appeared to work because the client answered in Basic, and it will now fail. It was sending the password in the clear.
• NTLM and Negotiate connections are pooled per principal, so an application authenticating as several identities against one host holds more connections than before.
• A cookie whose Domain names a public suffix is refused. A host whose own name is a public suffix, such as the short names Docker Compose and Kubernetes hand out, can still set a cookie for itself.
• A ResponseFilter that replays onto a different host no longer carries the first origin's realm to the new one. A client-wide realm no longer follows a cross-host replay.

What's Changed

• Backport: reject set-cookie domain that doesn't match the request host by @hyperxpro in #2199

Security Advisory

GHSA-m452-q8c9-rg2f

Full Changelog: async-http-client-project-2.15.0...async-http-client-project-2.16.0

What's Changed

• Bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.54 to 10.1.55 in /client by @dependabot[bot] in #2179
• Bump the dependencies group across 1 directory with 15 updates by @dependabot[bot] in #2180
• Streamline HTTP/2 request header copy by @hyperxpro in #2181
• Streamline DefaultChannelPool checkout and close paths by @hyperxpro in #2183
• Bump io.netty:netty-transport-native-epoll from 4.2.13.Final to 4.2.15.Final by @dependabot[bot] in #2188
• Bump io.netty:netty-codec-http2 from 4.2.13.Final to 4.2.15.Final by @dependabot[bot] in #2187
• Bump io.netty:netty-transport-native-kqueue from 4.2.13.Final to 4.2.15.Final by @dependabot[bot] in #2186
• Bump io.netty:netty-resolver-dns from 4.2.13.Final to 4.2.15.Final by @dependabot[bot] in #2185
• Bump io.netty:netty-handler from 4.2.13.Final to 4.2.15.Final by @dependabot[bot] in #2184
• Replace jakarta.activation with an internal MIME-type parser by @hyperxpro in #2193
• Bump the dependencies group across 1 directory with 4 updates by @dependabot[bot] in #2194
• Replace umbrella netty-codec with netty-codec-base and netty-codec-compression by @hyperxpro in #2195
• Fix HTTP/2 silent request timeouts under connection disruptions by @hyperxpro in #2162
• reject set-cookie domain that doesn't match the request host by @jmestwa-coder in #2196
• Stabilize HTTP/2: fix resource leaks and RFC conformance by @hyperxpro in #2197

Security Advisory

GHSA-m452-q8c9-rg2f

New Contributors

• @jmestwa-coder made their first contribution in #2196

Full Changelog: async-http-client-project-3.0.10...async-http-client-project-3.0.11

What's Changed

• Guard against null TimeoutsHolder in NettyConnectListener.onSuccess by @hyperxpro in #2176

Security Advisory

GHSA-fmxf-pm6p-7xgm

Full Changelog: async-http-client-project-3.0.9...async-http-client-project-3.0.10

Security Advisory

GHSA-fmxf-pm6p-7xgm

Full Changelog: async-http-client-project-2.14.5...async-http-client-project-2.15.0

Security Advisory

GHSA-cmxv-58fp-fm3g

Full Changelog: async-http-client-project-2.12.4...async-http-client-project-2.14.5

What's Changed

• Enable maven snapshots by @hyperxpro in #2161
• Avoid allocations in ChannelPoolPartioning by @doom369 in #2158
• Bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.52 to 10.1.54 in /client by @dependabot[bot] in #2164
• Add pluggable DnsNameResolver by @doom369 in #2163
• Strip credentials on cross-domain redirects and HTTPS-to-HTTP downgrades 6b2fbb7

Security

• GHSA-cmxv-58fp-fm3g

Full Changelog: async-http-client-project-3.0.8...async-http-client-project-3.0.9

What's Changed

• netty leak detector 0.2.2 by @sullis in #2143
• Bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.47 to 10.1.49 in /client by @dependabot[bot] in #2142
• Bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.49 to 10.1.50 in /client by @dependabot[bot] in #2145
• Add Support for Multiplexing HTTP/2 by @hyperxpro in #2144
• Modernize README and fix outdated project metadata by @hyperxpro in #2146
• Drop shaded Apache Commons FileUpload and move to test dependency by @hyperxpro in #2147
• Implement full RFC 7616 HTTP Digest Authentication compliance by @hyperxpro in #2148
• Switch to Revapi and Matrix JDK builds for all current JDK LTS by @hyperxpro in #2149
• Bump the actions group with 4 updates by @dependabot[bot] in #2150
• Bump the dependencies group with 50 updates and add profile for different JDKs by @dependabot[bot] in #2151
• Bump org.apache.tomcat.embed:tomcat-embed-core from 10.1.50 to 10.1.52 in /client by @dependabot[bot] in #2153
• RFC 7804 - SCRAM Authentication Implementation with SHA-256 by @hyperxpro in #2154
• Release v3.0.8 by @hyperxpro in #2155

Full Changelog: async-http-client-project-3.0.7...async-http-client-project-3.0.8