0.6.0
microsoft/agent-host-protocol0.6.0Aug 15, 2025by johnhurt
Upgrading?
Release notes summary
This release focuses on security improvements by bumping the minimum h2 crate dependency to guard against the 'MadeYouReset' H2 attack, while also introducing new configuration options and logging capabilities for HTTP servers and proxies.
Key Highlights
- Bumps minimum h2 crate dependency to guard against the 'MadeYouReset' H2 attack
- Adds HttpServerOptions for easier adhoc testing via HttpEchoApp
- Configures H2Options at HttpServer and HttpProxy levels
- Enables tracking the execution phase of a server
New Features
- Log runtime names during Server shutdown
- Enabling tracking the execution phase of a server
- Allow using in-memory compression dicts
- Make H2Options configurable at HttpServer, HttpProxy
- Updates HttpEchoApp to use HttpServer for easier adhoc testing
- Add initial support for multipart range requests
- Adds a callback to HttpHealthCheck for collecting detailed backend summary information
Full Release Notes
## [0.6.0](https://github.com/cloudflare/pingora/compare/0.5.0...0.6.0) - 2025-08-15
### Highlights
- This release bumps the minimum h2 crate dependency to guard against the [MadeYouReset]((https://blog.cloudflare.com/madeyoureset-an-http-2-vulnerability-thwarted-by-rapid-reset-mitigations/)) H2 attack
### 🚀 Features
- Log runtime names during Server shutdown
- Enabling tracking the execution phase of a server
- Allow using in-memory compression dicts
- Make H2Options configurable at HttpServer, HttpProxy
Also adds HttpServerOptions to the HttpServer implementation, and
updates the HttpEchoApp to use HttpServer for easier adhoc testing.
### 🐛 Bug Fixes
- Fix: read body without discard
### Everything Else
- Try loading each LRU shard individually and warn on errors
- Update LRU save to disk to be atomic
- Allow cache to spawn_async_purge
- Pass hit handler in hit filter
- Cache hit filter can mutate cache, allow resetting cache lock
- Persist keepalive_timeout between requests on same stream
- Properly check for H2 io ReadError retry types
- Add cache lock wait timeout for readers
- Fix CacheLock status timeout conditions
- Handle close on partial chunk head
- Allow optional to reset session timeouts
- Clippy fixes for 1.87, add 1.87 to GitHub CI
- Run `range_{header,body}_filter` after disabling cache
- Convert `InterpretCacheControl` members to `Duration`
- Disable downstream ranging on max file size
- Allow explicit infinite keepalive timeout to be respected
Note that a necessary follow up is to refactor the infinite keepalive
timeout to only apply to first read between requests on reused conns.
- Add method to disable keepalive if downstream is unfinished
- Discard extra upstream body and disable keepalive
- Explicitly disable keepalive on upstream connection when excess body
(content-length) is detected.
- Add brief sleep to shutdown signal tests to avoid flake
- Allow override of cache lock timeouts
- Allow arbitrary bytes in CacheKey instead of just Strings
- Corrects out-of-order data return after multiple peek calls with different buffer sizes.
- Mark previously too large chunked assets as cacheable
- Boring/OpenSSL load cert chain from connector options
- Add initial support for multipart range requests
- Adds a callback to HttpHealthCheck for collecting detailed backend summary information
- Multipart range filter state fixes
### Docs
- Explanation of request_body_filter phase
Related Repositories
openclaw/openclaw★ 392,882
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
morluto/rea★ 372,963
Reverse engineer anything with agents, from app behavior down to native binaries.
nilbuild/developer-roadmap★ 370,230
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
anomalyco/opencode★ 220,601
The open source coding agent.
n8n-io/n8n★ 208,409
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.