lighty news

1.4.85

gstrauss — Wed, 08 Jul 2026 00:00:00 +0000

Important changes¶

bug fixes

Downloads¶

lighttpd-1.4.85.tar.gz (GPG signature)
- SHA256: ffb2ab3e3b9e8b0dfadf9a8b2a5c86084afe5cc68ed3cf4d5776c8a7891c58e9
lighttpd-1.4.85.tar.xz (GPG signature)
- SHA256: 18de51b393bac4a6827879e1a7ff377c169e414bae92cd245091d80fc2601d13
SHA256 checksums
SHA512 checksums

Changes from 1.4.84¶

[mod_magnet] fix custom response with 4xx and 5xx (fixes #3313)
[core] fix large file uploads to fastcgi (fixes #3314)
[mbedtls] use mbedtls_ssl_iana_tls_group_info_t
[mod_alias] expand alias.url config order check
[core] quiet coverity short-sightedness
[core] server.http-parseopts option interaction
[core] check utf8 the same way in burl.c
[core] mark burl.c routines cold if modify URL
[core] burl_normalize() query string offset parse
[core] _WIN32: check reparse tag in win32 readdir
Bump actions/checkout from 6 to 7
Bump actions/cache from 5 to 6
[lemon] refresh LEMON parser to SQLite maint ver
[lemon] build configparser.y w/ -Werror workarounds
[lemon] quiet compiler warnings in LEMON parser
[core] buffer_path_simplify() comments and indent
[core] _WIN32: “url-path-backslash-trans” %5C->%2F
[lemon] quiet coverity warning
[core] http_request_parse_target() comment

1.4.84

gstrauss — Wed, 17 Jun 2026 00:00:00 +0000

Important changes¶

bug fixes, portability

HIGHLIGHTS¶

fix regression in mod_deflate

Downloads¶

lighttpd-1.4.84.tar.gz (GPG signature)
- SHA256: ccf90ecef33b0fc36463d2f7a4af4dc87e0bb809d43acb4c0daba4b0672cf633
lighttpd-1.4.84.tar.xz (GPG signature)
- SHA256: 076dd43bec8f2ba9ce6db7e7ca7e8ad72271cd529805ead2400b56efaa026f70
SHA256 checksums
SHA512 checksums

Changes from 1.4.83¶

[ci] use lua5.5-dev pacakge on alpine linux
[mod_authn_gssapi] cast to avoid compiler warning
[mod_mbedtls] build if mbedtls w/ reduced ciphers
[mod_deflate] fix 1.4.83 regression (fixes #3311)
[core] remove byte-range support for QUERY
[mod_staticfile] do not handle QUERY method
[core] _WIN32: support directory symlinks in fs_win32_readlinkUTF8
[core] _WIN32: fix stat() on drive and directory roots in fs_win32_stati64UTF8
[core] _WIN32: support stat() on local device path root

1.4.83

gstrauss — Sun, 14 Jun 2026 00:00:00 +0000

Important changes¶

security fixes; bug fixes; tighten resource management

Highlights¶

add PQC hybrid KEM X25519MLKEM768 to default TLS groups
mod_sockproxy can now route connections based on TLS SNI
mod_proxy proxy.header enhanced config for url-path mapping of response headers
HTTP Incremental header support
portability/compatibility with library updates (lighttpd dependencies)

BEHAVIOR CHANGES¶

add PQC hybrid KEM X25519MLKEM768 to default TLS groups
Reference: TLSRef guidelines
https://docs.tlsref.org/server-side-tls.html
HTTP/1.1 Upgrade: h2c has been deprecated; set default to disabled in lighttpd, but can still be enabled in config, and http2 prior knowledge is still enabled

Downloads¶

lighttpd-1.4.83.tar.gz (GPG signature)
- SHA256: 54f9598f6c07df0e9607c74bf6d2f6a45b0f420bcb0590bc5a01c5a6e3355f1a
lighttpd-1.4.83.tar.xz (GPG signature)
- SHA256: b3f878156480079f8a93903bd24d456074a0fbedb9b4d99fcd65df33b1f566f0
SHA256 checksums
SHA512 checksums

Changes from 1.4.82¶

[systemd] add RestrictAddressFamilies AF_NETLINK
[TLS] skip cert_is_active warnings for unset clock
[multiple] rename plugin_data statics per module
[mod_mbedtls] mbedtls 4.x removes mbedtls/ecp.h
[mod_mbedtls] mbedtls 4.x removes ECDH ciph suites
[core] clarify warning message
[multiple] http_status.[ch]
[core] single internal define for fs monitoring
[core] X-Sendfile shared code
[core] check for OTHER response headers earlier
[core] support Incremental header
[mod_magnet] resp_body_finished w/ r.resp_body:set()
[core] minor code tighten
[core] remove request_st member async_callback (unused)
[tests] t/test_http_status.c stub
[core] http_status_set_fin() handler_module = NULL
[mod_magnet] http_response_reset() before HANDLER_COMEBACK
[core] http_response_prepare() smaller funcs
[core] add continuation framework for response prep
[h2] add comment about zero-length payloads in padded frames
[mod_magnet] revert recent HANDLER_COMEBACK change
[core] remove small bit of commented out code
[core] do not generate no-longer-used plugin funcs
[core] minor code tighten
[h2] fix HTTP/1.1 upgrade: h2c
[h2] combine h2c code into h2_upgrade_h2c()
[h2] disable HTTP/1.1 upgrade: h2c by default
[core] clear trailer whitelist at startup
[core] static_assert sanity check for 64-bit off_t
[core] security: missing return on non-default path
[mod_magnet] modify reqbody_length after file append
[mod_openssl] check openssl func for NULL if mem err
[mod_*_dbi] proceed if third reconnect retry succeeds
[mod_ajp13] skip empty string (len == 65535)
[mod_ajp13] error if backend include LF in headers
[mod_deflate] translate ‘/’ in etag to ‘~’ for fn
[mod_deflate] mod_deflate_finished() shared code
[mod_authn_gssapi] warn if principal not in config
[mod_authn_gssapi] mod_authn_gssapi_construct_sprinc()
[core] support Range for QUERY
[multiple] make most module config thread-safe
[ci] tune build on freebsd
[mod_mbedtls] EC certs require drbg init
[ci] Bump actions/checkout from 5 to 6 (#147)
[multiple] quiet minor coverity warnings
[mod_extforward] HAProxy PROXY protocol extensions
[multiple] make most plugin objects instance-safe
[multiple] C99 designated initializers
[mod_auth] HTTP/2 response w/ multiple auth methods (fixes #3296)
[ci] Bump actions/cache from 4 to 5
[doc] add comment to lighttpd.service
[core] add .rst .xsl .xslt to builtin mimetype.assign (fixes #3295)
[build] support lua 5.5
[core] __attribute_packed__
[mod_extforward] fix reading ‘verify’ from PROXY (fixes #3298)
[mod_extforward] adjust reading ‘verify’ from PROXY (#3298)
[core] fix Range requests with dynamic backends
[core] adjust safety factor for max-connections (fixes #3299)
[core] quiet coverity false positive
[mod_boringssl] add more const
[mod_openssl] add more const
[mod_openssl] update openssl version EOL message
[TLS] add PQC hybrid KEM to default TLS groups
spelling suggestions from codespell (fixes #3303)
[mod_maxminddb] sanity check snprintf of flt, dbl
[multiple] add some ‘const’ for gcc 16 warnings
[mod_sockproxy] configure after TLS SNI (fixes #3304)
[core] add sanity check to li_hex2bin()
[core] security: reject req header CGI conflicts
[core] security: reject invalid Content-Length from backend (fixes #3309)
[mod_gnutls] avoid double-free in error path (unlikely)
[core] update for nettle 4.x digest func signatures
[mod_deflate] more precisely match If-None-Match
[core] attempt recovery on stat_cache EMFILE (fixes #3308)
[core] option to close unused socket after restart
[cmake] use find_package() with PCRE2
[h2] update ls-hpack
[mod_openssl] use OSSL_STORE_open for alt schemas
[mod_dirlisting] faster client-side sort on huge listings
[mod_dirlisting] additional minor javascript optim
[mod_proxy] adjust proxy.header config parsing
[mod_proxy] config opt for urlpath map resp hdrs (fixes #3300)
[core] allow server.max-fds up to 1048576
[tests] add tests for http_cgi.c varname encoding
[mod_wstunnel] code size reduction
[core] reduce struct gw_plugin_config size
[mod_wstunnel] RFC 6455 §5 compliance
[ci] remove wolfssl from CI on Debian/Ubuntu
[multiple] limit queue size to slow backends
[core] use tempfiles for HTTP/1.1 upgraded backend
[core] adjust trace for server.max-connections
[doc] update doc/initscripts.txt
[mod_wstunnel] disable hybi-00; obsolete
[mod_wstunnel] adjust parsing extended frame lens
[cmake] fix typos for mbedtls, tfpsacrypto libs
[mod_wstunnel] reduce handler_ctx struct size
[mod_wstunnel] stricter RFC 6455 compliance
[mod_wstunnel] optimize unmasking client payload
[core] propagate backend errs for h2 to RST_STREAM
[core] propagate backend errs for HTTP/1.1 chunked
[core] check another cond before calling cold func
[core] update rand.c for nettle 4.x digest funcs
[mod_wolfssl] workaround wolfssl code smells
[mod_mbedtls] disable DHParameters w/ PSA crypto
[TLS] debug.log-ssl-noise set TLS lib debug level
[mod_mbedtls] workaround mbedtls 4.1.0 bug
[mod_mbedtls] session tkts psa_alg w/ mbedtls 4.x
[mod_gnutls] test for PQC hybrid group support
[ci] use windows-2025-vs2026 and VS 2026
[ci] use default FreeBSD package source
[ci] NetBSD pkg_add -u

1.4.82

gstrauss — Fri, 12 Sep 2025 00:00:00 +0000

Important changes¶

restrict request trailers to configured list; bugfixes

BEHAVIOR CHANGES:¶

trailers in request headers will be ignored unless allowed field names are explicitly configured in a comma-separated list containing no spaces:
```
server.feature-flags += ("request.trailer-whitelist" => "...")
```
This changes behavior from lighttpd 1.4.80, which added support for request trailers and header merging, but did not restrict request trailers.

Downloads¶

lighttpd-1.4.82.tar.gz (GPG signature)
- SHA256: 4f07f2d61ee8d136d105d9a62f139a46ad8216fe9e346476ee5340f87bcabd79
lighttpd-1.4.82.tar.xz (GPG signature)
- SHA256: abfe74391f9cbd66ab154ea07e64f194dbe7e906ef4ed47eb3b0f3b46246c962
SHA256 checksums
SHA512 checksums

Changes from 1.4.81¶

[core] restrict request trailers to configured list
[core] fix logic inversion in “toupper:” modifier
[mod_redirect,mod_rewrite] ${url.authority.noport} token
[cmake,mod_mbedtls] mbedx509 mbedcrypto order
[mod_mbedtls] psa_crypto_init() for MBEDTLS_USE_PSA_CRYPTO (fixes #3288)
[build] mod_mbedtls: use tfpsacrypto if found
[ci] Bump actions/checkout from 4 to 5
[core] avoid chunk mem reallocation on read/recv

1.4.81

gstrauss — Sun, 17 Aug 2025 00:00:00 +0000

Important changes¶

security: fix to reject disallowed trailers

Downloads¶

lighttpd-1.4.81.tar.gz (GPG signature)
- SHA256: 1d137b7e595f3cd0ab1909ea8033ff17317a0ccf4f5d674cd5378744e6773093
lighttpd-1.4.81.tar.xz (GPG signature)
- SHA256: d7d42c3fd2fd94b63c915aa7d18f4da3cac5937ddba33e909f81cf50842a5840
SHA256 checksums
SHA512 checksums

Changes from 1.4.80¶

[core] security: fix to reject disallowed trailers

1.4.80

gstrauss — Wed, 13 Aug 2025 00:00:00 +0000

Important changes¶

detect and issue error trace for HTTP/2 MadeYouReset VU#767506 CVE-2025-8671

Highlights¶

detect and issue error trace for HTTP/2 MadeYouReset VU#767506 CVE-2025-8671
stricter HTTP request/response header, trailer, and chunked validation/parsing
support HTTP response trailers
support HTTP request trailers merge to headers (if not streaming request body)
bug fixes

BEHAVIOR CHANGES¶

extend TLS error log messages to include client addr if error caused by client (Please review TLS error string matching in log watchers)
extend TLS error log messages for HTTP/2 attack detection (Please review TLS error string matching in log watchers)
reject path info on static files by default (prior default allowed path info) (For prior behavior, configure static-file.disable-pathinfo = “disable”)

Downloads¶

lighttpd-1.4.80.tar.gz (GPG signature)
- SHA256: 30d5bbbcbeaf8e52a7bdde614248dd932d63753d87fed79307547312012b4c01
lighttpd-1.4.80.tar.xz (GPG signature)
- SHA256: cc5f0f71e8b2ee6bad545d1e91dfc3f954716c9174e7b352c2147add44f25bf3
SHA256 checksums
SHA512 checksums

Changes from 1.4.79¶

[doc] move comments in systemd lighttpd.service
[doc] refresh INSTALL
[core] adjust malloc_top_pad after srv->srvconf.max_conns
[build] remove references to libev; no longer used
[multiple] stricter string init without trail ‘\0’
workaround unsupported PR_CAP_AMBIENT_CLEAR_ALL on Cloud Run
[TLS] 0-init plugin_ssl_ctx (fixes #3281)
[autotools] LIGHTTPD_STATIC in config.h if static build
[doc] systemd lighttpd.service SystemCallFilter
[core] reject stray \r in chunked headers
[tests] reject stray \r or \n in chunked headers
[core] http_chunk_decode_append_error()
[core] h1_chunked_400_bad_request()
[mod_webdav] log trace for EACCES on PUT
[build] check for C23 memset_explicit()
[mod_ssi] set tmp file length if ssi exec fails
[ci] set SHELL=/bin/sh for builds on alpine
[mod_openssl] avoid BoringSSL/AWS-LC compiler warn
[mod_openssl] AWS-LC limitations/compatibility (#3282)
[ci] use actions/cache@v3 to cache Cygwin install
[mod_openssl] use BoringSSL APIs w/ SSL_CREDENTIAL
[mod_boringssl] cp mod_openssl.c mod_boringssl.c
[build] build support for mod_boringssl
[mod_boringssl] rename plugin init func
[mod_boringssl] remove openssl/libressl code
[mod_openssl] remove code specific to boringssl
[mod_boringssl] ignore ssl.read-ahead
[mod_boringssl] TLS_with_buffers_method() optim
[mod_boringssl] init/enable CRYPTO_BUFFER_POOL
[mod_boringssl] use SSL_get0_peer_certificates()
[mod_boringssl] using AWS-LC does not build
[mod_boringssl] code reuse
[mod_boringssl] more CRYPTO_BUFFER code, less X509
[mod_boringssl] elide excess time() calls
[mod_boringssl] alt callbacks for client cert vfy
[mod_boringssl] remove verify_callback (replaced)
[ci] bump actions/cache from 3 to 4
[ci] add package for SCONS “fullstatic” build
[mod_boringssl] load CRLs into STACK_OF(X509_CRL)
[mod_openssl] revert commits; re-support AWS-LC
[mod_boringssl] skip BIO copy if pkey already DER
[mod_boringssl] shared code for parsing PEM files
[mod_boringssl] typo
[mod_boringssl] wipe tmp_buf used to decode pkey
[mod_boringssl] more generic pkey read from PEM
[mod_wolfssl] more generic pkey read from PEM
[mod_nss] more generic pkey read from PEM
[core] http_chunk_decode_append_* code reuse
[h2] h2_send_headers_hoff() to reduce stack use
[core] stricter validate of trailers from backends
[core] check Transfer-Encoding: chunked from backends
[core] remove deprecated Expect-CT from enum
[core] http_header_str_contains_token() comment
[core] http_request_field_check_value() code reuse
[core] http_request_field_check_name() code reuse
[core] stricter validation of backend response
[mod_magnet] stricter validation of request/response
[h2] fill in hoff[] for “:status: XXX\r\n\r\n”
[core] simplify hoff[] access when hoff[1] == 0
[core] check HTTP/1.x field block fully consumed
[core] unfold fields in http_header_parse_hoff()
[h2] stricter validation of HTTP/2 trailers
[core] validate BACKEND_PROXY headers end w/ CRLF
[core] strict validate request headers end w/ CRLF
[core] fix stat_cache inotify for files in rootdir
[core] merge request trailers into request headers
[mod_staticfile] reject pathinfo on static files
[mod_setenv] warn if setenv.* incl invalid chars
[tests] trailers
[mod_proxy] sketch out streaming and trailers
[mod_setenv] quiet coverity noise
[core] disable mmap for < QNX 8.0.0
[core] connections_pool_clear() unless in jobqueue
[ci] run apt-get update on github ubuntu workflows
[ci] explicit compiler install on github ubuntu workflows
[mod_openssl] build against ancient openssl libs
[TLS] SSL error handling improvements
[mod_openssl] update lib version EOL warning
[mod_openssl] workaround OpenSSL 3 SSL_sendfile bug
[mod_wolfssl] check for WOLFSSL_SHUTDOWN_NOT_DONE
[TLS] skip SSL_shutdown after non-recoverable error
[mod_wolfssl] handle additional wolfssl socket err
[mod_mbedtls] mbedtls 4.x removes MBEDTLS_DHM_C
[mod_mbedtls] mbedtls 4.x PSA crypto handles RNG
[mod_mbedtls] mbedtls 4.x removes RSA key exch
[mod_mbedtls] mbedtls 4.x curve_info,list private
[mod_mbedtls] mbedtls 4.x makes oid private
[doc] command line -f - to read config from stdin (fixes #3286)
[h2] attempt to detect HTTP/2 MadeYouReset DoS

1.4.79

gstrauss — Fri, 04 Apr 2025 00:00:00 +0000

Important changes¶

hardened systemd lighttpd.service
bug fix for mod_openssl using both ECDSA and RSA certs

BEHAVIOR CHANGES¶

lighttpd-provided hardened systemd lighttpd.service may need admin-overrides on non-typical systems (less popular distros) using lighttpd-provided systemd lighttpd.service and which also run lighttpd as root, or run CGI scripts as root, to manage the system. To create overrides, systemctl edit lighttpd and edit /etc/systemd/system/lighttpd.service.d/override.conf . In contrast, many popular distros configure lighttpd to drop privileges from root and to run as an unprivileged user, e.g. ‘lighttpd’ or ‘www-data’. These systems are unlikely to be affected by the hardened and more secure systemd lighttpd.service configuration.

Downloads¶

lighttpd-1.4.79.tar.gz (GPG signature)
- SHA256: 72a625243de607802b74bd6ae243716cb65757aba8e74a40321cbd74cf12c9c8
lighttpd-1.4.79.tar.xz (GPG signature)
- SHA256: 3b29a625b3ad88702d1fea4f5f42bb7d87488f2e4efc977d7f185329ca6084bd
SHA256 checksums
SHA512 checksums

Changes from 1.4.78¶

[ci] update deps pkg names for lighttpd on Cygwin
[ci] MSYS detection kludge in tests/LightyTest.pm
[autotools] spelling Couldn’t => Could not
[mod_openssl] revert SSL_CTX default cert assign
[mod_openssl] spelling in comment
[TLS] issue trace if unable to check/refresh cert
[ci] Cygwin Invoke-WebRequest -MaximumRetryCount 3
[ci] Cygwin prefer D: drive
[ci] Cygwin remove redundant call to setup.exe
[core] set server.max-fds = 4096 if not specified
[core] clear Linux ambient capabilities, if any
[core] rename remove_pid_file() -> server_pid_file_remove()
[core] retry pidfile open on Linux
[doc] systemd lighttpd.service hardening
[doc] move TLS config to separate file tls.conf
[doc] systemd lighttpd.service hardening addition
[doc] systemd lighttpd*.socket activation examples
[core] default listen() backlog to SOMAXCONN
[ci] fix meson build execution selection

1.4.78

gstrauss — Sat, 22 Mar 2025 00:00:00 +0000

Important changes¶

option to reload TLS certs and CRLs; bug fixes

Downloads¶

lighttpd-1.4.78.tar.gz (GPG signature)
- SHA256: 6f1a563a23aafc649a76c40ae009445f327296a0d0c352690fbfedc46aea271d
lighttpd-1.4.78.tar.xz (GPG signature)
- SHA256: 3c0739e8bc75c9e9fc1cfa89e1c304dd4b0e4abb87adc646a1d20bc6a2db2a3e
SHA256 checksums
SHA512 checksums

Changes from 1.4.77¶

[core] comment about _WIN32 security dangers
[core] allow POST w/o Content-Length for HTTP/2 (#3273)
[mod_ssi] fix #exec (fixes #3275)
[multiple] address warnings for *unsigned* time_t
[multiple] add missing includes
[ls-hpack] adjust misplaced macro
[doc] add Documentation key to lighttpd.service
[mod_mbedtls] fix ssl.verifyclient.ca-crl-file
[doc] create-mime.conf.pl warn missing mime.types
[mod_wolfssl] limit default curves to avail curves
[mod_mbedtls] limit default curves to avail curves
[mod_openssl] fix preproc syntax error (fixes #3277)
[autotools] adjust build with wolfssl crypto
[mod_mbedtls] check/reload crt,pkey,crl each 64sec
[mod_wolfssl] use wolfSSL_CTX_set_cert_cb()
[mod_wolfssl] check/reload crt,pkey,crl each 64sec
[mod_openssl] check/reload crt,pkey,crl each 64sec
[mod_nss] check/reload crt,pkey,crl each 64sec
[mod_gnutls] check/reload crt,pkey,crl each 64sec
[TLS] remove hctx->tmp_buf use from acme-tls/1
[mod_wolfssl] adjust module spelling in config err
[core] _WIN32 cast size_t to DWORD for WSASend()
[mod_mbedtls] mbedtls 4.x mbedtls_ssl_ticket_setup
[mod_mbedtls] mbedtls 4.x removes DHE-RSA key exch
[mod_accesslog] quiet unused var on Windows warning
[ci] FreeBSD package mbedtls3
[mod_openssl] fix type mismatch fn run w/ libressl
[ci] macOS quiet brew install if pkg already inst
[mod_gnutls] free kp if cert chain invalid
[cmake] use execute_process()
[core] _WIN32: cast fd to SOCKET for FD_SET,FD_CLR
[mod_openssl] reload CRLs for openssl >= 1.1.0
[multiple] check EAGAIN and EWOULDBLOCK, if diff
[mod_dirlisting] Fix off-by-one error in date conversion for sorting on mtime
[mod_dirlisting] Swap A(scending) and D(escending) values (A=0, D=1)
[mod_dirlisting] fix JS date sorting (fixes #3279)
[core] yield after HTTP/1.x response end
[meson] set default buildtype=debugoptimized
[ci] use meson build with cov-build for coverity

1.4.77

gstrauss — Fri, 10 Jan 2025 00:00:00 +0000

Important changes¶

stronger TLS defaults: MinProtocol TLSv1.3; experimental TLS ECH support

Behavior Changes¶

lighttpd TLS defaults: MinProtocol TLSv1.3 Other configurations are still supported, but are not the default. Previous default: MinProtocol TLSv1.2 Current default: MinProtocol TLSv1.3
lighttpd TLS defaults now limit TLSv1.3 Groups to the IANA “Recommended” set: “X25519:P-256:P-384:X448” (https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8) Configure Groups/Curves using ssl.openssl.ssl-conf-cmd += (“Groups” => “…”)
server.error-handler-404 operates only on 404 (historical error: server.error-handler-404 operated on both 404 and 403) Since lighttpd 1.4.40 (released Jul 2016), server.error-handler is available to produce dynamic error pages for 4xx and 5xx responses. Since lighttpd 1.4.56 (released Nov 2020), magnet.attract-response-start-to is an additional, high performance mechanism to produce dynamic error pages. https://wiki.lighttpd.net/mod_magnet
doc/config/lighttpd.conf has been renamed doc/config/lighttpd.annotated.conf and doc/config/lighttpd.conf is now a simpler header which includes lighttpd.annotated.conf. lighttpd package maintainers must review their packaging scripts and include both lighttpd.conf and lighttpd.annotated.conf (e.g. doc/config/.conf) along with doc/config/conf.d/.conf.

Downloads¶

lighttpd-1.4.77.tar.gz (GPG signature)
- SHA256: 5321755fb15ca20084b7b12c26f8991278907fd5a2597b1bdc061a29f7c5ba5d
lighttpd-1.4.77.tar.xz (GPG signature)
- SHA256: acafabdbfa2267d8b6452d03d85fdd2a66525f3f05a36a79b6645c017f1562ce
SHA256 checksums
SHA512 checksums

Changes from 1.4.76¶

[build] packdist.sh tweaks of convenience commands
[build] remove ancient distribute.sh.in script
[core] add .torrent to mimetype.assign builtin defaults
Revert “[core] special value for Linux POLLRDHUP on SPARC” (fixes #3251)
[core] special value for Linux POLLRDHUP on SPARC (fixes #3251)
[mod_ssi] rename ssi_val_tobool to ssi_val_to_bool
[multiple] rename config_plugin_value_tobool
[core] fix graceful shutdown timeout handling
[core] preprocessor option to force crypto lib
[cmake] fix some typos in pcre2 detection
[tests] disambiguate regex test value from string
[tests] fix deflate tests w/ Fedora zlib-ng-compat
[core] port for QNX7.1/8.0
[doc] remove ancient doc/scripts/spawn-php.sh
[mod_deflate] limit zstd max window size to 8 MB
[mod_accesslog] ignore format specifier w/o label
[autotools] add pkgconf test for libdbi
[mod_webdav] use SQLITE_PREPARE_PERSISTENT
[mod_webdav] call sqlite3_initialize() at init
[mod_webdav] disable double-quoted string literal
[doc] remove ancient doc/scripts/spawn-php.sh
[core] clarify error msg for plugin ver mismatch
[mod_dirlisting] Add dark mode support
[autotools] Prefer libpcre.pc to pcre-config
[core] server.ip-transparent option on listen sock
[core] reject HTTP/1.x request-line URI trail sp
[core] remove http_request_parse_proto_loose()
[core] strictly require CRLF on chunked header
[core] strictly require CRLF on all chunked header
[multiple] quiet coverity false positives
[core] http_request_check_uri_strict optimization
[h2] fix spurious connection resets with zero log_monotonic_secs
[mod_dirlisting] fix ?json output; emit JSON list (fixes #3256)
[mod_dirlisting] minor optimization for ?json
[mod_auth] fix Digest nonce validation w/ nonce_secret
[core] omit pcre2 JIT error trace if JIT not avail
[doc] rename sample config lighttpd.annotated.conf
[doc] simplify doc/config/lighttpd.conf entry
[doc] use shorter https://wiki.lighttpd.net/ url
[ci] ci dependency maintenance
[meson] use pkg-config to find mbedtls 3.6
[meson] update FORCE_* vars to select crypto lib
[core] remove long-unused #ifdef USE_ALARM
[core] avoid pedantic compiler warning (fixes #3262)
[mod_auth] HTTP Digest and HTTP/2 extended CONNECT
[mod_dirlisting] sort by exact value of size (fixes #3264)
[mod_dirlisting] sort mtime using data-value (#3264)
[ci] enable Solaris build (now less slow)
[core] remove mimetype.assign from tests/lighttpd.conf
[ci] adjust Solaris CI build
[doc] update create-mime.conf.pl compression types
[doc] update doc/config/conf.d/mime.conf
[ci] adjust Solaris CI build
[core] remove cast from ioctl() RNDGETENTCNT
[core] update ls-hpack
[core] light_isprint(), light_iscntrl()
[core] perf: tighter loops for str encode,escape
[mod_wstunnel] Sec-WebSocket-Protocol: binary
[core] light_iscntrl_or_utf8_invalid_byte()
[core] option: allow unescaped UTF-8 in errorlog (fixes #3268)
[systemd] test config in ExecReload before signal
[core] config parsing: detect invalid keys
[TLS] allow list of Groups/Curves
[mbedtls] reset crt_profile when reconfigured
[mod_mbedtls] guard mbedtls use of RSA_PSK
[mod_nss] add ssl.openssl.ssl-conf-cmd Ciphersuite
[mod_wolfssl] typo
[mod_nss] ver check for experimental groups/curves
[mod_wolfssl] missing return
[tests] do not test for exact compress zlib size
[tests] consolidate test value comparison logic
.github/workflows/dependabot.yml “github-actions”
[ci] dependabot.yml name
[ci] ci.yml pull_request types
[ci] move file to .github/dependabot.yml
[multiple] avoid sending body to GW_AUTHORIZER (fixes #3272)
[mod_magnet] use local sys-dirent.h (portability)
[mod_magnet] add code header to mod_magnet.c
[TLS] skip SSL_CTX init if not in SOCKET condition
[mod_openssl] ssl.ech-opts, load ECH keys
[mod_openssl] ssl.non-ech-host opt to require ECH
[mod_openssl] free mem from SSL_ech_get1_status()
[mod_openssl] ECH: use new OSSL_ECHSTORE APIs
[mod_openssl] ECH: refresh 4 year old patches
[mod_openssl] ECH: kludge compat w/ OpenSSL ECH API
[mod_openssl] omit OSSL_ECH_FOR_RETRY for ECH-only
[mod_openssl] ECH: OSSL_ECH_FOR_RETRY for cur key
[mod_openssl] ECH: boringssl support
[TLS] modify TLS defaults to MinProtocol TLSv1.3
[TLS] use TLSv1.3 groups X25519:P-256:P-384:X448
[ci] macos: mariadb-connector-c is keg-only
[mod_openssl] skip *.ech files beginning with ‘.’
[mod_openssl] ECH: rename directives to ECH terms
[core] server.error-handler-404 handles only 404
[mod_magnet] quiet coverity false positive
[mod_openssl] ECH: use same (debug) CGI var names
[mod_openssl] ECH: reload keys only if modified
[mod_openssl] ECH: remove kludge compat w/ OpenSSL ECH API
[core] reset cond cache item URL if pathinfo
[mod_openssl] use BUF_PTR_LEN when buffer not NULL
[mod_openssl] ECH: code comments for ECH-only host
[core] import xxHash v0.8.3
[autoconf] update ax_prog_cc_for_build.m4

1.4.76

gstrauss — Fri, 12 Apr 2024 00:00:00 +0000

Important changes¶

detect VU#421644 HTTP/2 CONTINUATION Flood, avoid CVE-2024-3094 xz supply chain attack, bug fixes

detect VU#421644 HTTP/2 CONTINUATION Flood
- issue trace and send GO_AWAY
- (lighttpd not vulnerable to attack)
avoid CVE-2024-3094 xz supply chain attack
- use ‘git archive’ to replace ‘make dist’ to create release tarballs
  - remove excess complexity (m4 and autotools) from release process
  - now more easily verifiable that sources come from signed git release tag

FUTURE SCHEDULED BEHAVIOR CHANGES: (2025)¶

lighttpd TLS defaults will change to MinProtocol TLSv1.3 Other configurations will still be supported, but will not be the default. Proposed default: MinProtocol TLSv1.3 Current default: MinProtocol TLSv1.2
server.error-handler-404 will operate only on 404 (historical error: server.error-handler-404 operated on both 404 and 403) Since lighttpd 1.4.40 (released Jul 2016), server.error-handler is available to produce dynamic error pages for 4xx and 5xx responses. Since lighttpd 1.4.56 (released Nov 2020), magnet.attract-response-start-to is an additional, high performance mechanism to produce dynamic error pages. https://wiki.lighttpd.net/mod_magnet

Downloads¶

lighttpd-1.4.76.tar.gz (GPG signature)
- SHA256: ba14a030889518194fd88b33e419d51cc38c8fe917126d5a7a965be79b53e995
lighttpd-1.4.76.tar.xz (GPG signature)
- SHA256: 8cbf4296e373cfd0cedfe9d978760b5b05c58fdc4048b4e2bcaf0a61ac8f5011
SHA256 checksums
SHA512 checksums

Changes from 1.4.75¶

[core] add default to builtin mimetype.assign
[core] add MPTCP support
[core] disable MPTCP support by default
[mod_expire] omit caching hdrs for 204 No Content
[mod_staticfile] noinline cold func
[core] GNU/Hurd preadv2() RWF_NOWAIT ENOTSUP
[core] special value for Linux POLLRDHUP on SPARC
[mod_openssl] define asn1 time w/ OPENSSL_NO_OCSP
[h2] VU#421644 HTTP/2 CONTINUATION Flood
[build] packdist.sh git archive; replace make dist
[core] gw_network_backend_write_error() cold func
[core] reduce syscalls in some backend connect
[core] defer TCP_FIN propagate if connect()ing (fixes #3249)
[ci] workaround some packaging issues in NetBSD 10

1.4.75

gstrauss — Wed, 13 Mar 2024 00:00:00 +0000

Important changes¶

incrementally stronger TLS cipher defaults; bugs fixes

Downloads¶

lighttpd-1.4.75.tar.gz (GPG signature)
- SHA256: 283aa8cba5534979f987c2a652948c241a94683a21e06e2a7109f632bbcdda97
lighttpd-1.4.75.tar.xz (GPG signature)
- SHA256: 8b721ca939d312afaa6ef31dcbd6afb5161ed385ac828e6fccd4c5b76be189d6
SHA256 checksums
SHA512 checksums

Behavior Changes: (previously announced)¶

TLS cipher defaults have been incrementally updated to stronger defaults New defaults are forward-secret and support authenticated encryption (AEAD) New defaults: openssl ciphers ‘EECDH+AESGCM:CHACHA20:!PSK:!DHE’ Previous defaults: openssl ciphers ‘EECDH+AESGCM:AES256+EECDH:CHACHA20:!SHA1:!SHA256:!SHA384’ Little or no impact is expected for lighttpd configs already using lighttpd TLS defaults (and supported clients, i.e. those which have not already reached end-of-life). Reference: https://developers.cloudflare.com/ssl/reference/cipher-suites/recommendations/
mod_redirect: default url.redirect-code for HTTP/1.1 and later has been changed from 301 Moved Permanently to 308 Permanent Redirect (only if url.redirect is not explicitly set in lighttpd.conf) RFC7538: https://datatracker.ietf.org/doc/html/rfc7538 (published almost 9 years ago)

Future Scheduled Behavior Changes: (2025)¶

lighttpd TLS defaults will change to MinProtocol TLSv1.3 Other configurations will still be supported, but will not be the default. Proposed default: MinProtocol TLSv1.3 Current default: MinProtocol TLSv1.2
server.error-handler-404 will operate only on 404 (historical error: server.error-handler-404 operated on both 404 and 403) Since lighttpd 1.4.40 (released Jul 2016), server.error-handler is available to produce dynamic error pages for 4xx and 5xx responses. Since lighttpd 1.4.56 (released Nov 2020), magnet.attract-response-start-to is an additional, high performance mechanism to produce dynamic error pages. https://wiki.lighttpd.net/mod_magnet

Changes from 1.4.74¶

[mod_redirect] url.redirect-code = 308 new default
[ls-hpack] more portability fixes for sys/queue.h
[ls-hpack] update version to 2.3.3
[TLS] default to stronger ciphers w/ PFS and AEAD
[ci] apt-get install build-essential on Ubuntu
[ci] /usr/local/opt keg-only pkgs on Darwin(macOS)
[mod_authn_sasl] translate SASL_LOG_* to syslog
[build] include src/compat/sys/queue.h in tarball
[core] fdlog_openlog(), fdlog_closelog()
[mod_accesslog] fdlog_openlog() if using syslog
[cmake] fix LEMON_PATH with empty CMAKE_BUILD_TYPE
[ci] limit github ci to specific branches
[ci] prefer non-login shell for Cygwin CI build
[ci] prefer dash for Cygwin and MSYS2 builds
[mod_wstunnel] fix server.ping-interval w/ HTTP/2
[mod_dirlisting] fix suffix display of ‘/’ on file (fixes #3242)
[mod_openssl] use internal asn1_time fn on 32-bit (fixes #3244)
[mod_openssl] faster ASN1_TIME parse
[mod_wolfssl] faster ASN1_TIME parse
[doc] update TLS comment in sample lighttpd.conf

1.4.74

gstrauss — Mon, 19 Feb 2024 00:00:00 +0000

Important changes¶

bugs fixes, portability, expand CI

Downloads¶

lighttpd-1.4.74.tar.gz (GPG signature)
- SHA256: 3a82994d2afdd685c967569919cfa612dbb39bc1cc737d1b07dc4e988379ae57
lighttpd-1.4.74.tar.xz (GPG signature)
- SHA256: 5c08736e83088f7e019797159f306e88ec729abe976dc98fb3bed71b9d3e53b5
SHA256 checksums
SHA512 checksums

Behavior Changes:¶

Some messages sent to syslog() (if enabled in lighttpd config) have been changed to use different priorities (e.g. LOG_WARNING, LOG_DEBUG) instead of everything being sent with LOG_ERROR priority. The change affects only lighttpd configs which set server.errorlog-use-syslog = “enable” (not default)
Use sendfile() with musl libc; fix build detection of sendfile() w/ musl libc Please report any issues, though any issues are unexpected since lighttpd falls back to writev() if sendfile() fails.

Future Scheduled Behavior Changes: (for the next lighttpd release)¶

TLS cipher defaults will be incrementally updated to stronger defaults Proposed defaults are forward-secret and support authenticated encryption (AEAD) Proposed defaults: openssl ciphers ‘EECDH+AESGCM:CHACHA20:!PSK:!DHE’ Current defaults: openssl ciphers ‘EECDH+AESGCM:AES256+EECDH:CHACHA20:!SHA1:!SHA256:!SHA384’ Little or no impact is expected for lighttpd configs already using lighttpd TLS defaults (and supported clients, i.e. those which have not already reached end-of-life). Reference: https://developers.cloudflare.com/ssl/reference/cipher-suites/recommendations/
mod_redirect: default url.redirect-code for HTTP/1.1 and later will be changed from 301 Moved Permanently to 308 Permanent Redirect (only if url.redirect is not explicitly set in lighttpd.conf) RFC7538: https://datatracker.ietf.org/doc/html/rfc7538 (published almost 9 years ago)

Future Scheduled Behavior Changes: (2025)¶

lighttpd TLS defaults will change to MinProtocol TLSv1.3 Other configurations will still be supported, but will not be the default. Proposed default: MinProtocol TLSv1.3 Current default: MinProtocol TLSv1.2

Changes from 1.4.73¶

[mod_h2] send 500 if backend oversized resp hdrs
[mod_h2] h2_send_1xx() lowercase field names (fixes #3233)
[mod_dirlisting] smaller funcs to generate listing
[mod_dirlisting] dir-listing.sort option (#3235)
[mod_dirlisting] check for response stream bufmin
[core] skip SIGUSR1 after clock jump if chroot’ed
[mod_deflate] move bzip2 to end of priority list
[mod_deflate] deflate.allowed-encodings default
[core] cfg “if”,”elif”,”elsif”,”elseif”,”else if”
[lemon] refresh LEMON parser to SQLite maint ver
[core] add newlines to config parsing error trace
[ls-hpack] sys/queue.h portability
[scons] remove -std=gnu99 to use modern defaults
[multiple] share code for upgrade: websocket
[core] check for SOCK_CLOEXEC earlier in startup
[autotools] report if ipv6 support disabled (fixes #3237)
[core] simpler error page header
[mod_status] simpler status page header
[h2] quicker server graceful shutdown of idle h2
[mod_openssl] kTLS: check for kernel tls offload
[mod_gnutls] kTLS: check for kernel tls offload
[core] quicker server graceful shutdown of websockets
[build] -D_LARGEFILE64_SOURCE for musl sendfile64()
[mod_setenv] code consistency
[mod_expire] resp tag check
[mod_expire] comment
[core] use SF_NODISKIO with sendfile() on FreeBSD
[core] chunk_file_pread_chunk()
[mod_deflate] prefer reusable buffer to read file
[core] reduce blocking I/O sending files to net
[core] reduce network send file fallback path
[core] try mmap() if not using sendfile()
[mod_wolfssl] mod_wolfssl_write_err()
[multiple] extend chunkqueue_peek_data() w/ nowait
[core] preadv2 RWF_NOWAIT EOPNOTSUPP on tmpfs (?!)
[build] type error in configure.ac sendfile probe (fixes #3238)
[core] update ls-hpack
[ls-hpack] sys/queue.h STAILQ_FOREACH portability
[core] chunk_open_file_chunk() in chunk.h
[multiple] use chunk_open_file_chunk()
[core] remove chunkqueue_open_file_chunk()
[core] use sendfile() with iovecs where available
[scons] remove CheckFunc() incorrect header usage
[core] spelling in comment in network_write.c
[cmake] check for sendfile64 only on Linux
[core] quiet compiler warning for NDEBUG redefined
[autoconf] config test for mbedtls needs mbedx509
[mod_h2] add con to job queue when wr alloc used
[mod_h2] use different flag for disk I/O busy
[crypto] use evp api for truncated sha-2 with libressl
[mod_expire] smaller options parse func
[mod_expire] check modification time to cur time
[tests] t/test_mod_expire.c
[tests] add mod_expire tests to tests/request.t
[core] log trace with priority for syslog() (#3239)
[core] avoid preprocessor use inside macros
[core] log_pri() and log_pri_multiline() (#3239)
[build] remove checks for sendfile64
[tests] clean up memleak on test exit
[build] quiet compiler warnings in LEMON parser
[core] simplify connection_handle_write() err case
[core] gw_host_get shared code
[doc] update doc/config/conf.d/mime.conf
[core] combine *BSD cond handling 0-len FILE_CHUNK
[meson] portability improvements
[core] DragonflyBSD portability
[tests] quiet compiler warning
[ci] enable github CI
[ci] adjust .github/workflows/meson.yml
[ci] quiet msys-clang32 stdcall compiler warning
[ci] #undef _XOPEN_SOURCE on Solaris
[core] fix recent solaris typo; compile failure
[ci] _WIN32 portability
[cmake,meson] skip tests/* under native Windows
[tests] support platforms without cp -n
[ci] cmake did not detect inet_pton on x86 _WIN32
[ci] use latest GCC and clang
[ci] adjust .github/workflows/meson.yml
[ci] further simplify
[ci] adjust NetBSD,OpenBSD tests .github/workflows
[ci] add Windows-VisualStudio to .github/workflows
[ci] add Solaris (disabled) to .github/workflows
[ci] add Windows-MSYS2 to .github/workflows
[ci] rename .github/workflows/meson.yml to pr.yml
[tests] adjust shell syntax in tests/prepare.sh
[tests] test_mod stub funcs for static builds
[ci] adjust Windows tests in .github/workflows
[mod_authn_dbi,mod_vhostdb_dbi] check for
[ci] tailor scripts/ci-build.sh for FreeBSD
[ci] use set -e in .github/workflows run commands
[debug] debug.log-timeouts for all timeout logging
[debug] use log_debug_multiline() (#3239)
[debug] use log_debug() instead of log_error() (#3239)
[multiple] use log_warn() for config warnings (#3239)
[core] use log_warn(),log_notice(),log_info() (fixes #3239)
[ls-hpack] compat include of
[tests] skip deflate tests if zlib not available
[core] ignore cc -Wcpp warning for
[ci] mechanism to disable wolfssl in ci-build.sh
[ci] use Alpine Linux VMs to test additional arch
[ci] skip 32-bit builds on Windows; save resources
[tests] skip shutdown(SHUT_WR) in tests on s390x
[ci] add s390x arch
[meson] replace deprecated meson.build_root() use
[ci] x86_64 and x86 featureful builds on ubuntu
[ci] add x86_64 cmake ASAN build on ubuntu
[ci] ci-build.sh add some NO_* options
[ci] add Windows-Cygwin build
[ci] fail fast if x86 build fails on alpine
[ci] reduce some builds while maintaining coverage
[ci] remove config not actually running x86 ubuntu
[ci] more featureful build on macOS
[doc] cert-staple.sh check staple newer than cert
[ci] pr.yml format consistency
[tests] remove repeated file in prepare.sh cp
[wolfssl] renamed SSL_OP_NO_TICKET
[ci] more featureful build on NetBSD
[mod_authn_gssapi] ifndef GSS_KRB5_NT_PRINCIPAL_NAME
[build] check ‘lua54’ before other lua variants
[ci] OpenBSD CFLAGS LDFLAGS PKG_CONFIG_LIBDIR
[ci] more featureful build on OpenBSD
[ci] use bash on DragonflyBSD instead of csh
[ci] special-cases for running tests under MSYS2
[ci] basic build and run tests under MSYS2
[tests] remove stray comment from test_mod_expire
[ci] ci-build.sh NO_DBI option
[ci] ci-build.sh NO_UUID option
[ci] ci-build.sh NO_GNUTLS option
[ci] ci-build.sh NO_MYSQL option
[core] _WIN32 define PROT_WRITE to PAGE_READWRITE
[mod_authn_sasl] use HOSTNAME for fqdn on _WIN32
[ci] more featureful build on MSYS2
[mod_authn_sasl] fix typo
[ci] use cygwin test repos for latest packages
[ci] vmactions usesh: true
[ci] fix cmake generator path for MSVC
[mod_wstunnel] read and discard HTTP/1.1 req body
[core] use log_notice() for conn limit notice (#3239)
[core] gw_upgrade_policy() shared code
[mod_wstunnel] handle large kernel socket recv buf
[core] stat_cache.c replace assert w/ error codes
[core] remove dev assert in http_chunk_append_mem
[core] ck_static_assert()
[core] remove asserts from gw_status_get_counter()
[core] configparser.y combine assert, remove debug
[core] remove assert from sock_addr.c
[mod_fastcgi] check env w/ cond instead of assert
[core] shared code chunkqueue_close_tempchunk()
[core] buffer.c combine asserts
[core] array require nonnull for insert,replace
[core] li_tohex*() no longer adds ‘\0’
[core] accept 65536 in config for ushort values
[ci] add missing intermediate dep for Cygwin
[core] clarify configfile parse comment
[core] fix crash with invalid lighttpd.conf syntax
[core] lighttpd.conf detect,err if consecutive str
[mod_magnet] lighty.r.req_body.unspecified_len
[mod_proxy] handle HTTP/1.0 unspecified req len
[core] unset Upgrade if downgrade HTTP/1.1 to 1.0
[mod_magnet] interface to downgrade HTTP/1.1 to 1.0
[mod_magnet] expand guidance in error message (#3240)
[debug] use log_debug() instead of log_error() (#3239)
[mod_wstunnel] use log_warn(),log_notice(),log_info() (#3239)
[multiple] gw_backend_error_trace() (fixes #1406)
[mod_webdav] webdav_uuid_v4() to supplant libuuid (#1056)
[build] remove libuuid dependency (fixes #1056)
[mod_wstunnel] quiet coverity warning
[doc] fix typos in doc/config/lighttpd.conf
[mod_h2] send 502 if backend oversized resp hdrs

1.4.73

gstrauss — Mon, 30 Oct 2023 00:00:00 +0000

Important changes¶

HTTP/2 detect and log rapid reset attack

Downloads¶

lighttpd-1.4.73.tar.gz (GPG signature)
- SHA256: 816cbec71e8d02d874f1d5c798d76d091a76d5acbeb6e017ba76aeb4263d6995
lighttpd-1.4.73.tar.xz (GPG signature)
- SHA256: 818816d0b314b0aa8728a7076513435f6d5eb227f3b61323468e1f10dbe84ca8
SHA256 checksums
SHA512 checksums

Changes from 1.4.72¶

[core] add .mkv to mimetype.assign builtin defaults
[core] warn if out-of-range value for config short
[mod_openssl] set default curves for ossl < 1.1.0
[mod_h2] parse HEADERS flags sooner
[mod_h2] check send window before defer frame rd
[mod_h2] send GOAWAY to excessive request flood
[mod_h2] h2_parse_headers_frame() adjust args
[mod_h2] h2_recv_headers() parse trailers earlier
[mod_h2] send GOAWAY to excessive request flood
[mod_h2] discard new streams after GOAWAY sent
[mod_h2] h2_discard_headers() to HPACK-decode hdrs
[core] parse entire server.http-parseopts list
[mod_wstunnel] Sec-WebSocket-Protocol only if req hdr
[mod_h2] disable h2proto if mod_h2 was not found
[core] omit dlopen trace for mod_h2, mod_deflate
[mod_h2] defer input parsing if large output queue
[mod_h2] defer frame handling if stream pend close
[mod_h2] detect and log HTTP/2 rapid reset attack
[core] honor MBEDTLS_USE_PSA_CRYPTO for hash,rand
[mod_mbedtls] honor MBEDTLS_USE_PSA_CRYPTO for rand
[core] comment out li_rand_bytes() (unused)
[mod_mbedtls] handle mbedtls 3.x partial write
[mod_h2] detect and log HTTP/2 rapid reset attack
[mod_h2] detect and log HTTP/2 rapid reset attack
[mod_openssl] warn if openssl version < 3.0.0
[mod_openssl] include openssl/hmac.h for boringssl

1.4.72

gstrauss — Fri, 06 Oct 2023 00:00:00 +0000

Important changes¶

bugfixes

Downloads¶

lighttpd-1.4.72.tar.gz (GPG signature)
- SHA256: c016d62d2d13a3590ea05494c61059c025447bc71d14a87ee54968b9f506c3ca
lighttpd-1.4.72.tar.xz (GPG signature)
- SHA256: f7cade4d69b754a0748c01463c33cd8b456ca9cc03bb09e85a71bcbcd54e55ec
SHA256 checksums
SHA512 checksums

Changes from 1.4.71¶

[core] save config read from stdin across restart
[core] warn if daemonize w/o absolute config path
[mod_dirlisting] send Link w/ external css or js
[mod_dirlisting] fix missing header/readme (fixes #3211)
[core] ignore coverity warning
[core] ignore coverity warning
[core] reqpool.c:request_set_con()
[core] request_init_data() minor optim
[core] request.c:request_pool_{push,pop}
Revert “[core] h2 http_request_parse_header() tweak”
[core] enable config conditions on HTTP/2 PRI
[mod_webdav] extend symlink support (non-standard)
[mod_extforward] fix extforward.params config opt
[mod_authn_ldap] fix config auth.require group=… (fixes #3216)
[core] set CON_STATE_READ_POST for HTTP/2 reqbody
[core] chunkqueue_read_squash() returns cq->first
[core] get body from cq at offset in chunk
[doc] update stbuehler address
[tests] use sha crypt for fastcgi auth environment tests
[tests] drop des-crypt and crypt-md5 auth tests - deprecated/not available on various platforms
[core] code size: xxhash XXH_NO_STREAM
[core] fdevent_sh_exec()
[mod_dirlisting] http_dirlist_auto_layout_early_hints()
[mod_dirlisting] send 103 w/ external css or js
[mod_dirlisting] json output for //?json
[mod_dirlisting] include ETag with cached result
[core] import xxHash v0.8.2
[tests] move %ENV modifications into forked child
[mod_ssi] init hctx->wq to init alt cq tempdirs
[tests] initialize request_st cqs in tests
[core] chunkqueue_env_tmpdir()
[core] config_set_defaults() reduce code size
[tests] use current perl interpreter path for env.PERL in lighttpd.conf
[mod_deflate] code reuse to create temp file
[core] skip pwrite() to temp file if 0 len write
[core] store cq->tempdirs in stack var
[core] remove tempdirs ptr from struct chunkqueue
[core] treat upload_temp_file_size=0 as default sz
[core] hide unused var on _WIN32 compiler warning
[mod_nss] nspr include prefix portability(attempt)
[CI] scripts/ci-build.sh arg consistency;add meson
[CI] remove wolfssl from autobuild; let rest build
[CI] remove NSS from autobuild; let rest build
[CI] remove mbedtls from autobuild; let rest build
[mod_nss] nspr include prefix portability(attempt)
[CI] ci-build.sh: adjust meson; add pam, maxminddb
[CI] ci-build.sh: fix typo –with-pam
[CI] remove maxminddb from autobuild,cmake; let rest build
[CI] ci-build.sh re-enable additional dependencies
[core] optimize for non-Range requests
[core] allow larger number of Ranges if sorted
[tests] test_http_range.c
[core] attempt to quiet coverity warning
[build] packdist.sh now produces .md for www.l.n
[core] disable keep-alive if HTTP/1.1 CL and TE
[core] reject empty Content-Length for HTTP/1.x
[core] reject uppercase in unrecognized HTTP/2 hdr
[core] warn dynamic mods listed before staticfile
[core] dev-only internal request state debugging
[core] short-circuit connection_state_machine_loop
[core] reset connection-level state at con level
[core] optim for non-throttle writes
[core] remove connection_handle_write HTTP/1.x opt
[core] yield writing large HTTP/1.x on slow device
[core] tighten h2_process_streams()
[core] h2_process_streams() simpler loop to retire
[core] http_response_physical_pathinfo()
[core] http_response_prepare() tweaks
[meson] Fix ‘getoption’ meson typo
[core] use different getxattr() prototype on MacOS
[mod_deflate] do not compress any 1xx status
[core] http_response_304(), http_response_412()
[core] add config option to reject pathinfo
[core] expand mimetype.assign builtin defaults
[core] mark some cold routines noinline
[core] add config opt to send GOAWAY for bad auth
[core] show_features() show inotify or kqueue
[core] stat_cache_refresh_entry()
[core] splaytree: use all 32-bits of hash value
[core] splaytree: compare keys directly
[core] splaytree: splaytree_splay_nonnull()
[core] stat_cache: stat_cache_sptree_ndx()
[multiple] use splaytree_splay_nonnull()
[h2] comment struct h2con h2_sid member is unused
[mod_openssl] disable DH auto if DHParameters set
[mod_openssl] replace deprecated openssl funcs
[core] splaytree: splaytree_delete_splayed_node()
[multiple] use splaytree_delete_splayed_node()
[core] splaytree: splaytree_insert_splayed()
[multiple] use splaytree_insert_splayed()
[core] _WIN32 fs_win32_readlinkUTF8() (#3223)
[mod_magnet] lighty.c.readlink() (fixes #3223)
[core] add config option to reject pathinfo
[mod_dirlisting] send 103 Early Hints only for h2+
[mod_webdav] reject non-identity Content-Encoding
[scons] include mod_h2 in static builds (fixes #3224)
[core] http_request_validate_pseudohdrs comment
[core] comment out redundant code
[core] reset addtl state b4 dynamic error handler
[core] reject Connection hdr in h2 as soon as seen
[mod_h2] process headers for debug
[mod_h2] comments and behavior for h2spec tests
[multiple] mark func __attribute_returns_nonnull__
[core] expand mimetype.assign builtin defaults
[core] warn if IPv6 socket not supported
[mod_simple_vhost,mod_evhost] check host strict
[mod_simple_vhost,mod_evhost] minor code transform
[mod_magnet] quiet 32-bit compiler warning

1.4.71

gstrauss — Sat, 27 May 2023 00:00:00 +0000

Important changes¶

bugfixes and portability; HTTP/2 support separated to mod_h2 module

Downloads¶

lighttpd-1.4.71.tar.gz (GPG signature)
- SHA256: 3855dfed5ce7a4b006e3d434b00985852b5a91c2abc56d92071f98bfe79f9d80
lighttpd-1.4.71.tar.xz (GPG signature)
- SHA256: b8b6915da20396fdc354df3324d5e440169b2e5ea7859e3a775213841325afac
SHA256 checksums
SHA512 checksums

Behavior Changes (previously announced):¶

http/2 support will be split out into optional separate module (mod_h2)\ (static builds will need to list mod_h2 in plugin-static.h to include mod_h2)

Changes from 1.4.70¶

[mod_h2] HTTP/2 separate module; no longer builtin
[mod_magnet] fix static build using autoconf (fixes #3203)
[core] fix new use of posix_spawn with some glibc (fixes #3201)
[core] _WIN32 quiet compiler warnings 32-bit build
[core] check getaddrinfo EAI_ADDRFAMILY w/ glibc
[core] quiet lemon.c clang C2x warnings
[core] compile w/o posix_spawn() on iOS
[core] fix crash due to missing initialization (fixes #3207)
[core] request_init() separate static func
[multiple] remove some unused/redundant includes
[core] server.modules s/mod_compress/mod_deflate/
[core] preproc consistency #pragma GCC diagnostic
[core] update ls-hpack
[core] use empty value in srvconf.config_touched
[core] provide mimetype.assign default if unset
[mod_vhostdb_mysql] MySQL missing mysql_get_socket (fixes #3208)
[core] clarify comment

1.4.70

gstrauss — Wed, 10 May 2023 00:00:00 +0000

Important changes¶

speed up CGI spawning
native Windows build (experimental) (not packaged; no installer)
support HTTP/2 downstream proxy serving multiple clients on single connection (mod_extforward, mod_maxminddb)
restructure code to isolate HTTP/2

Downloads¶

lighttpd-1.4.70.tar.gz (GPG signature)
- SHA256: bc96e5571d937279aa7cfdc9c9de95bcc457ab6feafff6264aa8832d026068bc
lighttpd-1.4.70.tar.xz (GPG signature)
- SHA256: 921ebe1cf4b6b9897e03779ab7a23a31f4ba40a1abe2067525c33cd3ce61fe85
SHA256 checksums
SHA512 checksums

Behavior Changes (previously announced):¶

no longer building separate modules for built-in modules\ lighttpd 1.4.70 omits building separate (unused) modules for:\ mod_access mod_alias mod_evhost mod_expire mod_fastcgi mod_indexfile\ mod_redirect mod_rewrite mod_scgi mod_setenv mod_simple_vhost mod_staticfile

Future Scheduled Behavior Changes:¶

HTTP/2 support will be split out into optional separate module (mod_h2)\ (static builds will need to list mod_h2 in plugin-static.h to include mod_h2)

Changes from 1.4.69¶

[autotools] chmod u+w configparser.c for lemon
[build] skip build separate modules for built-ins
[core] cache format secs for high prec errlog
[mod_maxminddb] check remote IP each request (fixes #3191)
[multiple] store ptrs to remote addr in request_st (#3192)
[mod_extforward] manage remote addr per request (fixes #3192)
[core] use C23 memset_explicit() were available
[mod_accesslog] %{mask}a to mask/anonymize IP
[core] cast to fix compiler error in prior commit
[scons] fix static build to include builtin_mods
[core] h2_recv_headers() tweak to reduce code size
[core] h2_get_stream_req() code reuse
[core] h2: remove obsolete comment
[core] h2 mark :status matching lsxpack enum value
[core] h2 match w/ lsxpack pseudo-header key only
[core] limit server.max-request-field-size \<=65535
[core] permit shell HERE docs to specify config
[core] add members to http_header_parse_ctx
[mod_extforward] typo in comment
[mod_openssl] SSL_CTX_set_options() takes uint64_t
[core] reorder enum handler_t
[core] connection_handle_request_start_state()
[core] check chunk file open early in mmap viewadj (fixes #3197)
[core] h2 http_request_parse_header() tweak
[mod_extforward] recognize unix domain sockets (fixes #3198)
[mod_magnet] support ./configure —with-lua=luajit (#3199)
[core] remove instance of devel debug code
[core] quiet coverity warning
[core] connection_check_upgrade() h2_upgrade_h2c()
[core] CON_STATE_REQUEST_END transient state
[core] expose request_set_state() for internal use
[core] h2_send_goaway_graceful()
[core] h2_check_timeout()
[core] h2_process_streams()
[core] h2_recv_reqbody()
[core] HTTP_VERSION_3 enum value
[core] r~~[x union w/ structs for r]{style=”text-align:right;”}~~>x.{h1}
[core] r~~[x union w/ structs for r]{style=”text-align:right;”}~~>x.{h1,h2}
[core] http_dispatch[] tables for HTTP proto vers
[core] hxcon “base class” for h2con
[mod_h2] HTTP/2 module: mod_h2
[multiple] optimistic client read only if HTTP/1.x
[core] _WIN32 port compatibility headers
[core] _WIN32 impl of setenv(), unsetenv()
[multiple] _WIN32 protect code w/ HAVE_SYSLOG_H
[multiple] _WIN32 protect code w/ HAVE_FORK
[core] _WIN32 protect code w/ HAVE_IPV6
[multiple] _WIN32 protect code w/ HAVE_SYS_UN_H
[multiple] _WIN32 stat() compat sys-stat.h
[core] _WIN32 uid, gid compat
[core] _WIN32 signal-related compat
[multiple] _WIN32 misc compat
[core] _WIN32 minimal glob() impl for configfile.c
[core] _WIN32 use gmtime_s(), localtime_s()
[mod_dirlisting] _WIN32 Find*File()
[multiple] _WIN32 Find*File() sys-dirent.h
[core] _WIN32 sys-unistd.h to wrap \<unistd.h>
[core] _WIN32 sys-wait.h to wrap \<sys/wait.h>
[core] _WIN32 implementation of socketpair()
[core] _WIN32 fdevent_createprocess()
[core] _WIN32 socket-compat, filesystem-compat
[core] _WIN32 check WSAGetLastError() w/ sockets
[mod_cgi] _WIN32 use socketpair instead of pipe
[core] _WIN32 clock ticks and time
[core] _WIN32 alternative fdarray for Windows
[core] _WIN32 basic (very limited) getopt() impl
[tests] _WIN32 fcgi-responder.c, scgi-responder.c
[core] WIN32 rename_WIN32 to _WIN32
[core] _WIN32 casts to quiet some VS warnings
[tests] _WIN32 use TMPDIR (or TEMP) for test files
[build] _WIN32 mingw build
[multiple] MINGW32 missing strftime() “%F %T”
[tests] _WIN32 adjustments in LightyTest.pm
[core] _WIN32 reset std streams at startup
[core] _WIN32 log_perror() with GetLastError()
[core] _WIN32 log_serror() for WSAGetLastError()
[core] _WIN32 use log_serror() for WSAGetLastError
[core] _WIN32 use rand_s() to init pseudo RNG
[core] _WIN32 fdevent_kill()
[multiple] _WIN32 use fdevent_kill()
[core] _WIN32 stat(), ‘/’ and ‘\\’ adjustments
[tests] _WIN32 cygwin test support
[mod_deflate] _WIN32 disable deflate.cache-dir
[mod_dirlisting] _WIN32 close files before unlink
[tests] _WIN32 close files before unlink
[core] _WIN32 close chunk temp files before unlink
[core] _WIN32 prefer WSAPoll()
[core] _WIN32 lighttpd winsvc
[core] _WIN32 custom fs funcs on UTF-8 paths
[core] _WIN32 scream UTF-8 at MS (does not matter)
[cmake] _WIN32 build more mods with BUILD_STATIC
[cmake] _WIN32 remove older build config
[core] _WIN32 use WSASend for writev-equiv on sock
[meson] static build option under cygwin
[build] WIN32_declspec(dllexport) *_plugin_init
[build] _WIN32 shared dll build (autotools, cmake)
[tests] _WIN32 skip time-sensitive tests during CI
[core] use posix_spawn() where available
[mod_cgi] comment about caching target dirname
[meson] update comment with build flags
[meson] check FORCE_{WOLFSSL,MBEDTLS}_CRYPTO
[mod_auth] warn if auth.require path never matches
[core] h1.[ch] collect some HTTP/1.x specific code
[core] noinline connection shutdown, reset
[TLS] \$SERVER[“socket”] inherit global ssl.engine
[mod_proxy] match “map-host-response” “-” w/ Host
[core] noinline stat_cache_sptree_find()
[core] rename http_kv funcs, reorder http_versions
[mod_cgi] move fd count to cgi_create_env()
[mod_cgi] reduce code size
[mod_cgi] do not issue trace if CGI closes input
[mod_cgi] cgi_create_err() cold err handling func
[core] always decr fd count upon socket close()
[mod_mbedtls] check MBEDTLS_DEBUG_C for debug func
[core] return pid_t from fdevent_waitpid()
[core] _WIN32 compile fix
[meson] build fix for builtin_mods
[core] move some shared funcs to call from modules
[build] move some files to call from modules
[mod_cgi] doubly-linked list of CGI pids
[mod_cgi] reuse fd already opened to /dev/null
[mod_cgi] reset upload_temp_file_size in CGI close
[tests] copy confs for running tests in alt dir
[scons] avoid dup mod_h2 module in static build
[autoconf] include fs_win32.h in hdrs for dpkg
[build] ifdef _WIN32 before include fs_win32.h
[mod_openssl] SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE
[mod_dirlisting] _WIN32 fix fstat() after close()
[core] quiet coverity warning
[mod_openssl] FreeBSD: check “kern.ipc.tls.enable”
[core] fix HTTP/2 use of http_response_loop()
[mod_openssl] check kernel support for KTLS
[core] posix_spawnattr_setcwd_np() on QNX
[core] posix_spawn_file_actions_addclosefrom_np()
[core] Mac OS POSIX_SPAWN_CLOEXEC_DEFAULT
[core] modify use of posix_spawnattr_setsigdefault
[mod_dirlisting] _WIN32 compile fix
[core] fdevent_load_file() check if limit exceeded
[tests] tests/prepare.sh comment w/ alt build root
[core] treat mod_h2 as built-in module (for now)

1.4.69

gstrauss — Fri, 10 Feb 2023 00:00:00 +0000

Important changes¶

bugfixes, portability

Downloads¶

lighttpd-1.4.69.tar.gz (GPG signature)
- SHA256: 657010184c4c470ad98944abbf0a8e2281800fa2bb1836c7a2cd4a8874e97b28
lighttpd-1.4.69.tar.xz (GPG signature)
- SHA256: 16ac8db95e719629ba61949b99f8a26feba946a81d185215b28379bb4116b0b4
SHA256 checksums
SHA512 checksums

Future Scheduled Behavior Changes:¶

lighttpd 1.4.68 builds common modules into the lighttpd base executable.\ Separate dynamic modules are still built for the benefit of existing\ packaging scripts in various distributions, but those modules are not used.\ A future version of lighttpd will omit building separate modules for:\ mod_access mod_alias mod_evhost mod_expire mod_fastcgi mod_indexfile\ mod_redirect mod_rewrite mod_scgi mod_setenv mod_simple_vhost mod_staticfile

Changes from 1.4.68¶

[meson] remove t/test_mod_evasive.c
[doc] remove references to removed modules
[cmake] add doc/CMakeLists.txt to dist tar ball (#3181)
[meson] add meson.build to install man pages (fixes #3181)
[meson] fix typo in sbindir
[core] update ls-hpack
[cmake] remove -I/usr/include/mysql for mysql.h (#3181)
[cmake] add -DWITH_LUA_VERSION= to specify lua ver (#3181)
[cmake] use mysql_config cflags and ldflags (#3181)
[cmake] do not link with fam if inotify or kqueue
[TLS] fix spurious warning trace (fixes #3182)
[multiple] codespell: correct spelling in comments
[multiple] spelling: github action check-spelling
[lemon] upgrade LEMON parser to SQLite maint ver
[build] modify arguments to updated LEMON parser
[core] build configparser.y w/ -Werror workarounds
[lemon] fix -Wpendantic warnings for bad casts
[core] avoid accept4() on ARM unless detected
[cmake] use CMAKE_CURRENT_SOURCE_DIR
[cmake] SERVER_SRC variable
[multiple] quiet some coverity false positives
[cmake] use LIGHTTPD_MODULES_DIR as relative path (fixes #3185)
[core] add missed h2 state transition (fixes #3186)
[core] remove cygwin O_NOFOLLOW workaround
[multiple] clang -Wstrict-prototypes for C2x
[core] reset SIGUSR1 to SIG_DFL before execve()
[mod_webdav] modify OPTIONS response if no db cfg
[mod_webdav] MOD_WEBDAV_BUILD_MINIMAL preproc opt
[core] pass fdn to fdevent_sched_close,_unregister
[core] disable sendfile() on TARGET_OS_IPHONE
[core] iOS does not provide netinet/tcp_fsm.h
[core] move headers to help isolate fdevent layer
[core] avoid select() FD_ISSET repeat on active fds
[core] gw_backend more precise backend env alloc
[core] fdevent_poll_poll avoid potential race
[tests] quickly exit tests/request.t if GET / fail
[tests] adjust outdated opt in tests/lighttpd.conf
[autotools] add mod_evhost to static build list
[autotools] skip modules build if LIGHTTPD_STATIC
[mod_cgi] cygwin supports CGI file I/O redirection
[mod_dirlisting] use fdevent_rename() wrapper
[core] path-info in debug trace may be unset
[core] reset path-info for cgi.local-redir
[autotools] fix typo in -I used —with-pcre2=/path (fixes #3190)
[mod_webdav] send 409 Conflict if PUT miss parent
[core] fix HTTP/2 HEADERS frame parsing bug
[core] remove extra HTTP/2 HEADERS frame len check

1.4.68

gstrauss — Tue, 03 Jan 2023 00:00:00 +0000

Important changes¶

stronger TLS defaults (as previously announced)
KTLS sendfile in mod_openssl and mod_gnutls, if available and enabled
removal of deprecated modules

Behavior Changes (previously announced)¶

TLS modules now default to using stronger, modern ciphers and will default to allow client preference in selecting ciphers.\ Allowing client preference in selecting ciphers is safe to do along with restrictions to use modern ciphers supporting PFS, and is better for mobile users without AES hardware acceleration.
Legacy ciphers can still be configured in lighttpd.conf using `ssl.openssl.ssl-conf-cmd`, as long as the ciphers are supported by the underlying TLS libraries.
Also see https://wiki.lighttpd.net/Docs_SSL
- new defaults:
  - "CipherString" => "EECDH+AESGCM:AES256+EECDH:CHACHA20:!SHA1:!SHA256:!SHA384"
  - "Options" => "-ServerPreference"
- old defaults:
  - "CipherString" => "HIGH"
  - "Options" => "ServerPreference"
Deprecated TLS options have been removed.
- ssl.honor-cipher-order
- ssl.dh-file
- ssl.ec-curve
- ssl.disable-client-renegotiation
- ssl.use-sslv2
- ssl.use-sslv3
See https://wiki.lighttpd.net/Docs_SSL for replacements with ssl.openssl.ssl-conf-cmd, but prefer lighttpd defaults instead.
Continue gradual deprecation of “mini-application” lighttpd modules for which mod_magnet lua implementations are better and more flexible.
Please post on lighttpd forums to share feedback if you use these modules.
Forums: https://redmine.lighttpd.net/projects/lighttpd/boards
Deprecated: mod_evasive has been removed.
mod_evasive can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_evasive https://wiki.lighttpd.net/AbsoLUAtion#Fight-DDoS https://wiki.lighttpd.net/AbsoLUAtion#Mod_Security
Deprecated: mod_secdownload has been removed.
mod_secdownload can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_secdownload
mod_secdownload historically uses insecure MD5 though SHA1, SHA256 available
Deprecated: mod_uploadprogress has been removed.
mod_uploadprogress can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_uploadprogress
Deprecated: mod_usertrack has been removed. mod_usertrack can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_usertrack
mod_usertrack historically uses insecure MD5.

Behavior Changes (not previously announced)¶

meson build: some opts have changed from type: ‘boolean’ to type: ‘feature’; build scripts using -D with_example=true or =false need to change some opts to =enabled, =disabled, or =auto
mod_magnet: removed experimental lighty.r.req_attr[“response.*“] accessors (added in lighttpd 1.4.56 (2020) and replaced in lighttpd 1.4.65 (2022)) (see lighty.r.req_item.http_status and lighty.r.resp_body.* replacements)
remove libev fdevent option (ignore)
lighttpd directly uses native OS event handlers

Future Scheduled Behavior Changes¶

lighttpd 1.4.68 builds common modules into the lighttpd base executable.
Separate dynamic modules are still built for the benefit of existing packaging scripts in various distributions, but those modules are not used.
A future version of lighttpd will omit building separate modules for:
mod_access mod_alias mod_evhost mod_expire mod_fastcgi mod_indexfile mod_redirect mod_rewrite mod_scgi mod_setenv mod_simple_vhost mod_staticfile

Downloads¶

lighttpd-1.4.68.tar.gz (GPG signature)
- SHA256: fa8515297cfa7273cf84be8c8d312d26ec272e28b41022f7dcb8ccef02a99c78
lighttpd-1.4.68.tar.xz (GPG signature)
- SHA256: e56f37ae52b63e1ada4d76ce78005affb6e56eea2f6bdb0ce17d6d36e9583384
SHA256 checksums
SHA512 checksums

Changes from 1.4.67¶

[cmake] compile lemon with native cc for x-compile
[cmake] install man pages with CMake
[cmake] let CMake handle the version number
[cmake] set LIGHTTPD_VERSION_ID per version
[meson] set LIGHTTPD_VERSION_ID per version
[meson] add missing meson_version
[meson] use feature options
[meson] turn pcre into a combo option
[meson] simplify header checking
[meson] add wrapdb instructions
[lighttpd-angel] waitpid after HUP before restart
[core] use inotify_init() if missing IN_* defines
[core] keep sockets w/ server.graceful-restart-bg
[TLS] ssl.openssl.ssl-conf-cmd “DHParameters”
[mod_wolfssl] check for cert must_staple
[mod_mbedtls] config renegotiation;not recommended
[mod_alias] fix typo in config error message
[mod_proxy,mod_cgi] fix dummy Sec-WebSocket-Key
[mod_wolfssl] cast to fix compile error
[TLS] try DER format if reading PEM format fails
[mod_openssl] libressl 3.6.0 ASN1_TIME_cmp_time_t
[mod_deflate] skip cache for Cache-Control: private,no-store
[mod_webdav] minor cleanups and adjustments
[core] http_response_body_clear clears body flags
[core] ignore server.max-worker = 1
[doc/scripts/cert-staple.sh] *BSD date portability
[doc/scripts/cert-staple.sh] short-circuit checks
[doc/scripts/cert-staple.sh] add copyright header
[meson] fix wrong array
[meson] replace most has_function calls with loop
[meson] use non string true/false
[meson] use files()
[meson] remove use of non-existent win32 xgetopt.c
[meson] update comment for opts w/ type ‘feature’
[core] fix crash for invalid lighttpd.conf (fixes #3175)
[build] do not check for pthread.h
[cmake] use find_package() to include the PkgConfig module
[cmake] use GNUInstallDirs to set defaults for several directories
[cmake] use FindOpenSSL cmake module to search for OpenSSL
[cmake] remove wolfssl code that would already be handled by CMake
[cmake] improve searching for PostgreSQL
[cmake] remove needless arguments from xconfig macro
[cmake] prefer libpcre.pc over pcre-config
[cmake] use CMake’s provided FindZLIB
[cmake] use CMake’s provided FindBZip2
[cmake] remove path hints where CMake searches by default
[cmake] remove use of non-existent win32 xgetopt.c
[mod_openssl] mod_openssl_write_err() shared code
[mod_openssl] use SSL_sendfile() if KTLS available
[mod_gnutls] use gnutls_record_send_file() if KTLS
[TLS] handle ‘+’ on ssl-conf-cmd “Options”
[TLS] upgrade default cipher list to stronger set
[TLS] simplify TLS config; remove deprecated opts
[multiple] remove deprecated modules
[mod_magnet] remove lighty.r.req_attr[“response.*“]
[core] remove libev fdevent option (ignore)
[core] _WIN32 impl of plugins_load()
[core] check for built-in plugins before dlopen
[core] build core modules into lighttpd executable
[core] reduce M_TOP_PAD to default on small system
[multiple] mark mod_*_plugin_init() funcs cold
[core] check ifndef NDEBUG before setting NDEBUG
[core] server_main_setup_signals() separate func
[core] server_main_setup_workers() separate func
[core] server_main_setup() variable scoping
[core] ck_calloc() ck_malloc() ck_realloc_u32()
[multiple] employ ck_realloc_u32() shared code
[core] mark gw_proc_free() cold
[core] use data_config_list for config
[build] omit unused vector.[ch] from build
[mod_wstunnel] store value in tmp before byteswap
[core] log_buffer_vsprintf tweaks
[multiple] employ ck_calloc, ck_malloc shared code
[core] create non-inlined vector_resize()
[lighttpd-angel] remove unused includes
[core] chunk.c tweaks
[core] config_check_cond_nocache_eval() tweak
[mod_openssl] CLOSE_NOTIFY handling with KTLS
[mod_wolfssl] match mod_openssl CLOSE_NOTIFY
[core] ignore config dir-listing.* if not enabled
[doc] default lighttpd.conf: omit server.use-ipv6
[lighttpd-angel] simplify
[tests] disable auth.delay-invalid-creds for tests
[mod_deflate] “deflate” should include zlib header
[tests] fix “deflate” tests for added zlib header
[tests] disable Nagle on client, remove sleeps
[core] save ptr to avoid static analyzer realloc warn
[core] wrap server_main_setup_workers w/ HAVE_FORK
[core] temporarily disable O_NOFOLLOW on Cygwin

1.4.67

gstrauss — Sat, 17 Sep 2022 00:00:00 +0000

Important changes¶

bugfixes

Future Scheduled Behavior Changes¶

TLS modules will default to using stronger, modern ciphers and will default to allow client preference in selecting ciphers. Allowing client preference in selecting ciphers is safe to do along with restrictions to use modern ciphers supporting PFS, and is better for mobile users without AES hardware acceleration. Legacy ciphers can still be configured in lighttpd.conf using ssl.openssl.ssl-conf-cmd, as long as the ciphers are supported by the underlying TLS libraries.
https://wiki.lighttpd.net/Docs_SSL
- new defaults:
  - "CipherString" => "EECDH+AESGCM:AES256+EECDH:CHACHA20:!SHA1:!SHA256:!SHA384"
  - "Options" => "-ServerPreference"
- old defaults:
  - "CipherString" => "HIGH"
  - "Options" => "ServerPreference"
Deprecated TLS options will be removed.
- ssl.honor-cipher-order
- ssl.dh-file
- ssl.ec-curve
- ssl.disable-client-renegotiation
- ssl.use-sslv2
- ssl.use-sslv3
See https://wiki.lighttpd.net/Docs_SSL for replacements with ssl.openssl.ssl-conf-cmd, but prefer lighttpd defaults instead.
Continue gradual deprecation of “mini-application” lighttpd modules for which mod_magnet lua implementations are better and more flexible.\ Please post on lighttpd forums to share feedback if you use these modules.
Forums: https://redmine.lighttpd.net/projects/lighttpd/boards
Deprecated: mod_evasive will be removed.
mod_evasive can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_evasive
https://wiki.lighttpd.net/AbsoLUAtion#Fight-DDoS
https://wiki.lighttpd.net/AbsoLUAtion#Mod_Security
Deprecated: mod_secdownload will be removed.
mod_secdownload can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_secdownload
mod_secdownload historically uses insecure MD5 though SHA1, SHA256 available
Deprecated: mod_uploadprogress will be removed.
mod_uploadprogress can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_uploadprogress
Deprecated: mod_usertrack will be removed.
mod_usertrack can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_usertrack
mod_usertrack historically uses insecure MD5.

Downloads¶

lighttpd-1.4.67.tar.gz (GPG signature)
- SHA256: de3c783a0ec3459e7e36a5ef08e13482d8640b339570dd036dfd456a6f7bb312
lighttpd-1.4.67.tar.xz (GPG signature)
- SHA256: 7e04d767f51a8d824b32e2483ef2950982920d427d1272ef4667f49d6f89f358
SHA256 checksums
SHA512 checksums

Changes from 1.4.66¶

Update comment about TCP_INFO on OpenBSD
[mod_ajp13] fix crash with bad response headers (fixes #3170)
[core] handle RDHUP when collecting chunked body
[core] tweak streaming request body to backends
[core] handle ENOSPC with pwritev() (#3171)
[core] manually calculate off_t max (fixes #3171)
[autoconf] force large file support (#3171)
[multiple] quiet coverity warnings using casts
[meson] add license keyword to project declaration

1.4.66

gstrauss — Sun, 07 Aug 2022 00:00:00 +0000

Important changes¶

bugfixes

Future Scheduled Behavior Changes¶

TLS modules will default to using stronger, modern ciphers and will default to allow client preference in selecting ciphers. Allowing client preference in selecting ciphers is safe to do along with restrictions to use modern ciphers supporting PFS, and is better for mobile users without AES hardware acceleration. Legacy ciphers can still be configured in lighttpd.conf using ssl.openssl.ssl-conf-cmd, as long as the ciphers are supported by the underlying TLS libraries. https://wiki.lighttpd.net/Docs_SSL
- new defaults:
  - "CipherString" => "EECDH+AESGCM:AES256+EECDH:CHACHA20:!SHA1:!SHA256:!SHA384"
  - "Options" => "-ServerPreference"
- old defaults:
  - "CipherString" => "HIGH"
  - "Options" => "ServerPreference"
Deprecated TLS options will be removed.
- ssl.honor-cipher-order
- ssl.dh-file
- ssl.ec-curve
- ssl.disable-client-renegotiation
- ssl.use-sslv2
- ssl.use-sslv3
See https://wiki.lighttpd.net/Docs_SSL for replacements with ssl.openssl.ssl-conf-cmd, but prefer lighttpd defaults instead.
Continue gradual deprecation of “mini-application” lighttpd modules for which mod_magnet lua implementations are better and more flexible.
Please post on lighttpd forums to share feedback if you use these modules.
Forums: https://redmine.lighttpd.net/projects/lighttpd/boards
Deprecated: mod_evasive will be removed.
mod_evasive can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_evasive
https://wiki.lighttpd.net/AbsoLUAtion#Fight-DDoS
https://wiki.lighttpd.net/AbsoLUAtion#Mod_Security
Deprecated: mod_secdownload will be removed.
mod_secdownload can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_secdownload
mod_secdownload historically uses insecure MD5 though SHA1, SHA256 available
Deprecated: mod_uploadprogress will be removed.
mod_uploadprogress can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_uploadprogress
Deprecated: mod_usertrack will be removed.
mod_usertrack can be replaced by mod_magnet and a few lines of lua:
Replacement: https://wiki.lighttpd.net/ModMagnetExamples#lua-mod_usertrack
mod_usertrack historically uses insecure MD5.

Downloads¶

lighttpd-1.4.66.tar.gz (GPG signature)
- SHA256: d919c3f9031e2580b94b311a3749eaa1e3b4a6a57b2d5c4cbcad40c0a73a7200
lighttpd-1.4.66.tar.xz (GPG signature)
- SHA256: 47ac6e60271aa0196e65472d02d019556dc7c6d09df3b65df2c1ab6866348e3b
SHA256 checksums
SHA512 checksums

Changes from 1.4.65¶

[core] h2: optim: send window update in 16k units
[mod_magnet] reset for http-response-send-file
[multiple] fix json encoding
[core] buffer_append_bs_escaped_json()
[autoconf] update ax_prog_cc_for_build.m4
[doc] add libdeflate to INSTALL
[mod_webdav] cold func if xml reqbody w/o db conf
[mod_webdav] check reqbody Content-Type is XML
[doc] more consistent use of vars in examples
[core] do not load indexfile, dirlisting if unused
[mod_dirlisting] send ETag, Cache-Control w/ cache
[mod_openssl] compile compat w/ openssl \< 1.1.0
[mod_webdav] webdav_reqbody_type_xml() fixes
[core] clarify server.username = “root” error msg
[mod_wolfssl] compat with older wolfssl versions
[core] fix li_base64_dec() on whitespace
[core] perf tweak buffer_eq_icase_ssn()
[mod_deflate] fix use of libdeflate for files>128k (fixes #3161)
[core] fix buffer_substr_replace() extend (fixes #3160)
[mod_webdav] build with Android NDK
[core] check r->http_status before handling Range
[core] preprocessor option to force crypto lib
[core] fix SIGUSR1 graceful restart w/ TLS (fixes #3164)
[mod_authn_gssapi] warn if no confidentiality flag (fixes #3163)
[mod_wstunnel] fix crash with bad hybivers (fixes #3165)
[core] perf: adjust max h2 stream send increment
[core] fix HTTP/2 downloads >= 4GiB (fixes #3166)