1.4.82

Important changes

• restrict request trailers to configured list; bugfixes

BEHAVIOR CHANGES:

• trailers in request headers will be ignored unless allowed field names are explicitly configured in a comma-separated list containing no spaces:

  server.feature-flags += ("request.trailer-whitelist" => "...")
  

  This changes behavior from lighttpd 1.4.80, which added support for request trailers and header merging, but did not restrict request trailers.

Downloads

• lighttpd-1.4.82.tar.gz (GPG signature)
  • SHA256: 4f07f2d61ee8d136d105d9a62f139a46ad8216fe9e346476ee5340f87bcabd79
• lighttpd-1.4.82.tar.xz (GPG signature)
  • SHA256: abfe74391f9cbd66ab154ea07e64f194dbe7e906ef4ed47eb3b0f3b46246c962
• SHA256 checksums
• SHA512 checksums

Changes from 1.4.81

• [core] restrict request trailers to configured list
• [core] fix logic inversion in “toupper:” modifier
• [mod_redirect,mod_rewrite] ${url.authority.noport} token
• [cmake,mod_mbedtls] mbedx509 mbedcrypto order
• [mod_mbedtls] psa_crypto_init() for MBEDTLS_USE_PSA_CRYPTO (fixes #3288)
• [build] mod_mbedtls: use tfpsacrypto if found
• [ci] Bump actions/checkout from 4 to 5
• [core] avoid chunk mem reallocation on read/recv