Dnevnik sprememb

Izdano 15. julija 2026

• +Dodaja predpomnilnik, proxy in metapodatke izvlečka odziva, ki temeljijo na standardih izbire
• +Dokazuje pristnost ponovnega nalaganja posnetka v živo, povrnitve nazaj, preverjanja celovitosti in obstojnosti ponovnega zagona
• +Doda ponovljive dokaze FIPS-backend in široko utrjevanje izvornega časa delovanja

Izdano 14. julija 2026

• +Dodaja časovno omejeno nadzorovano dokončanje obstoječih povezav in predajo brez izpada, pogojeno s pripravljenostjo
• +Dodaja strogo aktivacijo vtičnic systemd z natančnim preverjanjem podedovanih poslušalnih vtičnic
• +Dokončuje utrjevanje razčlenjevalnika HTTP/1 in izboljšuje upravljanje lastništva storitev v ozadju

Izdano 13. julija 2026

• +Doda neobvezne varnostne profile odziva HTTP in preverjen CORS, ki podpira zahteve
• +Stabilizira izvedljive primere politike Wasm in teste, ki jih zahtevajo vrata za izdajo
• +Krepi posredovane glave identitete, razčlenjevanje glave in navodila za ponovni poskus za omejitve zmogljivosti

Izdano 12. julija 2026

• +doda primere migracij, ki jih je mogoče izvajati, za opravila pravilnika v slogu iRules, OpenResty, HAProxy/SPOE in VCL
• +doda omejen prenos ACME, razporejanje ARI, diagnostiko življenjskega cikla in izrecno sprejemanje pogojev
• +Okrepi obnovljive račune ACME in transakcije potrdil, meje shranjevanja in objavo posnetkov

Objavljeno 11. julija 2026

• +Začne z mejo opt-in WASI Preview 1 z eksplicitnimi dovoljenji za uro in naključnost ter zavrnitvijo privzeto uvoženih funkcij
• +Obnovi zaupanja vrednega GeoIP odjemalca in podpira kombinirane baze podatkov Country in ASN iz CIRCL
• +Močnejše varnostne meje za pretok SSRF in kopiranje, overjene posnetke, TLS, PHP-FPM, statično dostavo in omejitve Wasm virov

Izdano 10. julija 2026

• +Doda izbirni predogled ABI Proxy-Wasm z izrecnim preverjanjem imenskega prostora gostiteljskih klicev
• +Nepodprte klice predogleda deterministično zavrne, preden dosežejo izvorni strežnik
• +Utrdi strogo usmerjanje po gostitelju, omejen sprejem, zaupanje konfiguraciji, shrambo predpomnilnika, GeoIP in stiskanje

Izdano 9. julija 2026

• +Doda izrecne identitete prevedenih WebAssembly module po plugin digest, ABI, hook feature surface in različici Fluxheim
• +Doda admission proračune cache-hook za vsak vhost pod procesno zgornjo mejo cache-hook
• +Razširi omejene Wasm metrics, vidnost admin status in cross-family live-chain regression pokritost

Izdano 8. julija 2026

• +Doda omejene host calls za komponente cache-key za različice razreda naprave mobile in desktop
• +Doda fiksni cache-store TTL, tag in stored-header metadata brez poljubnega spreminjanja response-header
• +Doda pokritost live listener za izolacijo različic, range-cache slices, potek TTL in fail-closed omejitve metadata

Izdano 7. julija 2026

• +Doda žive native HTTP/1 Wasm hooke za cache-lookup in cache-store pod omejenim fluxheim_policy_v1 preview ABI
• +Doda rezultate cache za continue, pass, bypass, skip-store in deny brez razkrivanja surovih cache ključev, TTL-jev, tagov ali shranjenih metapodatkov
• +Loči admission omejitve cache-hookov in pri agregaciji cache-store ohrani pravilo most-restrictive-wins

Izdano 6. julija 2026

• +Doda žive native HTTP/1 route-decision Wasm hooke pod omejenim fluxheim_policy_v1 preview ABI
• +Doda simbolični izbor konfiguriranih vej za canary in mirror poti brez dinamičnega upstream ali shadow-target dostopa
• +Ohrani izvajanje Fluxheim ACL, rate-limit, concurrency, body-limit, redirect in header-policy po izbiri poti

Izdano 5. julija 2026

• +Doda žive native HTTP/1 Wasm hooke za request-header in response-header pri vhost in route priponkah
• +Ohrani header-hook ABI simboličen z dovoljenimi sintetičnimi mutacijami namesto surovega dostopa do headerjev ali bodyja
• +Uporabi vhost-level Wasm header-hooke in fallback response header policy za PHP-FPM fallback odgovore

Izdano 4. julija 2026

• +Poveže live native HTTP/1 access-decision hooke s prednostnim vrstnim redom, sestavo first-deny-wins in vedenjem fail-closed
• +Uveljavlja zgornje meje sprejema izvajanja na ravni procesa, plugina in attachmenta

Izdano 3. julija 2026

• +Doda izbirni workspace crate fluxheim-wasm
• +feature gatei wasm, wasm-proxy-abi in wasm-wasi so privzeto izklopljeni in nezdružljivi s privacy-mode
• +Datoteke vtičnikov Wasm se naložijo samo iz odobrenih absolutnih korenov; symlinki, neregularne datoteke in preveliki moduli so zavrnjeni
• +Tipizirani manifesti vtičnikov Wasm pred nalaganjem preverijo ABI, fazo, fail-mode, pot in omejitve sandboxa
• +Doda omejeno izvajanje Wasmtime z omejitvami za fuel, pomnilnik, tabelo, instanco, compile-timeout, compile-worker in watchdog na posamezen klic
• +Doda realno smoke pokritost sandboxa Wasm za uspešno izvajanje, trapse, zavrnitev rasti tabele in zavrnitev nevarnih fail-open manifestov

Izdano 30. junija 2026

• +Začasno prilagoditveno plast izvornega posredniškega strežnika preimenuje v native_proxy in iz običajnih gradenj odstrani stari ponovni izvoz za združljivost posredniškega strežnika.
• +DTO-je za skrbniške zahteve in rezultate izravnalnika obremenitve premakne v paket fluxheim-load-balancer.
• +Odstrani nedejavne korenske vmesnike iz obdobja Pingora in zastarelo onemogočeno kodo izvajalnih preizkusov, ki je običajne gradnje ne uporabljajo več.
• +Poenoti shranjevanje konfiguracije izvornega posredniškega strežnika, tako da ponovno nalaganje osveži isti posnetek, ki ga uporabljajo skrbniške poti predpomnilnika in izravnalnika obremenitve.
• +Doda regresijsko pokritost prekoračitve razčlenjenega telesa izvornega HTTP/1 in slike hitrih preizkusov opazljivosti pripne na določljive oznake.

Izdano 30. junija 2026

• +Ohranja običajni runtime na poteh Fluxheim-owned listener, TLS, HTTP/1, HTTP/2, WebSocket, cache, load-balancer, admin, metrics, stream in background service
• +Premakne piškotke auth, metrics, OpenBao cache, discovery, load-balancer in TLS private-key secret buffers proti sanitization crate
• +Okrepi nadomestno usmerjanje PHP-FPM/static, izvorno zaklepanje čiščenja disk-cache, serializacijo mutacij same-key disk-cache in izvorno upravljanje HTTP/2 upstream authority
• +Doda podporo za peer-fill shared-secret in jo zahteva za navadno besedilo non-loopback peer-fill URLs
• +Razširja pokritost testov privacy, observability, WordPress, load-balancer, smoke-image, randomized-port in release-gate za linijo stabilization

Izdano 29. junija 2026

• +Odstrani končni Pingora runtime/listener/TLS adapter crates iz običajnega Fluxheim build profiles
• +Ohranja izvorni proxy HTTP/1 in HTTP/2 runtime kot običajno pot za podprte konfiguracije route, cache, load-balancer, TLS, WebSocket, admin in metrics
• +Povezuje izvorno čiščenje admin cache, čiščenje diska stale cache, iskanje predmetov cache in obdelovalce statistike/mutacije load-balancer v živo z ročaji Fluxheim-owned runtime
• +Posodobitve vrat za izdajo dependency-policy, tako da normalne privzete, polne, robne, PHP, zasebnost, RPM, vir in gradnje vsebnika ne uspejo, če prevedejo Pingora crates
• +Okrepi izvorne predoglede in očiščenja admin cache z normaliziranim ujemanjem gostitelja, predogledi regex-route, izogibanjem zaklepanju čiščenja stale, stanjem konfiguracije v živo fail-closed in vnesenimi konteksti gradnje route-proxy

Izdano 29. junija 2026

• +Doda izvorno pariteto proxy-cache za pomnilnik, disk datotečnega sistema, storage-bin, šifriran disk, OpenBao Transit in memory+disk nivo
• +Podpira različici Vary in request-header, zastarelo strežbo, zaklepanje predpomnilnika, predpomnilnik rezine obsega, peer-fill in proračune za zaščito izvora
• +Okrepi sprejem predpomnilnika za Authorization, HEAD bypass, gorvodno odstranjevanje Age, preverjeno aritmetiko izteka in only-if-cached miss
• +Doda izvorno pariteto čiščenja predpomnilnika za indekse pomnilnika in diska ter natančne, množične, predpone, oznake, nadomestne znake, route-scope in zastarele čiščenja
• +Doda izvorno opazovanje predpomnilnika za posredniške števce, merilnike pomnilnika/diska, histograme iskanja predpomnilnika in regenerirane ID-je razpona traceparent

Izdano 28. junija 2026

• +Adds native runtime dispatch for proxy, admin, metrics, stream, UDP, and load-balancer refresh tasks
• +Adds metrics token-file loading with zeroizing storage and constant-time bearer-token checks
• +Adds native HTTP/1 proxy runtime startup for plaintext, rustls, OpenSSL, and trusted downstream PROXY protocol listeners
• +Usmeri izbrane downstream HTTP/2 TLS povezave v nativni multi-stream adapter
• +Utrdi nativne WebSocket nadgradnje, HTTP/2 stream-local napake, rate-limit sharding in zeroizing shranjevanje telesa zahtevka

Izdano 24. junija 2026

• +Moves cache request policy and local-static cache keys into the Pingora-independent fluxheim-cache crate
• +Moves PHP-FPM parsing, params, path mapping, static offload, error-page policy, and keep-alive pooling into fluxheim-php-fpm
• +Adds native memory local-static cache adapters for route and vhost static-web serving
• +Adds native upstream PROXY protocol v1/v2 send support and native Host router construction
• +Adds native runtime manifest and launch-plan evidence for services, listeners, background tasks, and policy rows

Objavljeno 23. junija 2026.

• +Premješta plaintext upstream HTTP/2 forwarding v native HTTP/1 proxy path za h2c/prior-knowledge origin
• +Dodaje pooled native upstream H2 connections s bounded stream capacity in safe-method retry nakon pre-response pooled-handle failure
• +Podržava TLS ALPN-negotiated upstream HTTP/2 s postojećom upstream TLS/SNI/CA policy
• +Dodaje eksplicitni, po defaultu isključeni h2c Upgrade fallback za plaintext http1-and-http2 origin
• +Ograničava native upstream H2 handshakes, stream-slot waits, keepalive pings in setup timeouts

Objavljeno 23. junija 2026.

• +Premakne inherited global/vhost compression policy v native HTTP/1 proxy in route proxy
• +Združi root/vhost/route header-policy inheritance v native route proxy construction
• +Premješta safe forwarded-client-IP ownership, trusted-chain append, regex rewrites, ACL, concurrency in rate limits na native path
• +Dodaje native ACME HTTP-01 challenge serving, traffic mirroring, auth-request in route-scoped gRPC validation

Objavljeno 21. junija 2026.

• +Moves route-level native response compression onto the HTTP/1 route proxy through fluxheim-compression
• +Moves proxy.error_pages onto native HTTP/1 proxy fallback strani podržane kroz fluxheim-web

Objavljeno 21. junija 2026.

• +Adds native HTTP/1 route static-web serving backed by fluxheim-web
• +Adds route request-header mutation, response rewrites, static upstream round-robin, and static upstream weights to the native route proxy

Objavljeno 21. junija 2026.

• +Adds native route redirect actions with safe {uri}, {path}, and {query} expansion
• +Moves route body limits and response-header overlays onto native HTTP/1 route proxy responses

Objavljeno 21. junija 2026.

• +Adds native HTTP/1 route-proxy execution for exact, prefix, and fallback routes with method filters and safe rewrite handling
• +Adds native-http1-proxy-candidate redove v runtime cutover evidence kako bi preostali compatibility blockers bili eksplicitni

Objavljeno 20. junija 2026.

• +Promiče native HTTP/2 downstream safety preview v cutover-ready nakon fokusiranih parity test
• +Čini representative native runtime cutover report blocker-free za jednostavne HTTP/1, HTTP/2, admin, metrics, stream in UDP konfiguracije

Objavljeno 20. junija 2026.

• +Cuts stream and UDP proxy service startup over to Fluxheim-owned native task boundaries
• +Adds cancellation-safe native shutdown waiting and abort-on-cancel background task joins

Objavljeno 20. junija 2026.

• +Starts native admin and metrics serving behind Fluxheim-owned server primitives
• +Utrdi nativne ročice opravil v ozadju, tako da odvržene kritične ročice prekinejo opravilo namesto tihega odklopa

Objavljeno 20. junija 2026.

• +Adds NativeBackgroundSupervisor za Fluxheim-owned background task orchestration
• +Adds critical task watchdog support and hardens shutdown delivery edge cases

Objavljeno 20. junija 2026.

• +Adds native runtime cutover evidence gates and fluxheim-config-tester --runtime-cutover
• +Moves remaining Pingora exception targets to a documented multi-release exit plan while keeping policy gates active

Objavljeno 19. junija 2026.

• +Adds explicit pingora-compat feature gating za preostali compatibility runtime boundary
• +Moves rustls/OpenSSL downstream TLS SNI, certificate storage, reload, PEM parsing, and native HTTP/1 TLS listener previews into Fluxheim-owned code

Objavljeno 19. junija 2026.

• +Nastavlja Pingora-exit slice smanjujući preostali root compatibility surface za proxy, cache in runtime paths
• +Dijeli native health checks v HTTP/gRPC, database, exec in TCP/TLS transport helper modules sa strožim probe bounds

Objavljeno 19. junija 2026.

• +Uklanja izravnu Pingora dependency iz fluxheim-load-balancer
• +Dodaje Fluxheim-owned bounded HTTP/1.1 in h2 gRPC active health checks s policy coverage za sprječavanje povratka Pingora

Objavljeno 19. junija 2026.

• +Dodaje native HTTP/1.1 proxy cutover readiness planning na ServerPlan
• +Fails closed za compatibility-only proxy features kot auth subrequests, mirroring, redirects, strip/rewriter transforms in advanced load-balancer policy

Objavljeno 18. junija 2026.

• +Dodaje Fluxheim-owned native HTTP/2 upstream client primitive s bounded headers, bodies, trailers in deadlines
• +Dodaje h2 client/server test za trailer preservation, oversized responses, stream resets in flow-control timeout behavior

Objavljeno 18. junija 2026.

• +Dodaje native rustls/OpenSSL upstream TLS in mTLS podršku v staged HTTP/1.1 proxy path
• +Dodaje ordered static upstream failover za safe methods plus bounded no-follow TLS material reads in hostname-policy coverage

Objavljeno 18. junija 2026.

• +Doda omejeno native HTTP/1.1 združevanje upstream povezav za origin odgovore z varnim content-length in brez bodyja
• +Dodaje keepalive pool sizing, upstream idle timeout handling, conservative no-reuse guards in real socket reuse/expiry tests

Objavljeno 18. junija 2026.

• +Dodaje reusable native HTTP/2 connection primitives s bounded request-body collection in response trailer support
• +Hardens HTTP/2 response lifetime, handler timeout, DATA capacity handling, prohibited headers/trailers in request-body zeroization

Objavljeno 17. junija 2026.

• +Dodaje native HTTP/2 runtime preview gater in h2 stack probe s bounded headers, URI, body, streams, frames, buffers in rapid reset policy
• +Dodaje HTTP/2 preview smoke coverage in proširuje native HTTP/1 behavior coverage za HTTP/1.0 keep-alive/close semantics

Objavljeno 17. junija 2026.

• +Doda omejen native HTTP/1 upstream klient in staged native proxy handler za plain statični upstream
• +Dodaje native proxy candidater inventory, Fluxheim-owned proxy headers, privacy-mode behavior in fail-closed eligibility za unsupported policy layers

Objavljeno 17. junija 2026.

• +Dodaje native HTTP/1 connection/listener runtime preko Tokio IO in staged native static-file adapter
• +Mapira server limits v native HTTP/1 policy in dodaje socket tests za keep-alive, body framing, shutdown, static files, slow clients in connection caps

Objavljeno 17. junija 2026.

• +Dodaje Fluxheim-owned HTTP/1.0/HTTP/1.1 request-head parsing, request-body framing classification, Host validation, persistence handling in chunked decoding
• +Dodaje downstream HTTP/1 policy defaults in hardened native parser boundaries za prihodnji runtime cutover work

Objavljeno 16. junija 2026.

• +Moves server bootstrap planning, listener inventory, service intent, background-task intent, HTTP/2 policy, PROXY protocol policy, and private Unix socket planning into fluxheim-server
• +Drži trenutni runtime kot eksplicitni compatibility adapter dok se nastavlja native server/listener work

Objavljeno 16. junija 2026.

• +Adds fluxheim-tls kot downstream TLS listener planning in provider-policy boundary
• +Moves TLS listener plans, SNI selection, wildcard matching, ALPN/cipher/curve policy, and rustls/OpenSSL provider checks into the TLS crate
• +Hardens TLS feature gates, SNI fallback behavior, PROXY v2 signature validation in trusted PROXY CIDR validation

Objavljeno 16. junija 2026.

• +Dodaje prvi namjenski fluxheim-headers boundary za header policy helpers
• +Premješta rewriter algorithms, forwarded-header handling, hop-by-hop request policy in repeated-header joining v Fluxheim-owned header code
• +Premješta stream PROXY protocol byte parsers u fluxheim-protocol and tightens privacy/proxy CIDR validation

Objavljeno 15. junija 2026.

• +Premješta shared background task lifecycle primitives u fluxheim-runtime
• +Moves OTLP metrics export, ACME certificate reload control, admin snapshot validation state, and rollback decisions into Fluxheim-owned runtime/snapshot code
• +Hardens local certificate reload control socket in privater backend filtering

Objavljeno 15. junija 2026.

• +Adds fluxheim-stream as the internal TCP stream proxy runtime boundary
• +Premješta stream upstream selection, PROXY protocol parsing/writing, source policy, DNS-rebinding guards, byte accounting in timeout handling iza Fluxheim-owned stream code

Objavljeno 14. junija 2026.

• +Moves cache key identity, object envelopes, disk index management, storage-bin helpers, tag handling, and cache storage interfaces into fluxheim-cache
• +Dodaje test in release gates koji enforced Pingora dependency removal targets tijekom normalnog cargo test izvođenja

Objavljeno 14. junija 2026.

• +Poganja prvo konkretno 1.6.x implementation release nakon foundation tag
• +Removes pingora-load-balancing/pingora-ketama from full and load-balancer image profiles, restores 1.6 load-balancer image builds, and moves TCP health checks plus request-key extraction behind Fluxheim-owned boundaries

Objavljeno 14. junija 2026.

• +Pokrenuta 1.6.x Pingora-exit foundation linija z nepromijenjen runtime behavior
• +Dodana modularity policy validation, legacy oversized-file exceptions, runtime baseline capture in performance evidence capture
• +Dodane release-gated Pingora dependency exceptions, runtime parity fixtures in extraction dependency graph
• +Added initial fluxheim-runtime and fluxheim-server boundary crates z tipizirane policy proof primitive

lipanj 2026.

• +Introduced the enterprise HTTP/TCP load-balancer line with focused binaries, images, runtime member and weight controls, persistence, health checks, queueing, and migration docs
• +Expanded Fluxheim-owned runtime boundaries across HTTP, stream proxying, load balancing, background tasks, cache interfaces, observability, config, and shared crates
• +Dodani managed affinity cookies, service discovery, active in protocol-aware health checks, restart-persistent stater in runtime backend mutation controls
• +Added UDP beta guardrails, cache origin-protection budgets, ARM/Linux and macOS developer assets, config tester archives, and broad proxy/cache/PHP-FPM security hardening

Objavljeno 25. maja 2026.

• +Production proxy parity release with trusted-proxy-aware ACLs, local rate limits, concurrency limits, bounded queues, and edge policy metrics
• +gzip, Zstandard, and Brotli response compression with vhost/route overrides and cache-safe Vary handling
• +Load-balancer resilience, TLS/protocol parity, PROXY protocol v1/v2, upstream mTLS, HTTP/2 controls in gRPC pass-through

Objavljeno 23. maja 2026.

• +Managed php-fpm process supervision under the existing php-fpm feature, while external php-fpm remains the default
• +Respawn watchdog, bounded backoff, SIGTERM-before-SIGKILL teardown, sanitized environment in privater generated pool state
• +Auditable [vhosts.php.fpm] mode = "managed" config surface za privater sockets, worker counts, process manager modes, slowlog, temp paths in pool files
• +Proširen WordPress PHP-FPM smoke coverage preko external, managed-static, managed-dynamic, managed-ondemand in managed-respawn modes
• +Recommended Wolfi PHP image now installs php-8.5-fpm and uses managed php-fpm container config by default

Objavljeno 23. maja 2026.

• +FIPS/ISO-required configs fail closed for unsupported internal cryptography, managed ACME, and local cache encryption
• +Provider-backed admin auth, numeric-local-loopback OTLP exception, and OpenBao Transit cache encryption evidence boundary
• +New compliance evidence template and release evidence package sections for regulated reviews

Objavljeno 22. maja 2026.

• +rustls/AWS-LC FIPS-capable candidater backend kroz tls-rustls-fips
• +FIPS in ISO/IEC 19790 rustls profile aliases, config examples, diagnostics in validation script

Objavljeno 21. maja 2026.

• +OpenSSL FIPS/ISO-capable TLS validation kroz tls-openssl-fips i provider diagnostics
• +FIPS deployment guide, config fixtures, validation script, release evidence in OWASP Top 10 2025 baseline

Objavljeno 20. maja 2026.

• +PHP-FPM keepalive pooling, upstream retry/failover in request body disk spooling za sigurniji rad pod opterećenjem
• +WordPress routing/cache preset plus PHP application recipes for common framework and forum deployments
• +PHP metrics in OpenTelemetry attributes, X-Accel-Redirect, X-Sendfile in X-Accel-Expires support

Objavljeno 18. maja 2026.

• +fluxheim-acme standalone companion binary za certificate renewal, status in ACME reload socket signalling
• +fluxheim-config-tester standalone binary za config validation v CI in kontejner entrypoint brez pokretanja gateway
• +ACME reload Unix socket — live certificate pickup brez gateway restart
• +Novi profile-php build profile — proxy + web + php-fpm + tls-rustls + security
• +Security hardening improvements across the request pipeline

Objavljeno 16. maja 2026.

• +Opt-in PHP-FPM FastCGI bridge for WordPress-style front-controller applications
• +Strict script resolution in bounded FastCGI request/response handling
• +Browser-validated WordPress proxy/PHP cookie compatibility fixes
• +PHP-FPM lahko servira static assets iz istega root, medtem ko route usmerja PHP v FPM.
• +New php-fpm Cargo feature (implies proxy profil and web)

Objavljeno 14. maja 2026.

• +Shared ingress/TLS feature-graph split — focused cache and proxy profiles are now TLS/ACME-capable
• +New profile-cache-edge — cache without static web module
• +New profile-proxy-edge — focused reverse proxy edge
• +Official focused container images for cache and proxy profiles

svibanj 2026.

2026

• + TLS policy profili
• + Multi-certificate rustls SNI
• + Managed ACME certificate issuance in renewal
• + EAB-capable issuers (Actalis in drugi)
• + File-backed TLS secret
• + acme-init guided issuer bootstrap alat
• + Paketirani certificate renewal systemd units

2026

• + Virtual host routing po Host header z default-vhost fallback
• + Route-level static, proxy, and redirect actions
• + Static file serving with MIME detection, ETag, conditional 304, byte ranges
• + Whole-vhost and route-level reverse proxying
• + rustls TLS with SNI, static/bought certificate support
• + Varno posredovanje ACME HTTP-01 challenge
• + Admin control-plane with bearer-token auth and brute-force throttling
• + Secure request/response header policy pravila
• + Opcionalno HTTP→HTTPS preusmjeravanje sa sigurnom Host provjerom
• + Systemd unit in RPM packaging
• + Rootless Podman container images