Feersum-1.507

Changes for version 1.507 - 2026-09-25

New:
multiple server instances (new_instance) and multiple listeners per instance, IPv6 among them
TLS 1.3 via picotls+openssl: per-listener certificates, SNI vhosts
HTTP/2 via nghttp2: multiplexing, streaming, extended CONNECT (RFC 8441), rapid-reset (CVE-2023-44487) and ping-flood (CVE-2019-9512) protection
PROXY protocol v1/v2, including TLVs
reverse_proxy mode: take client_address and url_scheme from X-Forwarded-For/-Proto behind a trusted upstream; off by default
SO_REUSEPORT, sendfile
timeouts and limits: header_timeout, write_timeout, linger_timeout, max_connections, max_body_len, max_uri_len, max_read_buf, max_accept_per_loop, max_h2_concurrent_streams, max_h2_conn_body, wbuf_low_water
introspection: active_conns, total_requests, access_log, pause_accept/resume_accept, set_psgix_io
psgix.h2.trailers, psgix.h2.extended_connect, psgix.h2.protocol, psgix.proxy_tlvs
psgi.input gains getline, getlines and <$fh>
Feersum::Runner: hot_restart, preload_app, daemonize, pid_file, user/group, after_fork, access_log, graceful_timeout, startup_timeout, max_requests_per_worker
bin/feersum native mode with full Runner option parity
Incompatible with 1.505:
requires Perl 5.14 (was 5.8.7)
the Feersum object is no longer a hashref; use the public API
psgix.input.buffered is no longer advertised (psgi.input is forward-only; Plack buffers the body when it is unset)
a UTF8-flagged response string whose characters all fit in a byte is sent as those bytes, like every other PSGI server
a 1xx final status is refused (101 excepted); a status above 599 answers 500
CR or LF in the status line, and a control character in a response header (a tab is allowed in a value), are refused (CWE-113)
psgi.input is always present, per PSGI 1.1
a graceful stop, worker retirement and hot-restart handover exit via POSIX::_exit: END blocks do not run and buffered STDOUT is lost (set $| = 1 or log to STDERR)
See the UPGRADING section in the docs for behaviour changes that bite with no code change (tighter default limits among them).