github.com-cloudflare-pingora

Upgrade body mode on 101 Previously the body reader would initialize to HTTP/1.0 mode when the upgrade request header is found. Now the reader is only converted to that mode when both the upgrade header and 101 is received.

Fix chunked trailer end parsing httparse itself does not treat the terminating chunk (0 + CRLF) any differently when parsing its chunk size, and the body reader does not validate the following CRLF required to close the body. Additionally, that current parsing scheme will not consider trailers before the end CRLF. Now the trailers are considered but simply discarded. The CRLFs between the trailers (and now, the CRLFs after the body payloads) are validated, however.

make Lru::shard_weight a lock-free read Add a per-shard atomic shadow of total weight (shard_weights: [AtomicUsize; N]) maintained alongside the existing global weight counter at every weight-mutating site (admit, increment_weight, evict_shard_at, remove, insert_tail). Rewrite Lru::shard_weight() to read from the shadow with a Relaxed load instead of acquiring the shard's RwLock to read the LruUnit::used_weight field. This mirrors the pattern already established for shard_lens/shard_len(). Like shard_len(), the same 'best-effort, no cross-thread ordering' caveat applies: the sum of shard_weight(i) is not guaranteed to equal weight() at any single instant, since the global and per-shard atomics are updated independently with Relaxed ordering. Motivation: callers (eviction-balance heuristics, observability) that want to scan all N shards every few seconds should not pay N brief read-lock acquisitions when an atomic shadow is cheap enough to maintain on the write path. Adds a single-threaded regression test verifying the shadow stays consistent with the truth across all five weight-mutating paths.

Subrequest sessions, clear body headers if no input Subrequests are now a separate server Session type, instantiated with corresponding SubrequestHandles that can send or receive HttpTasks to or from the subrequest. This makes it possible to communicate with created subrequests. Additionally the subrequest ctx now has a BodyMode input. If unset the background subrequest will clear request headers related to the request body to prevent issues where the upstream might expect body.

Share health across load-balancing selectors Add grouped selectors with asynchronous bounded rebuilds and shared active health across backend views.

handle upstream task-pipe closure on early downstream finish When a response bypasses cache (no cache writer) and the downstream half completes the response by its own framing (e.g. a range or Content-Length shorter than the upstream stream) before the upstream signals end-of-stream, it drops the task pipe. The upstream half's send then fails; previously that surfaced a spurious InternalError ("channel closed") and tore the upstream connection down, even though the client already received a correct response. Add a shared PipeState (Active / DownstreamComplete) that the downstream half sets before it returns and the upstream half checks at every task-pipe closure point: the body, trailer, and end-of-stream sends, and the HTTP/2 closed-pipe and trailer-race early exits. A closure is treated as benign only when the downstream signaled completion; an unexpected closure still surfaces an error. Applied consistently across HTTP/1, HTTP/2, and custom transports. On the benign HTTP/1 path, reuse is left to the loop's normal exit, which marks the upstream connection reusable only when both the response was fully read and the request was fully sent. A premature response can leave the request half-sent, so the connection must not be pooled on response completion alone.

Add cancel-safe body and header writer primitives Add BodyWriter task API (send_body_task, write_current_body_task, send_finish_task, write_current_finish_task) and HeaderWriter for cancel-safe writes that can be used in tokio::select! loops.

transfer-encoding parsing robustness

Add cancel-safe proxy task API for Subrequest server sessions Implement the same proxy task API functionality for subrequest server sessions as HTTP/1. Also fix the regular subrequest header write path so upgrade state is only marked after the 101 task is sent.

Year 2026

Avoid close delimit mode on http/1.0 req RFC9112 is now extra explicit about the close delimiting applying exclusively to response messages for HTTP/1.0. Also disables reuse explicitly when close delimiting on the response side as defense-in-depth that shouldn't have behavioral diff.

Validate invalid content-length on v1 resp by default Rejecting bad upstream content-length by default to avoid forwarding ambiguously framed messages. An option still exists to allow this in the peer options, if needed, and treat these responses as close-delimited though this is non-RFC-compliant. The content-length is now also removed on the response if transfer-encoding is present, per RFC.

Discard extra upstream body and disable keepalive Explicitly disable keepalive on upstream connection when excess body (content-length) is detected.

Add snapshot readiness for selectors

Add a system for specifying and using service-level dependencies

Default to close on downstream response before body finish For v1, this represents a safe default to prevent the next request after an unfinished request write from appearing as and being rejected as a pipelined request on the same connection.

Sanitize hop-by-hop headers on HTTP upstream requests Add configurable HTTP upstream request-header policy with standards-oriented defaults and explicit legacy compatibility modes. Strip hop-by-hop and Connection-nominated fields by default, reject sensitive nominations, normalize supported WebSocket upgrades, and prevent inconsistent 101 tunnel transitions. Finalize HTTP/1 request framing after application upstream filters: preserve explicit outgoing framing and synthesize chunked encoding for remaining non-empty unframed bodies. Apply related sanitization to HTTP/2-bound requests and add integration coverage for framing, upgrades, protected nominations, and compatibility settings.

Reject invalid content-length v1 requests If a content-length is present RFC9112 indicates we must reject invalid forms of that content-length header. This eliminates situations where we might be dealing with ambiguous request framing.

Don't init body reader on HEAD 1xx This prevents headers like 100-continue from ending the stream and causing hangs while the downstream is waiting.

Mark previously too large chunked assets as cacheable Too large assets without content-length could previously be skipped as uncacheable indefinitely by the cacheable predictor. This change moves the max file size tracking outside of the miss handler itself such that it can also be used to track body bytes after caching was disabled. This also adjusts the cache inner structs such that cache key and the cacheable predictor are accessible, so that an asset can be remembered as cacheable even if caching was disabled. Additional safeguards are also in place to ensure that the NeverEnabled reason is not overridden when disabling cache, as it does not make sense to disable cache when it was never enabled in the first place.