cloudflare/pingora 0.9.0 on GitHub

0.9.0 - 2026-09-04

Reworked connection pooling with sharded storage and a true global LRU, addressing stale entries and race windows.
Added an upstream module system that applies before upstream compression.
More handling of HTTP parsing and framing edge cases, including non-origin-form request-target preservation, and hop-by-hop header sanitization, obsolete line-fold normalization, stricter request-target validation, and bounded default HTTP/2 limits.
Split Prometheus integration into the pingora-prometheus crate and made Prometheus optional.
Improved graceful shutdown and upgrade behavior, including responsive load-balancer shutdown, descriptor lifecycle fixes, and lower shutdown-notification contention.

Minimum supported Rust version moves to 1.85 for some crates. pingora-foundations declares an MSRV of 1.88.
RequestHeader and ResponseHeader no longer implement DerefMut because unrestricted mutation could violate internal invariants.
Removed async_write_vec APIs; consumers should use tokio::io::AsyncWriteExt::write_all_buf.
Prometheus integration moved from pingora-core to the separate pingora-prometheus crate; Prometheus is optional.
tracing is now optional in pingora-cache.
Upgraded to the boring-rs 5.x API.
PeerOptions::curve now uses Cow.
Upstream requests strip hop-by-hop and Connection-nominated headers by default; legacy behavior requires explicit compatibility settings.
Default HTTP/2 server limits are bounded rather than unbounded.
Removed the unused LruShard Default implementation and lifted Default bounds on sharded cache structures.
Removed the CacheKey namespace parameter.
PurgeOutcome enum gains an Expired variant.
ForcedFreshness and hit-status reporting gain ForceExpiredServeStale variant.

Add abort-on-close session configurability.
Support HTTP/1.1 downstream request pipelining.
Add cancel-safe body and header writer primitives (proxy tasks) to prevent stalled cache misses from applying backpressure.
Add an upstream module system and allow modules to adjust after receiving upstream response headers.
Add proxy warning-log suppression hooks.
Add keepalive-pool callbacks for tracking connection ages.
Expose HTTP/1.x request-body bytes accepted by the upstream writer.
Report point-in-time available HTTP/2 stream capacity.

Add ability to configure an offload thread pool for downstream TLS handshakes.
Add Acceptor::from_server_config for runtime-built rustls ServerConfig values and in-memory key material.
Export TLS keying material, including from pingora-s2n.
Add per-peer CA configuration.
Add a pre-TLS callback for PROXY protocol support.
Expose the rustls certificate type.
Add curve and second-keyshare settings to HttpPeer hashing.
Avoid compiling aws-lc-rs when the ring provider is selected.

Allow sharing backends across load-balancing selectors.
Add graceful-upgrade signalling between old and new processes.
Add per-listener L4 buffer configuration and socket send/receive buffer settings.
Add Tokio blocking-pool configuration, poll-time histograms, and an alternative timer runtime knob.
Allow proxy services to override runtime options.
Add a working-directory option for daemon mode.
Enable adding user context between sessions on the same connection with HttpPersistentSettings.
Add socket-cookie access and TCP/TLS establishment timing fields.
Make HTTP/2 stream and connection windows configurable.

Add deferred cache-admission policy hooks.
Implement DCZ dictionary compression and vary on available-dictionary.
Add CacheMeta freshness updates and expiration-at-time support.
Support optionally flooring fractional delta-seconds for RFC 9111 handling.
Preserve Vary provenance across stale refreshes.
Make cache-lock retries configurable and bounded.
Add an opt-in purge mode that expires an asset while retaining its body for conditional revalidation and stale serving.
Use power-of-two selection for eviction balancing.
Add peek_lru, update_or_admit, and non-promoting set_weight operations in lru.
Allow adjusting LRU weight limits and reserving capacity.

HTTP ambiguity hardening: centralize raw request-target classification so path and authority validation share one parser; reject ambiguous request authorities on ingress and egress; reject forbidden CR/LF bytes in HTTP/2 :path; and reject delimiter bytes in request lines as defense in depth.
Sanitize hop-by-hop upstream request headers.
Preserve non-origin-form request targets without mangling the URI.
Normalize forwarded responses with obsolete HTTP/1.1 response-header line folding.
Bound default HTTP/2 server limits to reduce memory-exhaustion exposure.
Avoid a process abort while appending oversized header maps by returning an InvalidHTTPHeader error.
Fix some unchecked integer conversions.
Explicitly prevent reuse of HTTP/1 connections after incomplete responses.
Update Prometheus for a security advisory.
Replaced unmaintained daemonize crate with daemonix and updated nix to 0.31.x.

Fix connection-pool and PoolNode race windows and remove empty entries.
Fixed a potential stall on HTTP/1 response-header reads upon forwarding request bodies via a cancel safety fix.
Stop waiting on HTTP/2 upstream work after the downstream ends and close timed-out HTTP/2 connections.
Drain in-flight HTTP/2 streams during shutdown and retry stream creation on a fresh connection when appropriate.
Prevent HTTP/1 upstream reuse after failed writes or incomplete responses.
Discard retry buffers after truncation and avoid unnecessary HTTP/2 accept allocations.
Skip h2c preface detection on TLS streams.
Do not initialize a body reader for HEAD informational responses.
Correct HTTP/1 session body-byte accounting.
Fix listener-fd inheritance and close transfer sockets during graceful upgrade; mark received listener fds close-on-exec.
Remove the duplicate graceful-shutdown sleep and improve load-balancer shutdown responsiveness.
Shard proxy shutdown notifications to reduce lock contention and close a lost-wakeup race during graceful shutdown.

pingora-timeout now uses Tokio timeouts for (configurably) long intervals to avoid memory accumulation.
Split pingora-prometheus into a separate crate.
Forward WriteBuf::chunks_vectored to the wrapped buffer.
Replace custom ASCII-trimming helpers with stabilized standard-library methods.
Update the MSRV lane and use cargo check for MSRV validation.
Improve documentation examples for connection tracing and basic setup.
Preserve bound ports in digests after TLS failures.
Return an error for divergent multipart cache progress and remove a panic from maybe_cache_meta.
Various flaky test fixes.