0.20.0 (2026-07-27)
release
- prepare 0.20.0 (e3abdac)
Bug Fixes
- accumulate last_buf across the whole output chain (ad8d7bc)
- accumulate last_buf across the whole output chain (9eb8a2a)
- align non-delayed body intervention teardown with finalize path (1b0a60f)
- always set intervention_triggered when an intervention fires (2b8d1f4)
- always set intervention_triggered when an intervention fires (0d66632)
- bound delayed-header buffering on uninspected file-backed streams (145ce04)
- bound delayed-header buffering on uninspected file-backed streams (39c0f6d)
- cap delayed response-body buffering to bound worker memory (03691ca)
- cap delayed response-body buffering to bound worker memory (da34c4c)
- clear entity headers on synthesized redirects (c8ed380)
- clear entity headers on synthesized redirects (0c2163b)
- config: compile-probe libcoraza result enum via auto/feature (fabb8bb)
- coraza_transaction_id takes exactly one argument (81358c7)
- coraza_transaction_id takes exactly one argument (bce33c8)
- dedup body chunk length calc via shared helper (955fa99)
- detect libcoraza result enum via config, not #ifdef on an enum member (309ea3e)
- do not synthesize Connection/Keep-Alive for the WAF on HTTP/2 (5dbcdb7)
- do not synthesize Connection/Keep-Alive for the WAF on HTTP/2 (74ac2aa)
- don't delay HEAD response headers (062fd57)
- don't delay HEAD response headers (f7f65a3)
- don't delay response headers for SSE streams (#81) (dc49612)
- don't delay response headers for SSE streams (#81) (099f587)
- drop unused Coraza dl symbols (c1c0481)
- drop unused Coraza dl symbols (07eae2d)
- fail closed on NGX_ERROR from the intervention handler (34aeb08)
- fail closed on NGX_ERROR from the intervention handler (f4e5194)
- fail closed when body-phase processing fails in Coraza (770fb29)
- fail closed when body-phase processing fails in Coraza (6cbfd48)
- fail closed when request-body submission to Coraza fails (6b46045)
- fail closed when request-body submission to Coraza fails (28a3e73)
- fail closed when response-body submission to Coraza fails (2fd2605)
- fail closed when response-body submission to Coraza fails (426a51b)
- fall back to per-header path when bulk submission fails (a4d6323)
- free transaction when cleanup registration fails (2c5d782)
- fuzz: empty input yields a valid pointer, not NULL (8d4dda8)
- gate phase-4 finalize on per-buffer last_buf, not the sticky flag (5bbe7ae)
- guard h2/h3 forbidden headers by http_version, not r->stream (cc38a6b)
- guard size_t to int narrowing at the Coraza cgo boundary (ff47fd4)
- guard size_t to int narrowing at the Coraza cgo boundary (34987d4)
- harden bulk-header dl contract and drop stale docs/decl (a192f8a)
- keep libcoraza loaded for worker lifetime (056e7b3)
- keep libcoraza loaded for worker lifetime (f5bd4c7)
- keep the per-buffer last_buf test separate from the chain-wide one (f71f0b2)
- omit NUL from synthetic server header (c27575d)
- omit NUL from synthetic server header (6edbace)
- propagate delayed header filter status (acf18c0)
- propagate delayed header filter status (5c4be30)
- propagate response header insert failures (3a14a41)
- propagate response header insert failures (11916db)
- reject oversized response-body chunks before read, set intervention flag (d151590)
- remove linker path from include flags (f864842)
- remove linker path from include flags (89a7a5f)
- remove stale sanity check build traps (d29279f)
- remove stale sanity check build traps (589785b)
- report HTTP/3 protocol version to the WAF (0e052b1)
- report HTTP/3 protocol version to the WAF (3f5747f)
- report HTTP/3 response protocol to the WAF, not just the request (2170fce)
- report REQUEST_PROTOCOL in slash-delimited form (9123a61)
- require libcoraza 1.4 ABI (2492a2a)
- require libcoraza 1.4 ABI (ff2181b)
- require valid file pointer before replaying file buffer (9fc0a19)
- return empty C string for empty ngx_str (f8a76b0)
- return empty C string for empty ngx_str (7abb251)
- slash-delimited RESPONSE_PROTOCOL and phase:3 response-protocol rule (ee3858a)
- use != 0 not < 0 to detect request-body submission failure (4408b0c)
- use ngx_http_clear_accept_ranges to clear Accept-Ranges (4ef52a9)
- validate transaction handle and transaction_id copy in create_ctx (a0abfc6)
- validate transaction handle and transaction_id copy in create_ctx (478a81e)
Performance Improvements
- add coraza_delay_response_headers directive (2afa451)
- avoid copying uninspected file response buffers (735d715)
- avoid copying uninspected file response buffers (7c2bb44)
- drop redundant ctx lookup and strlen rescan on the hot path (6c0a100)
- make response body header delay configurable (a42e606)
- reduce per-request CGO crossings on the hot path (f9e881b)
- skip always-NULL and OK-path intervention polls (5a522c1)
- submit request/response headers to Coraza in one cgo call (c055b09)