dunglas/mercure v1.0.4

on GitHub

Community

Mercure 1.0.4 fixes a memory regression in 1.0.3. Since Caddy 2.11.7, encode compresses Server-Sent Events responses, and each compressed stream keeps its own encoder, several MiB, for as long as the subscriber stays connected. On hubs with many subscribers, memory use grew a lot after upgrading. The default Caddyfile no longer compresses the subscription endpoint, so the Docker images and the Helm chart are fixed by upgrading. If you maintain your own Caddyfile, apply the change below.

⚠️ Upgrade Notes

• Custom Caddyfiles using encode: exclude the SSE endpoint. Compressing private updates in the same stream as data an attacker can influence also enables BREACH-style attacks.

  @compressible not path /.well-known/mercure
  encode @compressible zstd gzip

• dispatch_timeout: Caddy's new write_idle timeout (1 minute by default) overrides it until caddyserver/caddy#8145 is released. To keep slow subscribers bounded by dispatch_timeout, set servers { timeouts { write_idle 5s } }.

🐛 Bug Fixes

• Caddyfile: don't compress the SSE endpoint, and document the trade-off and the write_idle workaround. by @dunglas in #1418

Enterprise

Mercure Enterprise picks up the same fix in image v1.0.4. Mercure Cloud hubs are upgraded automatically: use Mercure Cloud to get fixes like this one without managing upgrades yourself.

Enterprise releases ship under the Enterprise SLA, with prioritized patches and direct support. Contact contact@mercure.rocks for the managed Cloud offering, on-premise licenses, custom development, consulting, and training.

Full Changelog: v1.0.3...v1.0.4