lighttpd 1.4.71

http/2 support will be split out into optional separate module (mod_h2)
(static builds will need to list mod_h2 in plugin-static.h to include mod_h2)

speed up CGI spawning
native Windows build (experimental) (not packaged; no installer)
support HTTP/2 downstream proxy serving multiple clients on single connection
(mod_extforward, mod_maxminddb)
restructure code to isolate HTTP/2

Update comment about TCP_INFO on OpenBSD
[mod_ajp13] fix crash with bad response headers
[core] handle RDHUP when collecting chunked body
[core] tweak streaming request body to backends
[core] handle ENOSPC with pwritev()
[core] manually calculate off_t max
[autoconf] force large file support
[multiple] quiet coverity warnings using casts
[meson] add license keyword to project declaration

Update comment about TCP_INFO on OpenBSD
[mod_ajp13] fix crash with bad response headers
[core] handle RDHUP when collecting chunked body
[core] tweak streaming request body to backends
[core] handle ENOSPC with pwritev()
[core] manually calculate off_t max
[autoconf] force large file support
[multiple] quiet coverity warnings using casts
[meson] add license keyword to project declaration

WebSockets over HTTP/2
RFC 8441 Bootstrapping WebSockets with HTTP/2
HTTP/2 PRIORITY_UPDATE
RFC 9218 Extensible Prioritization Scheme for HTTP
prefix/suffix conditions in lighttpd.conf
mod_webdav safe partial-PUT
webdav.opts += (“partial-put-copy-modify” => “enable”)
mod_accesslog option: accesslog.escaping = “json”
mod_deflate libdeflate build option
speed up request body uploads via HTTP/2

graceful restart/shutdown timeout changed from 0 (disabled) to 8 seconds
configure an alternative with:
server.feature-flags += (“server.graceful-shutdown-timeout” => 8)
build: lighttpd defaults to —with-pcre2 instead of —with-pcre
pcre2 is current. pcre is no longer maintained.
Explicitly specify —with-pcre in build to use pcre instead of pcre2.
deprecated modules (previously announced) have been removed
mod_authn_mysql
mod_mysql_vhost
mod_cml
mod_flv_streaming
mod_geoip
mod_trigger_b4_dl
https://wiki.lighttpd.net/Docs_ConfigurationOptions#Deprecated
suggests migration steps for replacements, if needed

[core] import xxHash v0.8.1
[core] isolate use of sys/filio.h
[core] fix reqpool mem corruption in 1.4.62

[mod_alias] fix use-after-free bug (fixes #3114)
[core] clean up fdlog_st and log_error_st decls
[core] ‘struct log_error_st’ ? ‘log_error_st’
[core] remove redundant asserts
[core] explicitly include sys/cdefs.h
[tests] t/test_mod_ssi
[core] fdevent_socket_nb_cloexec_init()
[core] fdevent_impl.c separate from fdevent.c
[core] merge fdevent impls into fdevent_impl.c
[core] fdevent_fdnode.c separate from fdevent.c
[core] close backend socket fds more quickly
[core] use TCP_CORK w/ TLS if cq length > 16k
[core] warn if dynamic modules before mod_auth
[mod_cgi] check fd-to-cgi not -1 before close
[core] libev EV_ERROR conflicts with kqueue
[tests] disable test_mod_ssi in cmake (temporary)
[tests] disable test_mod_ssi in cmake (temporary)
[tests] reenable test_mod_ssi in cmake
[core] run plugin cleanup hooks in reverse
[core] fix removal of server.pid-file when testing (fixes #3115)
[doc] improve sample configs
[doc] expand vhosts.template
[doc] improve sample configs
[core] use ck_assert() in vector.[ch]
[tests] mod_ssi tests moved to src/t/test_mod_ssi
[mod_ssi] 0-init ssi_val_t in ssi_ctx_t
[mod_ssi] fix ancient bugs; replace cond parser
[mod_ssi] remove mod_ssi parser generator file
[mod_ssi] merge mod_ssi_expr.c into mod_ssi.c
[core] uint_fast32_t tweaks
[core] better asm for binary num to ascii string
[tests] t/test_mod now runs all t/test_mod_*.c
[tests] t/test_mod_alias.c
[tests] remove unused mod from tests/lighttpd.conf
[mod_evasive] smaller funcs for testing
[tests] t/test_mod_evasive.c
[mod_evasive] update comment to add references
[tests] combine tests into test_common.c
[core] get_http_method_key() tweak
[mod_dirlisting] check for disabled cache at start
[core] buffer_append_string_encoded_json()
[mod_dirlisting] (experimental) json (disabled)
[tests] t/test_mod needs -ldl on Debian
[core] save config regex captures only if used
[core] save pcre result state in config_pcre_match
[core] use stack w/ pcre_exec unless save captures
[core] extend pcre_keyvalue_ctx to pass more state
[core] pcre2 support (—with-pcre2)
[core] allocate one fewer cond_match_t, if needed
[core] allocate pcre output vector on demand
[build] configure.ac with AC_PROG_CC_C99 (fixes #3116)
[build] CI builds now use pcre2 (upgrade pcre)
[core] fix compiler warning in 32-bit build
[build] fix CMake pcre2 detection
[mod_auth] RFC7616 HTTP Digest username* userhash
[mod_dirlisting] fix bug not showing HEADER.txt
[tests] t/test_mod_ssi adjust to follow symlinks
[mod_auth] quiet coverity warning
[doc] refresh/update dependency lists in doc
[core] fix crash when using lighttpd -1 with pipes (fixes #3117)

Future Scheduled Behavior Changes (estimated early 2022)
graceful restart/shutdown default timeout will change from
0 (infinite/no timeout) to 5 seconds (or some similar non-zero period)
configure an alternative with:
server.feature-flags += (“server.graceful-shutdown-timeout” => 5)
lighttpd (optional) dependencies on libev and on FAM are deprecated.
lighttpd event loop and file monitoring use native OS interfaces
except on obscure platforms. FAM and gamin appear to be abandoned.
Package maintainers on Linux and *BSD:
please remove —with-libev and —with-fam from package builds
lighttpd uses epoll() on Linux, kqueue() on *BSD for event notification.
lighttpd uses inotify() on Linux, kqueue() on *BSD for file monitoring.
https://wiki.lighttpd.net/Docs_ConfigurationOptions#Deprecated

mod_compress is DEPRECATED; use mod_deflate
mod_compress has been subsumed by mod_deflate
Note: mod_compress config options may be removed in a future release
mod_geoip is DEPRECATED; use mod_maxminddb
Note: mod_geoip will be removed from a future lighttpd release
mod_authn_mysql is DEPRECATED; use mod_authn_dbi
Note: mod_authn_mysql will be removed from a future lighttpd release
mod_mysql_vhost is DEPRECATED; use mod_vhostdb_dbi or mod_vhostdb_mysql
Note: mod_mysql_vhost will be removed from a future lighttpd release
mod_cml is DEPRECATED; use mod_magnet
Note: mod_cml will be removed from a future lighttpd release
mod_flv_streaming is DEPRECATED; (Adobe Flash Video (.flv))
(Note: can be replaced with a few lines of lua code and mod_magnet)
(sample script flv-streaming.lua is posted at
https://redmine.lighttpd.net/projects/lighttpd/wiki/ModMagnetExamples )
Adobe Flash is deprecated and support has been removed from modern clients
Changes from 1.4.60
[core] define __BEGIN_DECLS, __END_DECLS if needed
[core] Y2038: error log high-precision timestamps
[multiple] attribute_nonnull now takes params
[core] bounds check while url-decoding
[mod_magnet] prefer lua_newuserdatauv() w/ lua 5.4
[core] earlier macOS need define for errno_t (fixes #3107)
[tests] force POSIX::WNOHANG
[mod_dirlisting] sort “../” to top (fixes #3109)
[tests] force Fcntl::F_SETFD() autovivification (#3110)
[core] avoid repeated typedef for fdlog_st
[doc] update INSTALL
[mod_extforward] keep remote IP thru request reset
[core] fix HTTP/2 upload > 64k w/ max-request-size (fixes #3108)
[mod_auth] fix Basic auth passwd cache (fixes #3112)
[mod_ajp13,mod_fastcgi] comment: no response body
[mod_webdav] ignore PROPFIND Depth for files
[core] add comment to ck_memeq_const_time()
[core] accept up to 5 digit port num in host cond
[core] expose chunkqueue_remove_empty_chunks()
[core] short-circuit if response body recv w/ hdrs (fixes #3111)
[core] resched HTTP/2 streams w/ pending data (#3111)
[core] separate func for gw_authorizer_ok()
[core] make ck_memeq_const_time() more generic (#3112)
[mod_auth] revert adjustment to auth passwd cache (#3112)
[core] thwart h2c smuggling when Upgrade enabled
[core] separate funcs to check for valid chars
[core] thwart h2 request tunnelling
[core] clear shared log buffer after writes
[mod_nss] quiet trace for PR_END_OF_FILE_ERROR
[core] allow debug.log-state-handling in condition
[core] combine more dup header processing code
[mod_ajp13,mod_fastcgi] check resp w/ content len
[mod_proxy] Length Req if proxy forcing HTTP/1.0
[core] restart dead proc on connect error if local
[mod_ajp13,mod_fastcgi] recv_parse smaller funcs
[multiple] warn deprecated mods slated for removal
[core] remove redundant checks in same context
[core] tighten chunkqueue_steal* code; better asm
[build] check for preadv(), pwritev()
[core] pwritev w/ chunkqueue_steal_with_tempfiles
[core] tighten chunkqueue_mark_written; better asm
[doc] uncomment mod_auth load in conf.d/auth.conf
[core] tighten chunkqueue_small_resp_optim()
[core] chunkqueue_small_resp_optim if resp < 16k
[mod_auth] clear crypt() output if len >= 13
[multiple] add assert after malloc in two spots
[core] add HTTP/2 check resp finished w/ empty cq (#3111)
[core] chunkqueue_small_resp_optim() comment