Amphp Http Versions Save

What's Changed

• Security: Fix Denial of Service via HTTP/2 CONTINUATION Frames by @kelunik

References

• https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm
• https://kb.cert.org/vuls/id/421644

Full Changelog: https://github.com/amphp/http/compare/v2.1.0...2.1.1

What's Changed

• Security: Fix Denial of Service via HTTP/2 CONTINUATION Frames by @kelunik

References

• https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm
• https://kb.cert.org/vuls/id/421644

Full Changelog: https://github.com/amphp/http/compare/v1.7.2...v1.7.3

What's Changed

• Make implicit nullable types explicit by @nicolas-grekas in https://github.com/amphp/http/pull/28

Full Changelog: https://github.com/amphp/http/compare/v1.7.1...v1.7.2

• Updated league/uri-components requirements to ^2.4.2 | ^7.1 as part of fixing #24 and allow psr/message@v2
• Changed request query string encoding to use RFC3986 rules to as part of fixing #24

Full Changelog: https://github.com/amphp/http/compare/v2.0.0...v2.1.0

• PHP 8.1 is now required
• Renamed Status and Message to HttpStatus and HttpMessage respectively
• Added a message parameter to Http2Processor::handleShutdown()
• Http2Parser constructor now requires an HPack instance to be injected, as well as providing parameters for upgrade settings, header size limit, and frame size limits
• Http2Parser::parse() was removed; Http2Parser now has a push() and cancel() methods to push received data and end parsing
• Added HttpRequest and HttpResponse as abstract base classes for requests and responses
• HttpRequest now includes methods for getting and setting query parameters
• Moved Rfc7230 to Http1 sub-namespace.
• Renamed header methods using the term "raw" to use "pairs" instead, e.g., getRawHeaders() → getHeaderPairs(), parseRawHeaders() → parseHeaderPairs()
• Added mapHeaderPairs() function to convert header pairs returned from functions such as Rfc7230::parseHeaderPairs() into a map similar to that returned by Rfc7230::parseHeaders()
• Passing an int, float, or Stringable as an array value to HttpMessage::setHeaders() will cast the value to a string instead of throwing a TypeError
• Removed parseFieldValueComponents() and createFieldValueComponentMap(), replacing them with four new functions:
  • splitHeaders() — Splits comma-separated fields into individual components. Returns null if a syntax error is encountered.
  • parseMultipleHeaderFields() — Parses a list of key-value pairs from each comma-separated and semi-colon delineated header value. Returns null if a syntax error is encountered.
  • parseSingleHeaderFields() — Parses a single semi-colon delineated header into key-value pairs.
  • parseHeaderTokens() — Parses a list of tokens from comma-separated header values.

Removed parseFieldValueComponents() and createFieldValueComponentMap(), replacing them with three new functions:

• splitHeaders() — Splits comma-separated fields into individual components. Returns null if a syntax error is encountered.
• parseMultipleHeaderFields() — Parses a list of key-value pairs from each comma-separated and semi-colon delineated header value. Returns null if a syntax error is encountered.
• parseSingleHeaderFields() — Parses a single semi-colon delineated header into key-value pairs.

• Added HttpRequest and HttpResponse as abstract base classes for requests and responses. HttpRequest includes methods for getting and setting query parameters
• Moved Rfc7230 to Http1 sub-namespace.
• Renamed header methods using the term "raw" to use "pairs" instead, e.g., getRawHeaders() → getHeaderPairs(), parseRawHeaders() → parseHeaderPairs()
• Added convertHeaderPairsToMap() function to convert header pairs returned from functions such as Rfc7230::parseHeaderPairs() into a map similar to that returned by Rfc7230::parseHeaders().
• Passing an int, float, or Stringable as an array value to HttpMessage::setHeaders() will cast the value to a string instead of throwing a TypeError.

• PHP 8.1 is now required
• Renamed Status and Message to HttpStatus and HttpMessage respectively. Aliases of the old names to the new names exist in this beta version, but may be removed before the stable release
• Added a message parameter to Http2Processor::handleShutdown()
• Http2Parser constructor now requires an HPack instance to be injected, as well as providing parameters for upgrade settings, header size limit, and frame size limits
• Http2Parser::parse() was removed; Http2Parser now has a push() and cancel() methods to push received data and end parsing

• Fixed header validation regex to allow names containing *, +, and . (#19)

• Expose frame and byte count metrics in Http2Parser
• Reduce strtolower calls, improving performance
• Relax parsing strictness for request cookies to ignore empty trailing semicolons (https://github.com/amphp/http/pull/18)