Dear hakkers,
we — the Akka HTTP committers — are happy to announce Akka Http 10.0.6, which is the sixth release of the Akka Http 10.0 series. It contains an important security fix for a vulnerability that affects all Akka HTTP applications that use the Akka HTTP routing DSL. The vulnerability allows a remote attacker to crash an Akka HTTP server with a simple request leading to a denial of service. It is highly recommended to update to Akka HTTP 10.0.6 as soon as possible. See the security announcement for more details.
Please subscribe to the akka-security mailing list to be notified promptly about future security issues.
This update also contains several maintenance fixes and improvements as detailed below.
Compatibility notes
This version is compatible with Akka 2.4.x as well as the current 2.5.1, so we encourage you to use Akka 2.5 with this version, as the new completely redesigned materializer in Akka Streams can result in various performance and memory usage improvements across the board.
If you want to use Akka HTTP together with Akka 2.5.1 make sure to include a dependency to akka-stream 2.5.1 and not only to akka-actor 2.5.1 (otherwise, your app may fail at runtime because of incompatibilities between a 2.4.x version of akka-stream and a 2.5.x version of akka-actor).
Akka 10.0.x is backwards binary compatible with previous 10.0.x releases and Akka 2.4.x. This means that the new JARs are a drop-in replacement for the old one (but not the other way around) as long as your build does not enable the inliner (Scala-only restriction). It should be noted that Scala 2.12.x is is not binary compatible with Scala 2.11.x.
Notable changes:
Improvements
akka-http-core
- Make response parser more relaxed on accepting status line without reason message (#981)
- Use media type parameters in content negotiation (#963)
- Small performance improvements (#999, #1032)
- Added
HttpMessage.transformEntityDataBytes
(#771) - Allow binding server with HTTP/2 support via configuration flag with
Http().bindAndHandleAsync
(#463)
akka-http
- Make marshaller composition more lazy to prevent redundant marshalling when using
Marshaller.oneOf
(#1019) - Allow Java-implemented ContentTypeResolver (#360)
- Java DSL routing
complete
now has override that takesResponseEntity
as a parameter instead ofRequestEntity
(#982) - Improved usage and documentation of Encoder / Decoder on the Scala and Java side (#771)
akka-http2-support
- Refactoring: move handling of per-stream frames to dedicated state handlers (#1064)
Documentation
- Provide Decoding Response example for Java (#760)
- Add Java example to extract header value with default value (#639)
- Add HTTP custom method example (#954)
- Smaller fixes and additions
Build + Infrastructure
- Add OSGi to project in order to release each project with OSGi bundle headers (#574)
- Rename root project to ‘akka-http-root’ (#1030)
Bug Fixes
akka-http-core
- Ignore unsupported
*/xyz
media types (#1072) - Exclude port when rendering X-Forwarded-For and X-Real-Ip headers (#440)
- Fix NPE when accessing static Java constant fields (#936)
- Make sure pool log messages have “PoolGateway” set as logClass for easier filtering (#1013)
akka-http
- Move special non-2xx handling from RequestContextImpl to fromStatusCodeAndHeadersAndValue marshaller (#1072)
- Handle failure while parsing the URI in parameter extraction (#1043)
- Make
extractStrictEntity
provide strict entity for inner routes (#961) - Enable javadsl to unmarshal with default
ExecutionContext
(#967) - Smaller fixes for
HttpApp
akka-http2-support
- Fix memory leak in ALPN switcher (#886)
Credits
A total 50 issues were closed since 10.0.5.
The complete list of closed issues can be found on the 10.0.6 milestones on github.
For this release we had the help of 14 contributors – thank you all very much!
Credits:
commits added removed
16 581 104 Konrad `ktoso` Malawski
13 320 93 Josep Prat
10 464 210 Johannes Rudolph
5 119 30 Arnout Engelen
4 131 44 Jonas Fonseca
4 37 13 Bartłomiej Tomala
3 102 13 michael-smith
2 3 3 Barnabás Oláh
1 39 8 Jan Ypma
1 21 9 Aurélien Thieriot
1 21 1 Richard S. Imaoka
1 19 2 Hugh
1 6 4 Patrik Nordwall
1 1 1 MiR
Happy hakking!
– The Akka Team