Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release/v1.7.0 #1207

Open
wants to merge 76 commits into
base: master
Choose a base branch
from
Open

Release/v1.7.0 #1207

wants to merge 76 commits into from

Conversation

clarinette9
Copy link
Collaborator

merge v1.7.0 into master, in order to release 1.7.0

kwanhur and others added 30 commits December 29, 2024 15:24
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: suhang <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: kwanhur <[email protected]>
Signed-off-by: Song Jian <[email protected]>
pheianox and others added 24 commits December 29, 2024 15:24
Signed-off-by: Benjamin <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.0.0-20211216021012-1d35b9e2eb4e to 0.1.0.
- [Release notes](https://github.com/golang/sys/releases)
- [Commits](https://github.com/golang/sys/commits/v0.1.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: liangchuan <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: liangchuan <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: liangchuan <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: liangchuan <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Maintaining HPACK state requires that we parse and process all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, we don't allocate memory to store the excess headers but we do parse them. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

Set a limit on the amount of excess header frames we will process before closing a connection.

This is CVE-2023-45288 and Go issue https://go.dev/issue/65051.

Signed-off-by: Song Jian <[email protected]>
Replace go compile args to TARGETOS and TARGETARCH to support multiarch compile

Signed-off-by: Allen Chen <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Fix broken unit tests

Signed-off-by: Song Jian <[email protected]>
Remove duplicated code lint workflow

Signed-off-by: Sijie Yang <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Signed-off-by: xuleiming <[email protected]>
Signed-off-by: Song Jian <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.