News§
Most recent updates (to get them automatically, subscribe to our RSS feed):
Unit 1.37.0 Released §
Byte-range and conditional requests for static files; certificate replacement without a restart; hardening of the messages between Unit's processes; Accept-Encoding negotiation fixes; a --hardening configure option. Five advisories: GHSA-qjcm-mqc4-83p5, GHSA-r8gw-f8h9-vc5q, GHSA-pr6c-9w58-qw6g, GHSA-33mh-v5x6-3vj4 and GHSA-46w9-v4vj-9w35.
Unit 1.36.1 Released §
Peer-message hardening across the port protocol; chunked trailers and response-length correctness; OpenTelemetry export health in /status and a leaner traced request path; session tickets fixed on no-deprecated builds; OpenSSL 1.1.1 floor and 4.0 support.
Unit 1.36.0 Released §
Security and correctness hardening — config NUL/empty rejection, rootfs mount TOCTOU, proxy response-smuggling, libunit/Java bounds; SIGQUIT graceful stop; wasmtime 36. Two advisories: GHSA-768w-qrh2-jjvh and GHSA-g6v8-r577-76jm.
Unit 1.35.5 Released §
Promote chunked_transform out of experimental (auto-convert chunked request bodies to Content-Length); fix a TLS SSL_write busy-loop on peer close; plug cert/script-store and port-machinery memory/fd leaks; upgrade njs to 0.9.8.
Unit 1.35.4 Released §
Fix router CPU spin and connection hang under port scanning load; reduce default HTTP keep-alive idle_timeout to 30s.
Unit 1.35.3 Released §
Migrate contrib mirror to packages.freeunit.org; upgrade njs to 0.9.6, libunit-wasm to 0.5.0, wasmtime to 43; add Java 17 and 21; eliminate QEMU for ARM64 CI builds; bump Rust to 1.94.1.
Unit 1.35.2 Released §
Bug-fix release — PHP workers in TrueAsync mode now shut down cleanly on quit signal; fix builds against PHP versions without pre_request_init; fix Ruby clang-ast CI on debian:testing.
You can also browse our archives: