Release Info¶

• Version: 1.4.62
• Previous version: 1.4.61
• Branch: 1.4
• Status: stable
• Release Purpose: bug fixes
• Release manager: gstrauss
• Released date: 2021-12-01

Important changes from 1.4.61¶

• support pcre2; HTTP Digest auth userhash; bugfixes

Downloads¶

• https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.62.tar.gz
  • GPG signature: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.62.tar.gz.asc
  • SHA256: aa695d506a87c6aa7b54a66bdb5a07653e800c95da9af3188661430e65a15c4f
• https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.62.tar.xz
  • GPG signature: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.62.tar.xz.asc
  • SHA256: 36cf483cf34a06f7c75c724a4237d8779b0d88ce208a1742763793d317114ab7
• SHA256 checksums: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.62.sha256sum

FUTURE SCHEDULED BEHAVIOR CHANGES (estimated Jan 2022):¶

• graceful restart/shutdown default timeout will change from
  0 (infinite/no timeout) to 5 seconds (or some similar non-zero period)
  configure an alternative with:
  server.feature-flags += ("server.graceful-shutdown-timeout" => 5)
• lighttpd (optional) dependencies on libev and on FAM are deprecated.
  lighttpd event loop and file monitoring use native OS interfaces
  except on obscure platforms. FAM and gamin appear to be abandoned.
  Package maintainers on Linux and *BSD:
  please remove --with-libev and --with-fam from package builds
  lighttpd uses epoll() on Linux, kqueue() on *BSD for event notification.
  lighttpd uses inotify() on Linux, kqueue() on *BSD for file monitoring.
• lighttpd will default to --with-pcre2 instead of --with-pcre
  pcre2 is current. pcre is no longer maintained.
  Explicitly specify --with-pcre in build to use pcre instead of pcre2.

https://wiki.lighttpd.net/Docs_ConfigurationOptions#Deprecated

• mod_compress is DEPRECATED; use mod_deflate
  mod_compress has been subsumed by mod_deflate
  Note: mod_compress config options may be removed in a future release
• mod_geoip is DEPRECATED; use mod_maxminddb
  Note: mod_geoip will be removed from a future lighttpd release
• mod_authn_mysql is DEPRECATED; use mod_authn_dbi
  Note: mod_authn_mysql will be removed from a future lighttpd release
• mod_mysql_vhost is DEPRECATED; use mod_vhostdb_dbi or mod_vhostdb_mysql
  Note: mod_mysql_vhost will be removed from a future lighttpd release
• mod_cml is DEPRECATED; use mod_magnet
  Note: mod_cml will be removed from a future lighttpd release
• mod_flv_streaming is DEPRECATED; (Adobe Flash Video (.flv))
  Note: mod_flv_streaming will be removed from a future lighttpd release
  (Note: can be replaced with a few lines of lua code and mod_magnet)
  (sample script flv-streaming.lua is posted at
  https://redmine.lighttpd.net/projects/lighttpd/wiki/ModMagnetExamples )
  Adobe Flash is deprecated and support has been removed from modern clients
• mod_trigger_b4_dl is DEPRECATED; use mod_magnet
  Note: mod_trigger_b4_dl will be removed from a future lighttpd release
  (Note: can be replaced with a few lines of lua code and mod_magnet)
  (sample script mod_trigger_b4_dl.lua is posted at
  https://redmine.lighttpd.net/projects/lighttpd/wiki/ModMagnetExamples )

Changes from 1.4.61¶

• [mod_alias] fix use-after-free bug (fixes #3114)
• [core] clean up fdlog_st and log_error_st decls
• [core] 'struct log_error_st' -> 'log_error_st'
• [core] remove redundant asserts
• [core] explicitly include sys/cdefs.h
• [tests] t/test_mod_ssi
• [core] fdevent_socket_nb_cloexec_init()
• [core] fdevent_impl.c separate from fdevent.c
• [core] merge fdevent impls into fdevent_impl.c
• [core] fdevent_fdnode.c separate from fdevent.c
• [core] close backend socket fds more quickly
• [core] use TCP_CORK w/ TLS if cq length > 16k
• [core] warn if dynamic modules before mod_auth
• [mod_cgi] check fd-to-cgi not -1 before close
• [core] libev EV_ERROR conflicts with kqueue
• [tests] disable test_mod_ssi in cmake (temporary)
• [tests] disable test_mod_ssi in cmake (temporary)
• [tests] reenable test_mod_ssi in cmake
• [core] run plugin cleanup hooks in reverse
• [core] fix removal of server.pid-file when testing (fixes #3115)
• [doc] improve sample configs
• [doc] expand vhosts.template
• [doc] improve sample configs
• [core] use ck_assert() in vector.[ch]
• [tests] mod_ssi tests moved to src/t/test_mod_ssi
• [mod_ssi] 0-init ssi_val_t in ssi_ctx_t
• [mod_ssi] fix ancient bugs; replace cond parser
• [mod_ssi] remove mod_ssi parser generator file
• [mod_ssi] merge mod_ssi_expr.c into mod_ssi.c
• [core] uint_fast32_t tweaks
• [core] better asm for binary num to ascii string
• [tests] t/test_mod now runs all t/test_mod_*.c
• [tests] t/test_mod_alias.c
• [tests] remove unused mod from tests/lighttpd.conf
• [mod_evasive] smaller funcs for testing
• [tests] t/test_mod_evasive.c
• [mod_evasive] update comment to add references
• [tests] combine tests into test_common.c
• [core] get_http_method_key() tweak
• [mod_dirlisting] check for disabled cache at start
• [core] buffer_append_string_encoded_json()
• [mod_dirlisting] (experimental) json (disabled)
• [tests] t/test_mod needs -ldl on Debian
• [core] save config regex captures only if used
• [core] save pcre result state in config_pcre_match
• [core] use stack w/ pcre_exec unless save captures
• [core] extend pcre_keyvalue_ctx to pass more state
• [core] pcre2 support (--with-pcre2)
• [core] allocate one fewer cond_match_t, if needed
• [core] allocate pcre output vector on demand
• [build] configure.ac with AC_PROG_CC_C99 (fixes #3116)
• [build] CI builds now use pcre2 (upgrade pcre)
• [core] fix compiler warning in 32-bit build
• [build] fix CMake pcre2 detection
• [mod_auth] RFC7616 HTTP Digest username* userhash
• [mod_dirlisting] fix bug not showing HEADER.txt
• [tests] t/test_mod_ssi adjust to follow symlinks
• [mod_auth] quiet coverity warning
• [doc] refresh/update dependency lists in doc
• [core] fix crash when using lighttpd -1 with pipes (fixes #3117)

External references¶

• https://www.lighttpd.net/2021/12/1/1.4.62