Version 3.0.0 - 2026-10-10

Avoid Windows DLL shutdown hangs by retaining the default timer service

during process termination while preserving ordinary timer cleanup.

Report the saved Winsock error code when host WSAPoll fails.

Use explicit SCP evidence transport for FreeBSD CI, disabling redundant

whole-workspace copyback without changing native test gates.

Connect native TLS-off/on builds, replay and complete installed matrices to CI.

Add bounded sanitizer fuzz smoke, persistent trusted corpora and scheduled

campaign code that activates after default-branch cutover.

Require exact selected-archive readiness and all platform evidence before

publication, with immutable artifact verification and isolated permissions.

Fix an ambiguous QUIC replay cursor construction rejected by GCC 13.

Restore native Doxygen linked-page input and a Graphviz-compatible font.

* Ship the C++20 native engine with SOVERSION 3 and native public headers.

* Remove MHD and GnuTLS configure, source, build, link and package prerequisites.

* Require strict TLS-on/off installed audits and validate versioned ABI-2/3 runtime coexistence.

Version 2.0.0

Fixed macOS CI failure when verifying the pinned libmicrohttpd

archive by using the portable `shasum -a 256` interface.

Replaced the blocking-start pthread mutex/condvar pair with C++20

atomic wait/notify, avoiding a Valgrind 3.22 Helgrind stale

lock-address false positive, and suppressed the same third-party

detector limitation in libmicrohttpd-owned mutexes.

v2.0 release. See RELEASE_NOTES.md for the full v1->v2 porting summary.

SOVERSION bumped: shared library now ships as libhttpserver.so.2

(Linux) / libhttpserver.2.dylib (Darwin). Parallel-installable

with any prior libhttpserver.so.0/1 on disk (runtime artefacts

only; dev-time .la/.a/.pc/headers are last-installer-wins by

design).

Added per-function cyclomatic complexity gate

(scripts/check-complexity.sh via `lizard`) and copy/paste

detection gate (scripts/check-duplication.sh via PMD CPD with

the C++ tokenizer), wired into the existing CI lint lane and

exposed locally as `make lint-complexity` /

`make lint-duplication`. Initial CCN ceiling intentionally set

above the current worst offender so CI stays green; ratcheted

down per refactor commit until reaching the long-term target

of 10. Duplication gate runs at PMD's default

minimum-tokens=100 from day one (currently zero hits).

Version 0.20.0

Raised minimum C++ standard to C++20. Build now requires gcc >= 11

or clang >= 13 (Apple Clang from Xcode 15+). Updated

AX_CXX_COMPILE_STDCXX macro (m4/ax_cxx_compile_stdcxx.m4) to

serial 25 to support C++20 detection. Pruned CI matrix rows

(gcc-9, clang-11, clang-12) that lack full C++20 support.

Raised minimum libmicrohttpd requirement to 1.0.0.

Migrated Basic Auth to v3 API (MHD_basic_auth_get_username_password3,

MHD_queue_basic_auth_required_response3) with UTF-8 support.

Migrated Digest Auth to v3 API (MHD_digest_auth_check3,

MHD_digest_auth_check_digest3, MHD_queue_auth_required_response3)

with SHA-512/256 support, userhash, nonce binding, and structured

digest_auth_result enum. Default algorithm changed to SHA-256.

Added new response types: empty_response, pipe_response, iovec_response.

Added external event loop integration: webserver::run(), run_wait(),

get_fdset(), get_timeout(), add_connection().

Added daemon management: quiesce(), get_listen_fd(),

get_active_connections(), get_bound_port().

Added daemon options: listen_backlog, address_reuse,

connection_memory_increment, tcp_fastopen_queue_size,

sigpipe_handled_by_app, https_mem_dhparams, https_key_password,

https_priorities_append, no_alpn, client_discipline_level.

Added startup flags: no_listen_socket, no_thread_safety, turbo,

suppress_date_header.

Added WebSocket support (conditional on HAVE_WEBSOCKET):

websocket_handler, websocket_session, register_ws_resource().

TASK-035: replaced the raw-pointer

register_ws_resource(string, websocket_handler*) overload with

smart-pointer overloads register_ws_resource(string,

unique_ptr<websocket_handler>) and register_ws_resource(string,

shared_ptr<websocket_handler>); added unregister_ws_resource(string).

Mirrors the TASK-023 register_resource ownership model and is

consistent with DR-010 / PRD-HDL-REQ-003 / PRD-HDL-REQ-005.

Duplicate registrations now throw std::invalid_argument

(previously a silent overwrite). On HAVE_WEBSOCKET-off builds

all three entry points throw feature_unavailable.

Added utility functions: reason_phrase(), is_feature_supported(),

get_mhd_version().

Added example and documentation for serving binary data from memory

using string_response (addresses PR #368).

Added conditional compilation for basic auth (HAVE_BAUTH), mirroring

existing HAVE_DAUTH pattern for digest auth. Basic auth support

is auto-detected via AC_CHECK_LIB and can be disabled at build time.

Fixed path traversal vulnerability in file uploads when

generate_random_filename_on_upload is disabled.

Fixed TOCTOU race in file_response by replacing stat-then-open with

open-then-fstat; added O_NOFOLLOW on non-Windows.

Fixed file descriptor leaks in file_response on lseek failure and

zero-size file paths.

Fixed NULL pointer dereference when MHD_get_connection_info returns

nullptr for TCP_NODELAY.

Fixed uninitialized _file_size in file_info.

Fixed auth skip path bypass via path traversal (e.g. /public/../protected).

Fixed use of free() instead of MHD_free() for digest auth username.

Fixed unchecked write error during file upload.

Fixed std::terminate when MHD invokes the URI log callback with a

null uri pointer (e.g. port scans, half-open connections, or

non-HTTP traffic). Resolves issue #371.

Fixed std::terminate when MHD invokes the post-processor iterator with

a null key on a continuation chunk (a field split across multiple

callbacks). Resolves issue #375.

Version 0.19.0 - 2023-06-15

Considering family_url as part of the priority when selecting a URL to match.

More explicit selection of C++ version.

Ability to handle multiple parameters with the same name on the URL.

Enable error_log to handle params to interpolate in the string.

Reduced memory footprint of requests using of string_view.

Configurable management of upload files that allows to load files on disk only, memory only or both disk and memory.

Fixed error codes.

Method not allowed now returns 'allows' header.

Added method to access the gnutls_session struct.

Code cleanups.

Better use of RAII.

Improved test coverage.

Cleaned code to support cpplint and extra warnings.

Use pointers in place of non-const references.

Simplified dependency management for libmicrohttpd.

Added support on build for CodeQL security checks.

Moved builds to travis.com.

Added IWYU checks as part of build and cleaned-up accordingly.

Introduced dual-stack support.

Added OS specific tips, and cleaned up some compiler warnings.

Updates to readme and documentation.

Slight performances improvement by allowing to skip a copy in

string_response constructor.

Moved windows builds to AppVeyor.

Made the library compatible with libmicrohttpd v0.9.71 and above.

Version 0.18.1 - 2020-06-06

Prevent use of regex in http_endpoint outside of registration which could

allow DOS attacks.

Version 0.18.0 - 2020-05-16

General performance improvements (reduced use of regex, lazy-building of

post-processor).

General code cleanup.

General fixes to the documentation.

Fixed support on FreeBSD (added missing headers).

Fixed support for Cygwin.

Removed depedency on C regex - now using C++11 regex.

Added support for TCP-NODELAY.

Changed set_path on http_request to have lazy behavior.

Added support for body parsing in DELETE requests.

Added support for PATCH method.

Version 0.17.5 - 2019-01-28

libhttpserver now includes set of examples to demonstrate the main capabilities of the library.

"examples" are now optionally disabled.

Adds valgrind memcheck to the build system on travis.

Travis now tests performance with apache benchmark.

Reduced the CPU time spent in normalizing URLs (thus saving ~15% on average per request).

All classes now implement move constructor and move assignment operator.

The library now avoids collecting connection properties (headers, arguments, footers, cookies, etc...) unless explicitly asked by the client code.

Removed the support for integrated COMET logic.

Removed the support for caching logic.

Added integ tests.

Changed http_resource interface to use shared_ptr.

Improved interface of the http_response object.

Deprecated http_response_builder object.

Version 0.16.0 - 2018-12-26

Fixed IPV6 parsing logic.

Added tests to support IP parsing, URL parsing and utilities.

Version 0.15.0 - 2018-11-23

Solved problem with the server not being able to start on mac os.

Version 0.14.0 - 2018-11-05

Moved http_endpoint as a sub-class of webserver. This avoids usage of friends.

Version 0.13.0 - 2017-02-26

Fixed problem with segfault when copying http_response object.

Version 0.12.0 - 2017-02-12

Updated to libmicrohttpd 0.9.52.

Version 0.11.1 - 2016-07-13

Fixed problems with large payloads.

Fixed memory leak in http_response_ptr.

Version 0.11.0 - 2015-12-26

Removed support for event supplier (badly defined, complicated and almost useless).

Eliminated custom selection logic (simplified overall code in webserver.cpp).

Changed comet to use a lock-free implementation.

Removed POLL start configuration (THREAD now defaults to POLL or EPOLL on Linux).

Use TCP_FASTOPEN on linux >= 3.6.

Changed http_resource to use classic C++ polymorphism using virtual instead of CRTP.

Removed build dependency on pkg-config.

Version 0.9.0 - 2015-04-15

Support build on MacOsX.

Improved support for CI on travis.

Solved bug on event_supplier registering.

Solved bug on standardize_url to avoid removing root.

Change cycle_callback_ptr so that buffer can be modified.

Version 0.8.0 - 2014-07-23

Support for building on MinGW/Cygwin systems.

min libmicrohttpd version moved to 0.9.37.

Version 0.7.2 - 2014-03-23

Continue the cleanup reducing webserver.cpp responsibilities.

Deep work on documentation.

Version 0.7.0 - 2014-01-25

Cleaned-up webserver.cpp code to extract secondary classes.

Enforced immutability of webserver class.

Enabled library to compile on g++ 4.1.2.

Version 0.5.4 - 2012-10-30

Added parameter in http_response to specify if it needs to be deleted by WS.

Changed dependency download method.

Added travis CI configuration.

Changed the buggy debian changelog.

Version 0.5.3 - 2012-10-30

Added grow method to http_request.

Version 0.5.2 - 2012-10-23

Changed default log behaviour to print nothing.

Added getters and setters for dynamic components of WS.

Version 0.5.1 - 2012-10-10

Added querystring to request attributes.

Added response constructor with byte.

Removed unuseful dependency from libuuid.

Solved a bug that made impossible to parse post data.

Version 0.5.0 - 2012-10-05

Added -D_REENTRANT to configuration.

Aligned debian changelog.

Added comet capabilities to the server.

Solved a bug with print in debug mode.

Modified webserver in order to accept comet calls.

Partially solved undefined symbol in wrappers.

Avoided the usage of the sole option MHD_USE_POLL.

Added forgotten modded_request.hpp file.

Added .gitignore file.

Moved http_endpoint to details namespace.

Version 0.4.0 - 2012-08-26

Changed visibility of http_endpoint methods to avoid them to be called

by external applications.

Avoided explicit usage of MHD constants in classes interface.

Changed http_resource interface in order to avoid copy-constructor calls

and improve performances.

Changed answer_to_connection method in order to avoid multiple checking

on methods and thus improve performances.

Added a way to register personalized error pages.

Removed code repetition in handle_request method.

Added capability to compile with gcov.

Changed infinite loop in ws to use wait conditions.

Removed a bug from GET-like method handling.

Modified in order to parse qs in POST/PUT cases.

Avoid inclusion of internal headers.

Changed in order to find libmicrohttpd in system.

Solved some performance and style issues.

Added some comments to http_endpoint and http_request.

using m4 to define major, minor and revision number in configure.ac.

Changed in order to solve some problems with deb package and rpm package.

Added parameter used to ignore dependecies during debpkg creation.

Adjusted errors in debian rules.

Modified rpm build in order to compile it.

Lowered required version of libmicrohttpd to 0.9.7.

Solved a logical error in http_resource route.

Changed in order to add optional optimizations on ws.

Changed in order to enhance deb packages generation.

Added rpm packages generation.

Changed in order to include debian package creation to makefile.