|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to this project are documented in this file. |
| 4 | + |
| 5 | +## [Unreleased] |
| 6 | +- (TBD) |
| 7 | + |
| 8 | +## [2.1.2] - 2026-03-17 |
| 9 | +- Version bump and release metadata synchronization. |
| 10 | + |
| 11 | +## [2.1.0] - 2026-02-26 |
| 12 | +- **Fix**: Use-after-free of `RequestContext` — transport callbacks now capture `shared_ptr<RequestContext>` instead of raw `void*` pointer, preventing dangling access after `cleanup()`. |
| 13 | +- **Fix**: `handleData()` now checks `cancelled` flag at entry, matching `handleDisconnect`/`handleTransportError`. |
| 14 | +- **Fix**: Race condition between `loop()` timeouts and AsyncTCP callbacks — `triggerError()` and `loop()` now check `atomic<bool> cancelled` before acting. |
| 15 | +- **Fix**: `Content-Length` parsing uses `strtoul()` with `endptr` validation instead of `toInt()` (which returns 0 for invalid input). |
| 16 | +- **Fix**: `Transfer-Encoding` multi-value support — `gzip, chunked` is now correctly detected via substring search instead of exact comparison. |
| 17 | +- **Fix**: `setMaxBodySize()` is now enforced in streaming mode (`setNoStoreBody(true)`) to protect against unbounded data from malicious servers. |
| 18 | +- **Perf**: Chunked transfer decoding eliminates double buffering — chunk body bytes are delivered directly from the incoming data buffer instead of being copied through `responseBuffer`. |
| 19 | +- **Perf**: `_pendingQueue` changed from `std::vector` to `std::deque` for O(1) dequeue instead of O(n). |
| 20 | +- **Feature**: `Content-Type` auto-detection for POST/PUT/PATCH — bodies starting with `{` or `[` default to `application/json`; user-set `Content-Type` headers take precedence. |
| 21 | +- Internal: `_activeRequests` now uses `shared_ptr<RequestContext>` instead of `unique_ptr`. |
| 22 | + |
| 23 | +## [2.0.0] - 2026-02-20 |
| 24 | +- **Breaking**: `SuccessCallback` now receives `std::shared_ptr<AsyncHttpResponse>`. |
| 25 | +- **Breaking**: `request()` now takes `std::unique_ptr<AsyncHttpRequest>`. |
| 26 | +- **Breaking**: `getBody()`, `getHeader()`, and `getStatusText()` return `String` by value. |
| 27 | +- **Breaking**: removed legacy void-return helpers (`*_legacy`, `ASYNC_HTTP_LEGACY_VOID_API`). |
| 28 | +- **Breaking**: `parseChunkSizeLine()` is now private. |
| 29 | +- Normalize `HttpHeader` names to lowercase for faster lookups. |
| 30 | +- Refactor request context state into sub-structs and store active/pending requests as `std::unique_ptr`. |
| 31 | +- Document `BodyChunkCallback` lifetime guarantees. |
| 32 | +- HTTPS/TLS transport: AsyncTCP + mbedTLS, CA/fingerprint/mutual-auth configuration, TLS error codes, and gated insecure TLS. |
| 33 | +- Redirects: default safer cross-origin header forwarding, allow HTTP→HTTPS redirects. |
| 34 | +- Cookies: host-only by default, allowlist required for parent-domain `Domain=` attributes. |
| 35 | + |
| 36 | +## [1.0.7] - 2025-11-13 |
| 37 | +- Align `library.json`, `library.properties`, and `ESP_ASYNC_WEB_CLIENT_VERSION` with release 1.0.7 so CI/release scripts pass. |
| 38 | +- Document contributor expectations in `AGENTS.md` and reconfirm README error codes plus HTTPS warning stay in sync with `HttpCommon.h`. |
| 39 | +- Verified required Arduino/PlatformIO example skeletons for CI (SimpleGet, PostWithData, MultipleRequests, CustomHeaders, StreamingUpload, CompileTest) remain present. |
0 commit comments