Skip to content

Upgrading hyper 0.13 to 0.14

Breaking0.13.10 → 0.14.32Breaking11Security4New35Changed4Fixed37Other1

Full comparisonBack to hyper
BreakingUpgrade verdict

10 breaking changes and 4 security fixes.

In plain terms
  • If you use the unstable FFI and want HTTP/1 header case preserved, you must now turn that option on yourself.
  • You must now enable the client feature to use hyper's HTTP client.
  • You must now enable the http1 feature to use HTTP/1.
  • hyper no longer emits log records by default; enable tracing's log feature to get them.
Must act Top 5 of 14 that need code or config changes

What you must change

Breaking10
hyper_clientconn_options_new no longer enables http1_preserve_header_case by default in unstable ffi.
hyper_clientconn_options_newhyper_clientconn_options_set_preserve_header_casehttp1_preserve_header_case
0.14.19CHANGELOG.mdSummarizedView source
Makes the client an optional feature, disabled by default.
client
0.14.0CHANGELOG.mdSummarizedView source
Makes HTTP/1 support an optional feature, disabled by default.
http1http2
0.14.0CHANGELOG.mdSummarizedView source
Removes automatic log record emission; tracing log feature must be enabled.
tracing
0.14.0CHANGELOG.mdSummarizedView source
Disables all optional features by default.
0.14.0CHANGELOG.mdSummarizedView source
Makes the server code an optional feature, disabled by default.
server
0.14.0CHANGELOG.mdSummarizedView source
Removes http1_writev methods from client and server builders.
http1_writevclient::Builderclient::conn::Builderserver::Builderserver::conn::BuilderAsyncWrite::is_write_vectored
0.14.0CHANGELOG.mdSummarizedView source
DNS Resolver now resolves to SocketAddrs instead of IpAddrs.
HttpConnectorSocketAddrIpAddr
0.14.0CHANGELOG.mdSummarizedView source
Upgrades to Tokio 1.0, Bytes 1.0 and http-body 0.4.
tokiobyteshttp-body
0.14.0CHANGELOG.mdSummarizedView source
Moves HTTP upgrades off Body to a new API.
Body::on_upgrade()hyper::upgrade::on
0.14.0CHANGELOG.mdSummarizedView source
Security4
Parser creates invalid uninitialized value
0.14.12GitHub AdvisoryOriginalView source
Integer overflow in hyper's parsing of the Transfer-Encoding header leads to data loss
Critical · CVSS 9.1
0.14.10GitHub AdvisoryOriginalView source
Lenient hyper header parsing of Content-Length could allow request smuggling
Medium · CVSS 5.3
0.14.10GitHub AdvisoryOriginalView source
Multiple Transfer-Encoding headers misinterprets request payload
High · CVSS 8.1
0.14.3GitHub AdvisoryOriginalView source