Skip to content
TrustMyStack, home

pingora

0.9.1
cloudflare/pingora

A library for building fast, reliable and evolvable network services.

Version of cloudflare/pingora you run

CompareView on GitHub
Maintenance
ActiveBased on the last push: commit history is not collected yet
License
Apache-2.0Permissive · OSI-approved
Security
8 advisories2 critical, 5 high, 1 medium
Supported versions
No scheduleendoflife.date does not track this project

27.9k stars · 1.8k forks · 325 open issues · last release 12 days ago · data checked 1 hour ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 11 releases.

  • 0.9.0Sep 9, 2026

    ⚠️ Potential Breaking Changes

    • Minimum supported Rust version moves to 1.85 for some crates. pingora-foundations declares an MSRV of 1.88.
    • RequestHeader and ResponseHeader no longer implement DerefMut because unrestricted mutation could violate internal invariants.
    • Removed async_write_vec APIs; consumers should use tokio::io::AsyncWriteExt::write_all_buf.
    • Prometheus integration moved from pingora-core to the separate pingora-prometheus crate; Prometheus is optional.
    • tracing is now optional in pingora-cache.
    • Upgraded to the boring-rs 5.x API.
    • PeerOptions::curve now uses Cow.
    • Upstream requests strip hop-by-hop and Connection-nominated headers by default; legacy behavior requires explicit compatibility settings.
    • Default HTTP/2 server limits are bounded rather than unbounded.
    • Removed the unused LruShard Default implementation and lifted Default bounds on sharded cache structures.
    • Removed the CacheKey namespace parameter.
    • PurgeOutcome enum gains an Expired variant.
    • ForcedFreshness and hit-status reporting gain ForceExpiredServeStale variant.

Release history

All releases on GitHub
Atom feed/feed/cloudflare/pingora
BadgeLatest version of cloudflare/pingora[![version](/badge/cloudflare/pingora)](/p/cloudflare/pingora)

Pingora 0.9.1

0.9.1 - 2026-11-02

🐛 Bug Fixes

  • Fix a panic on every accepted and outgoing connection with tokio 1.54 and later, which rejects zero-capacity buffered readers (#1059).
  • Fix the docs.rs build of the pingora crate, which failed for 0.9.0 (#1018).
  • Fix a panic in pingora-limits Estimator::incr when a counter overflows in builds with overflow checks enabled (#1041).

🔒 Security

  • Require zstd 0.14.3, and through it zstd-safe 8.2.0 and zstd-sys 2.1.2, so dependency resolution cannot select zstd crates affected by RUSTSEC-2026-0391, RUSTSEC-2026-0395 through RUSTSEC-2026-0406, or RUSTSEC-2026-0410.

⚙️ Miscellaneous Tasks

  • Ignore RustSec advisories for rustls 0.21, webpki-roots 0.26, rustls-webpki 0.101 and crypto-bigint 0.5.5, which reach the lockfile only through optional transitive dependencies and have no compatible fixed release.
  • Update HTTP/2 rejection tests for h2 releases that reject conflicting Content-Length headers in the codec.

Full release notesCompare with previous