Release notes
Version 6.3.0RC1
(alpha)
|
- Windows Support: `Swoole` now supports use on `Windows`.
- New `Swoole\Table` Interfaces: Added `add()` (insert a new row only when the key does not exist), `update()` (update only when the key exists), `cmpset()` (compare and swap), `cmpdel()` (compare and delete), and `getdel()` (get and delete, supporting snapshots of an entire row or a single field).
- ARM64 BTI Support: Added `BTI (Branch Target Identification)` support to the `Boost.Context` assembly files for `ARM64` (AArch64).
- PHP 8.4 PDO Subclass Support: Added support for the driver-specific subclasses introduced for `PDO` in `PHP 8.4`: `Pdo\Sqlite`, `Pdo\Mysql`, `Pdo\Pgsql`, `Pdo\Firebird`, and `Pdo\Odbc`.
- autoload Symbol Export: The original `zend_autoload` function pointer saved by `Swoole` has been changed from a `static` private variable to an exported symbol accessible via `php_swoole_api.h`, allowing third-party extensions to still call `PHP`'s original `autoload` handler after `Swoole` hijacks `autoload`.
- Cross-Platform Atomic Wait/Wakeup Mechanism: Implemented an atomic wait/wakeup mechanism based on a shared memory registry for platforms without `futex (Linux)` or `WaitOnAddress (Windows)` (such as `macOS` and `BSD`), replacing the previous `std::mutex` approach and supporting cross-process waiting and timeouts.
- Windows Atomic futex Implementation: Implemented `sw_atomic_futex_wait` / `sw_atomic_futex_wakeup` for the Windows platform—based on the `WaitOnAddress` / `WakeByAddressSingle` APIs, combined with a mutex + unordered_map to track waiters, supporting timeouts and correct wakeups.
- HTTP/2 Multiplexing Client: `Swoole library` adds `Swoole\Coroutine\Http2\MultiplexClient`, an `HTTP/2` client that can multiplex requests from multiple coroutines onto one shared connection.
- Redis ACL Authentication: `Swoole library` adds `Swoole\Database\RedisConfig::withAuth()`, which now accepts a `[username, password]` array in addition to a password string, for `Redis ACL` authentication.
- Coroutine curl Support for `CURLOPT_PREREQFUNCTION`: `Swoole library` supports the `CURLOPT_PREREQFUNCTION` option in the coroutine `curl` handler. On `PHP` versions that do not natively support this option, use the namespaced constants `Swoole\Curl\CURLOPT_PREREQFUNCTION`, `Swoole\Curl\CURL_PREREQFUNC_OK`, and `Swoole\Curl\CURL_PREREQFUNC_ABORT`.
- HTTP/2 Server Option: `Swoole library` supports the `http2_max_headers` server option, adding the new constant `Swoole\Constant::OPTION_HTTP2_MAX_HEADERS`.
- SSH Host Key API: The coroutine-based `ssh` extension adds the `ssh2_hostkey()` function—a new API that exposes the negotiated server's raw host key and algorithm type, supporting precise `TOFU` storage and independent verification.
- SHA-256 Fingerprint Support: Added the `SSH2_FINGERPRINT_SHA256` flag while retaining the original MD5/SHA-1 default behavior.
- Removed the duplicate `server` array field set in `Swoole\Coroutine\Http\Server` to avoid triggering assertion failures in `debug` builds.
- Fixed a logic error in the kernel version check when `Swoole` loads `io_uring`, which caused `Linux` kernels with a major version greater than `6` to be misjudged as too old.
- Fixed improper maintenance of the `Swoole` coroutine context chain (`origin_ctx`) that produced dangling pointers, causing occasional segfaults when a `Worker` parsed `HTTP` parameters.
- Fixed a segfault caused by the uninitialized module global variable `cli` under a multi-threaded `SAPI`.
- Fixed an issue in ZTS (Zend Thread Safety) mode where, with static `TSRM` local storage caching enabled, `Swoole` global variable access could read the wrong thread cache.
- Fixed the handling of `Content-Length` when the `Swoole HTTP/2` server builds response headers, with the core goal of preserving `Content-Length` explicitly set by the application and preventing it from being incorrectly overwritten or recalculated.
- Fixed the incorrect return value semantics of `stream_socket_shutdown()` under the `Swoole Runtime` hook.
- Fixed the initialization of `SFTP` directory streams by filling in the `session` and `sftp` pointers before the stream is exposed, giving them complete handle state like ordinary file streams.
- Fixed resource ownership for the `SFTP wrapper` by registering the `session` before authentication, so every failure path releases the initialized Zend resources and attaches the subsystem to the owned `session`.
- Fixed the release of temporary resources after one-off `SFTP` operations by calling `zend_list_delete` after operations such as `stat` and `mutation`, so SFTP references are no longer leaked.
- Fixed sub-resource protection after session closure by introducing the shared `php_ssh2_session_is_open()` predicate, so `channel`, `listener`, `public-key`, and `SFTP` return normal failure values after the parent session is closed.
- Fixed session liveness protection in destructors by skipping `libssh2` calls when the parent session is already closed while still releasing `Zend` references and local bookkeeping to avoid crashes.
- Fixed the default blocking state of `channel` by changing `is_blocking` from `0` to `1`, consistent with normal `PHP` stream behavior.
- Fixed the `EOF` inference logic of `channel`, so negative transfer errors are no longer misjudged as `EOF`.
- Fixed `sub-second` timeout precision by passing per-stream timeouts directly to `socket poll`, preserving millisecond precision and preventing one `channel` from changing the shared `session` timeout.
- Fixed the publication of `channel-local` stream metadata so that `stream_get_meta_data()` reflects the `channel`'s own blocking, `EOF`, timeout, and other states.
- Fixed error handling for `SFTP` file streams so that negative `SFTP` reads remain errors rather than `EOF`, and `EOF` only comes from zero-byte reads.
- Fixed error handling for `SFTP` directory streams to distinguish transfer errors, normal completion, and valid entries, with each result owning its own `EOF` state.
- Fixed the `arginfo` for `ssh2_forward_listen` / `ssh2_forward_accept` by removing the invalid `resource` return type and parameter type declarations, correcting the inconsistency between the generated `arginfo` and the handwritten function table contract.
- Fixed timeout support for `ssh2_async_call` by adding `timeout` and `timeout_event` parameters, passing the timeout during `poll`, and distinguishing whether the failure was caused by a timeout.
- Fixed `channel` initialization in `ssh2_forward_accept` by adding the `is_blocking = 1`, `timeout = 0`, and `timeout_event = false` fields.
- Fixed a request memory leak in `Swoole\Redis\Server`.
- Fixed stream writes under the `Swoole Runtime Hook` incorrectly reporting partial writes as failures.
- Fixed a commit addressing ownership issues with `proc_open` stream descriptors.
- Fixed `trailer` being closed prematurely in `HTTP/2` streaming responses.
- Fixed the `HTTP/2` server not releasing the session after a fatal request, causing a crash when the `worker` shuts down.
- Fixed `HTTP/2 sendfile` loading the entire file at once by changing it to chunked streaming transmission.
- Fixed incorrect interaction between `Content-Length` and compression handling in `HTTP/2` responses.
- Fixed the `HTTP/2 Bomb` security vulnerability (remote denial-of-service attack). Liunardo
- Fixed incomplete/corrupted data still being sent to the `task worker` or `pipe` transport layer when `PHP` serialization fails, while preserving the original exception and correcting `falsy` return values being misjudged as no result.
- Fixed `ssh2_exec()` prematurely publishing the "completed" state when `stdout/stderr` reached `EOF` (causing an incorrect exit code).
- Fixed premature reading of native state during constructor and parameter parsing in `Swoole\Table`, `Swoole\Lock`, `Swoole\Coroutine\Lock`, `Swoole\Thread\Lock`, `Swoole\Thread\Barrier`, `Swoole\Process`, and `Swoole\Server`, changing it to check native state only after `Zend` parameter parsing is complete, preventing object state corruption when `PHP 8` scalar type conversion diagnostics trigger user code reentrancy.
- Fixed resource leaks and duplicate listener replacement in `Swoole\ProcessPool` when setting up the listening `socket` fails.
- Fixed `MessageBus` internal buffers incorrectly using an external `allocator` for allocation, which could cause a `coredump` on release.
- Fixed an issue in `Swoole ZTS` where, after setting `PHP_STREAM_FLAG_NO_CLOSE` to prevent `stdio` from being closed prematurely, `fd`s were not automatically closed at thread exit, causing file descriptor leaks.
- Fixed `WebSocket` frame parsing not rejecting control frames (`CLOSE`/`PING`/`PONG`) with the `RSV1` bit set.
- Fixed target hostname length validation in `SOCKS5` proxy `DNS` tunnel mode.
- Fixed a memory leak where, when `reactor` initialization failed, only an error code was returned without deleting the already allocated `reactor` object.
- Fixed `Swoole Runtime hook` not correctly reporting timeout status on read/write timeouts (`ETIMEDOUT`) and instead marking the stream as `EOF`.
- Fixed `Swoole\Thread::setPriority()` not preserving the current scheduling policy when the `policy` parameter is omitted and instead using the invalid `-1`.
- Fixed `WebSocket ping()` not reporting an error when encoding fails (such as when the payload exceeds the 125-byte control frame limit) and continuing to send an empty `buffer`.
- Fixed `Swoole library` reporting fatal `accept` failures of `\Swoole\Coroutine\Server` through `start()` and `errCode`.
- Fixed a memory leak in `Swoole library`'s `Swoole\RemoteObject\Client` that had existed since `6.2.0`. Previously, each client would remain alive for the entire lifetime of the process, so every hooked `dns_get_record()`, `checkdnsrr()`, `getmxrr()`, `mail()`, and `gethostbyaddr()` call, as well as every `Swoole\MongoDB\Client`, would leak a client, its HTTP client, and an open unix socket. Now, the client is released immediately when there are no users, so for clients that have disappeared, `Swoole\RemoteObject\Client::getInstance()` returns `null`; clients can also no longer be cloned.
- Fixed keyboard-interactive authentication state isolation by moving the in-progress password from a process-global pointer to per-session abstract data, eliminating the risk of password cross-contamination between concurrent coroutines.
- Fixed build configuration error handling by upgrading missing agent/session-timeout symbols from warnings to configuration errors, avoiding silently generating feature-reduced APIs when headers and libraries do not match.
- Fixed SSH2 shell size parameters by correcting the handling of shell size parameters.
- Fixed SSH2 environment variable iteration to ensure each key is correctly paired with its own value.
- Fixed environment variable value masking by masking SSH2 environment variable values in warning messages.
- Fixed exec PTY metadata by changing the `pty` parameter from `bool` to `?string`, representing the remote terminal type.
- Fixed recoverability for incomplete shell sizes by issuing a warning and returning `false` when only width is provided without height, and removing the unreachable return after the fatal error.
- Fixed the issue in `SWOOLE_THREAD` mode where `Swoole\Server` could not start when the `set()` method was not called.
- Fixed an issue where, after a hooked TLS stream completed the handshake in `Socket::connect()`, if that call failed or was canceled, the stream transport layer would still try to enable encryption again instead of directly returning failure.
- Fixed HTTP compression using the wrong data format when returning `deflate` encoding.
- Fixed the issue where, when native hook was not enabled, destroying a native `CurlHandle` did not hand the object release work back to `ext-curl`, resulting in incorrect release logic.
- Fixed cURL multi not correctly restoring the "readable and writable simultaneously" event mask in the `CURL_POLL_INOUT` state, causing HTTP/2 duplex transmission to be repeatedly woken up in a busy loop when blocked by flow control.
- Fixed coroutine leaks caused by the peer closing the connection after `send_yield` is enabled, preventing the coroutine from being woken up.
- Fixed incorrect read/write behavior for coroutine sockets with iouring enabled when SSL/TLS is enabled.
- Fixed a null pointer dereference crash when querying port properties (`ServerPortProperty`) while a `Swoole` server is closing a port, caused by passing a `NULL` port pointer. -program
- Fixed incorrect parameter validation, incorrect error messages, and crashes when passing objects for `SO_LINGER`, `SO_RCVTIMEO`, and `SO_SNDTIMEO` in `Swoole\Coroutine\Socket`'s `setOption()`.
- Fixed an issue where calling `Swoole\Process::signal()` in `onManagerStart` when built with `--enable-thread-context` (`SW_USE_THREAD_CONTEXT`) caused the `manager` process to crash with `SIGSEGV`. |
