v0.26.7

scripts/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.26.6"
+assert manifest["package"]["version"] == "0.26.7"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.26.6"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.26.7"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.26.6",
-    "CHANGELOG.md": "## 0.26.6",
-    "ROADMAP.md": "## 0.26.6",
-    "AGENTS.md": "Current source version: 0.26.6.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.26.6",
+    "README.md": "# RustProxy 0.26.7",
+    "CHANGELOG.md": "## 0.26.7",
+    "ROADMAP.md": "## 0.26.7",
+    "AGENTS.md": "Current source version: 0.26.7.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.26.7",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -136,6 +136,15 @@ assert "cargo generate-lockfile" in dockerfile and "cargo build --locked --relea
 assert "USER rustproxy:rustproxy" in dockerfile
 assert 'VOLUME ["/var/lib/rustproxy"]' in dockerfile
 assert "COPY . ." in dockerfile
+for marker in [
+    "python3 -m venv /opt/rustproxy-certbot",
+    "certbot==5.8.0",
+    "certbot-dns-cloudflare==5.8.0",
+    "certbot-dns-ovh==5.8.0",
+    "certbot-dns-rfc2136==5.8.0",
+    "PATH=/opt/rustproxy-certbot/bin:",
+]:
+    assert marker in dockerfile, marker
 assert "data" in (root / ".dockerignore").read_text().splitlines()
 css = (root / "src/admin/web/style.css").read_text()
 assert ".logging-grid fieldset" not in css, "logging sinks must reuse shared card styling"
@@ -170,6 +179,9 @@ assert 'member.backend.websocket_client.maintain_rotation();' in balance_source
 upstream_client_source = rust_source(root, "src/upstream/client.rs")
 assert 'fn maintain_rotation(&self)' in upstream_client_source
 assert 'self.rotate(self.generation.load(Ordering::Acquire), "age", false);' in upstream_client_source
+assert 'fn reusable_with(&self, other: &Self) -> bool' in upstream_client_source
+assert 'member.backend = old.backend.clone();' in balance_source
+assert 'compatible_pool_rebuild_reuses_upstream_clients' in balance_source
 for marker in [
     'pub struct PassiveHealth', 'enabled: false', 'pub passive_health: PassiveHealth',
     'passive_health_failures_total', 'http_5xx_total', 'timeouts_total',
@@ -256,7 +268,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.26.6"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.26.7"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -390,6 +402,10 @@ assert 'transform_enabled' in docker_js
 cache_panel_js = (root / 'src/admin/web/cache-panel.js').read_text()
 for marker in ['/api/cache/cold/cleanup', 'removed_entries', 'freed_bytes', '/api/cache/invalidate', '/api/cache/bans', 'cache-invalidation-operation', 'cache-invalidation-selector', 'cache-ban-ttl', 'confirm_wide', 'cachePurgeUrl']:
     assert marker in cache_panel_js or marker in html, marker
+for marker in ['cp-hot-entries-meter', 'cp-memory', 'cp-cold-entries-meter', 'cp-cold-disk']:
+    assert marker in html and marker in cache_panel_js, marker
+for marker in ['data.settings?.max_entries', 'data.settings?.cold_max_entries', 'data.settings?.cold_max_bytes', 'setMeter(']:
+    assert marker in cache_panel_js, marker
 transform_panel_js = (root / 'src/admin/web/transform-panel.js').read_text()
 for marker in ['/api/transform', 'tp-cache-hits', 'transform-reason-list']:
     assert marker in transform_panel_js, marker
@@ -769,6 +785,28 @@ docker_ui = (root / "src/admin/web/docker.js").read_text()
 for marker in ["pub enum AppliedEncoding", "AppliedEncoding::Gzip", "AppliedEncoding::Brotli", "AppliedEncoding::Zstd", "AppliedEncoding::Deflate"]:
     assert marker in compression_source, marker
 assert "quality_weights_can_select_each_enabled_codec" in compression_source
+for marker in [
+    "pub struct AllowCookie",
+    'response.extensions().get::<AllowCookie>().is_none()',
+    "cache_safe_cookie_marker_allows_compression_without_weakening_default_guard",
+    "age_header_survives_downstream_compression",
+]:
+    assert marker in compression_source, marker
+compression_finalize_source = rust_source(root, "src/proxy/upstream_helpers.rs")
+for marker in [
+    'exchange.cache_status.load(Ordering::Relaxed) == 1',
+    'response.extensions().get::<StaticSourceResponse>().is_some()',
+    '.insert(crate::compression::AllowCookie)',
+]:
+    assert marker in compression_finalize_source, marker
+headers_source_0267 = rust_source(root, "src/headers.rs")
+vhost_core_0267 = (root / "src/admin/web/vhosts/core.js").read_text()
+assert '| "age"' in headers_source_0267, "Age must be protected from generic response rules"
+assert '["host", "age", "connection"' in vhost_core_0267, "UI must protect Age consistently"
+compression_tester_0267 = (root / "scripts/test_compression.py").read_text()
+for marker in ["--revalidate", "if revalidate:", 'headers["Cache-Control"] = "no-cache"', "headers.get('Age', '-')"]:
+    assert marker in compression_tester_0267, marker
+assert "cache_hit_and_dashboard_age_advance_from_storage_clock" in read_cache_source()
 diagnostics_source = rust_source(root, "src/diagnostics.rs") + rust_source(root, "src/system_stats/mod.rs") + rust_source(root, "src/system_stats/linux.rs")
 for marker in ["pub struct NetworkInterfaceView", "pub network_interfaces: Vec<NetworkInterfaceView>", "sysinfo::Networks::new_with_refreshed_list", "system.network_stats", "collect_network_systemstat", "normalize_network_interfaces", "merge_network_interfaces"]:
     assert marker in diagnostics_source, marker
@@ -1238,7 +1276,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.26.6"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.26.7"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1283,5 +1321,5 @@ for schema_name in ["RedirectHost", "NotFoundHost"]:
     node = openapi_0241["components"]["schemas"][schema_name]["properties"]["frontend"]["properties"]["hosts"]
     assert "maxItems" not in node, schema_name
 
-print("PASS: 0.26.6 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
+print("PASS: 0.26.7 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, Debian/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v8 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")