Act nowcan affect a running systemReviewed all 26 non-merge commits from build 2.4.17162 through 2.4.17187: 989 additions and 286 deletions outside version bookkeeping. The raw payload has no superseded_by metadata; the avoid windows come from directly inspected fixes to the same routines. No unresolved final-head defect was identified.
URI redirects settle as heartbeat and session timing recover
The URI stack is rewritten around RFC 3986 parsing and relative Location resolution, then stabilized through build 2.4.17187 before HTTP clients adopt it for redirects. Production users also receive the successor fix for disabled async WebSocket heartbeats, corrected signed-URI and REST session timeouts, safer proxy-cache startup and shutdown, and optional Windows IOCP direct writes. External callers of ESynSspi.RaiseLastOSError have one source migration to make.
TL;DR
- Land on upstream head 215c7bbd240419735ad7e89f5d35ddc9cfeb8b4d at build 2.4.17187 for the completed URI and redirect sequence.
- Build 2.4.17171 restores async WebSocket heartbeat callbacks disabled by the previous idle-loop comparison.
- Signed URI timestamp ordering and REST session timeout arithmetic are corrected for long-running services and 32-bit tick rollover.
- Windows proxy caches can use direct IOCP writes and now avoid startup and background-deletion races.
- Replace external ESynSspi.RaiseLastOSError calls with ESynSspi.RaiseSspiError.
- Avoid builds 2.4.17162–2.4.17170 for heartbeat users and 2.4.17176–2.4.17186 for the incomplete URI sequence.
Upgrade advice
Upgrade to build 2.4.17187 at head 215c7bbd240419735ad7e89f5d35ddc9cfeb8b4d rather than stopping inside the URI rewrite. WebSocket, Signed URI, REST session, SOA discovery and proxy-cache users should prioritize the update. Before compiling external code, replace ESynSspi.RaiseLastOSError with ESynSspi.RaiseSspiError; then regression-test relative redirects, credential policy and Windows proxy throughput.
26 of 26 entries · 26 commits upstream
1
High
Signed URI sessions survive tick rollover correctly
TRestServerAuthenticationSignedUri.RetrieveSession compares timestamps with signed modular deltas, updates its last timestamp only when newer, and aligns startup and 32-bit rollover handling.
Security
mormot.rest.server
1c193929+31-25
rest: fixed TRestServerAuthenticationSignedUri.RetrieveSession parsing
Impact
Long-running signed-URI services no longer reject or misorder otherwise valid authentication timestamps around process start and tick wrap.
Upgrade recommended
Prioritize this commit for Signed URI authentication and test replay windows across simulated rollover.
Units
2
High
HTTP redirects resolve Location through TUri
THttpClientSocket replaces manual 3xx Location string handling with TUri.FromLocation, lets OnRedirect alter Location and options, and derives reconnect, credential and rejection decisions from the parsed URI.
Fixes
mormot.net.client
150674b6+69-66
net: fixed THttpClientSocket 3xx redirection Location: parsing
Impact
Relative, absolute and scheme-relative redirects are handled consistently, but this first integration requires the following cross-origin fix before production use.
Upgrade recommended
Take only as part of the completed sequence through build 2.4.17187 and test redirect callbacks.
Public API
THttpClientSocket redirect Location handlingbehaviour-changed — Uses RFC 3986-aware TUri.FromLocation resolution.
Units
3
High
Initial URI parser defects are corrected
TUri.From and FromLocation correct direct string-length handling, reject an empty explicit port, repair type and boundary checks, and fix relative-resolution output discovered by tests.
Fixes
mormot.net.sock
50b2e69c+25-37
net: fixed TUri.From/FromLocation methods
Impact
Applications should not use the initial builds of the new parser because malformed ports and some input lengths could be handled incorrectly.
Upgrade recommended
Take this and all later URI fixes through build 2.4.17187.
Units
4
High
TUri.FromScheme now keeps textual and enum schemes coherent
TUri.FromScheme now assigns Scheme from the TUriScheme lookup in addition to UriScheme, with regression coverage for HTTP, HTTPS, WS, WSS, FTP and LDAPS.
Fixes
mormot.net.sock
215c7bbd+14-11
net: fixed TUri.FromScheme
Impact
Callers using URI, SameUri or Https after FromScheme now receive the expected scheme; code stopping at build 2.4.17186 can construct internally inconsistent TUri values.
Upgrade recommended
Land on build 2.4.17187 and test every FromScheme call that later reads Scheme, URI or Https.
Public API
TUri.FromSchemebehaviour-changed — Now initializes both UriScheme and Scheme.
Units
5
High
Redirect origin checks and retry state are stabilized
THttpClientSocket computes cross-origin state only after parsing the new Location, removes the transient RedirectCrossOrigin field, restores saved HTTP state when reopening fails, and TUri.FromScheme records UriScheme.
Fixes
mormot.net.client+1
eb38a32d+10-7
net: one last set of fixes before the week-end
Impact
Redirect credential policy is evaluated against the actual target and failed reconnects no longer leave client state half-mutated.
Upgrade recommended
Do not stop on build 2.4.17183; take this stabilization and the final FromScheme fix.
6
High
SOA discovery honors live publication timeouts
TServicesPublishedInterfacesList reverses expired/live comparisons so valid published interfaces remain visible and expiring entries can refresh their checksum state.
Fixes
mormot.soa.core
712db4b8+9-8
soa: fixed TServicesPublishedInterfacesList timeout logic
Impact
Service discovery with nonzero publication timeouts stops hiding live services or skipping required refresh work.
Upgrade recommended
Prioritize for SOA registries using expiring publications and verify discovery renewal.
Units
7
High
Proxy-cache startup no longer races its idle worker
THttpProxyServer adds an fUrlSet readiness flag and makes OnIdle exit until URL initialization has completed, addressing a documented random GPF during startup.
Fixes
mormot.net.async
7060c16c+8-3
net: fixed random GPF at THttpProxyServer startup
Impact
Production proxy caches avoid an initialization race that could crash the process before Start completed.
Upgrade recommended
Upgrade proxy-cache deployments and include the following shutdown/deletion guard.
Units
8
High
Proxy-cache deletion aborts safely during shutdown
THttpProxyServer clears fUrlSet on Stop and remote-IP changes and checks it during slow directory deletion, preventing background work from continuing against invalidated state.
Fixes
mormot.net.async
98ab0d20+6-3
net: hardened Proxy Cache background deletion even more
Impact
Proxy-cache shutdown and reconfiguration avoid background access to stale URL state, reducing crash and race exposure.
Upgrade recommended
Take with the startup guard and stress Stop or SetRemoteIP during large cache deletion.
Units
9
High
Async WebSocket heartbeats run again
TAsyncConnections.IdleEverySecond compares the current second against each allowed callback time, replacing the erroneous comparison between allowed and garbage-collection cutoff.
Fixes
mormot.net.async
505684ce+4-4
net: fixed regression in TWebSocketAsyncConnections heartbeats
Impact
TWebSocketAsyncConnections heartbeat callbacks no longer stop after the default memory-release threshold, restoring liveness traffic and stale-peer detection.
Upgrade recommended
Upgrade WebSocket async servers immediately and remove the temporary LastOperationReleaseMemorySeconds=0 workaround after validation.
Units
10
High
TUri parsing is rewritten around bounded buffers
TUri.From is rewritten and delegates to a new public FromBuffer method that parses scheme, user information, IPv6 authority, port, path, query and fragment from bounded pointers.
Under the hood
mormot.net.sock
4dd65061+152-92
net: rewritte TUri.From() method
Impact
URI parsing behavior changes broadly and gains an allocation-free entry point; the initial implementation is incomplete without the following fixes.
Upgrade recommended
Do not cherry-pick alone; land the whole sequence through 2.4.17187.
Public API
TUri.FromBufferadded — Parses a bounded URI buffer with an optional default port.TUri.Frombehaviour-changed — Now uses the new bounded RFC-oriented parser.
Units
11
Medium
SSPI exceptions report the SSPI error they received
ESynSspi.RaiseLastOSError is renamed RaiseSspiError and builds its message from the supplied SSPI status instead of appending unrelated GetLastError state; internal Check becomes CheckOK.
Breaking changes
mormot.lib.sspi+1
60ef8977+31-32
lib: fixed SSPI exception message
Impact
Windows authentication and TLS diagnostics become accurate, while external code calling the public exception helper no longer compiles until renamed.
Migration required
Grep for ESynSspi.RaiseLastOSError and replace it with ESynSspi.RaiseSspiError.
Public API
ESynSspi.RaiseLastOSErrorrenamed — Renamed to RaiseSspiError and now reports the supplied SSPI status.
12
Medium
URI validation follows RFC 3986 edge cases
TUri parsing rejects a colon in the first segment of a relative path, tightens authority, port and Location validation, and expands regression coverage for valid and malformed references.
Fixes
mormot.net.sock
96f4f5cf+69-57
net: follow RFC 3986 for URI parsing
Impact
Malformed redirect targets are rejected instead of being ambiguously interpreted; valid RFC 3986 relative references remain supported on Delphi and FPC.
Upgrade recommended
Include in the full URI sequence and test any nonstandard Location values accepted by your services.
Public API
TUri.From and TUri.FromLocationbehaviour-changed — Malformed RFC 3986 references are rejected more strictly.
Units
13
Medium
Async connection garbage collection handles tick rollover
TAsyncConnections.OneGC uses unsigned elapsed-time subtraction and clamps future last-operation values, making idle cleanup valid across 32-bit tick wrap.
Fixes
mormot.net.async
b67f5df7+12-10
net: fixed TAsyncConnections GC timing logic
Impact
Long-running async Delphi/FPC servers no longer delay or trigger connection garbage collection incorrectly around timer rollover.
Upgrade recommended
Upgrade long-running async servers and exercise idle connection cleanup.
Units
14
Medium
HTTP proxy keep-alive uses the proxy-specific header
THttpClientSocket sends Proxy-Connection: Keep-Alive for proxy traffic while retaining Connection handling for direct requests and close semantics.
Fixes
mormot.net.client
6c5201e6+8-6
net: try to fix THttpClientSocket over SQUID Proxy
Impact
Connections through SQUID-style proxies are less likely to be closed or mishandled because the intended hop-by-hop header is explicit.
Upgrade recommended
Upgrade affected proxy clients and test persistent HEAD and GET requests.
Units
15
Medium
Weekly HTTP rotation triggers at the correct time
THttpRotater reverses its tick comparison so weekly rotation runs when the current tick reaches NextTix32 rather than while the deadline is still ahead.
Fixes
mormot.net.http
1fc47dc2+4-3
net: fixed regression in THttpRotater logic
Impact
Backends relying on weekly HTTP log or file rotation resume the intended schedule instead of rotating at the wrong time.
Upgrade recommended
Upgrade services using THttpRotater and verify the next scheduled rotation.
Units
16
Medium
TSynCache resets only after its deadline
TSynCache.ResetIfNeeded now requires a nonzero fTimeoutTix and resets when the current tick reaches or passes it, replacing the reversed future-deadline check.
Fixes
mormot.core.search
f975f6ac+4-3
core: fixed TSynCache.ResetIfNeeded logic
Impact
Caches stop being cleared before expiry and now expire at the configured moment on Delphi and FPC.
Upgrade recommended
Upgrade users of timed TSynCache instances and retest hit retention and expiry.
Units
17
Medium
REST session expiry no longer loses timeout precision
TAuthSession computes fTimeOutShr10 by multiplying SessionTimeout by MilliSecsPerMin before shifting, instead of truncating the per-minute factor first.
Fixes
mormot.rest.server
75a6ffd2+3-3
rest: fixed TAuthSession timeout computation
Impact
Long-lived Delphi and FPC servers stop expiring idle sessions slightly early; a 60-minute setting previously lost up to roughly 36 seconds.
Upgrade recommended
Upgrade REST servers that depend on precise SessionTimeout boundaries and recheck expiry tests.
Units
18
Medium
TUri can resolve HTTP Location values without allocation
A public TUri.FromLocation method resolves absolute, scheme-relative, root-relative and path-relative Location values against a server, port and TLS context.
New features
mormot.net.sock
1d79356f+264-2
net: new TUri.FromLocation() method
Impact
Delphi and FPC HTTP code can replace ad hoc redirect string manipulation with a single allocation-free parser, but should take its follow-up fixes.
Worth a look
Adopt only at final build 2.4.17187 and test relative Location forms used by your servers.
Public API
TUri.FromLocationadded — Public RFC 3986-aware Location resolver.
Units
19
Medium
Redirects can force a fresh HTTP connection
THttpRedirectOption gains hroForceReconnect so THttpClientSocket closes and reopens its socket for every redirect, including same-origin targets.
New features
mormot.net.client
49fa877c+10-6
net: new hroForceReconnect option for THttpClientSocket
Impact
Clients behind SQUID/E2Guardian can avoid stale or misrouted reused connections; the empty default option set preserves existing behavior.
Worth a look
Enable hroForceReconnect only for affected proxy paths and measure the connection cost.
Public API
THttpRedirectOption.hroForceReconnectadded — Forces socket recreation on redirects.
Units
20
Medium
Async sockets can process IOCP writes directly
TAsyncConnectionsOptions gains acoIocpWriteDirect and the Windows write path may call TPollAsyncSockets.ProcessWrite directly before falling back to the queue.
Performance
mormot.net.async
7966b5fb+29-14
net: new hsoIocpWriteDirect HTTP server option for IOCP
Impact
Opt-in Windows async servers can reduce dispatch overhead; Delphi and FPC POSIX paths are unchanged.
Worth a look
Enable only through the server option and stress concurrent large responses on Windows.
Public API
TAsyncConnectionsOptions.acoIocpWriteDirectadded — Requests direct Windows IOCP write processing.TPollAsyncSockets.ProcessWritesignature-changed — Adds a defaulted direct-processing parameter on Windows.
Units
21
Medium
Windows proxy caches enable direct IOCP writes
A public hsoIocpWriteDirect server option maps to acoIocpWriteDirect, and THttpProxyServer enables it by default to reduce queued write handoffs on Windows IOCP.
Performance
mormot.net.async+1
217c0a6b+15-11
net: enhanced Proxy Cache scaling on Windows
Impact
Windows proxy-cache throughput should scale with less write-queue contention; non-Windows backends and servers without the option retain their path.
Worth a look
Benchmark proxy-cache throughput and latency on Windows before and after the default change.
Public API
THttpServerOption.hsoIocpWriteDirectadded — Enables direct IOCP write processing.
22
Low
Tests adapt to translation layers and older curl
RSA key generation relaxes its timeout under Windows PRISM, symbol discovery skips SynLogVectoredHandler, and TFTP integration tests are gated for curl versions with known retransmission problems.
Compiler & platform
mormot.core.log+2
6250c714+47-36
test: try to adapt to some LUTI conditions
Impact
CI and emulated Windows environments see fewer false failures; application behavior changes only by allowing a longer RSA timeout under PRISM.
23
Low
URI and Location parsing gain broad regression coverage
The network test suite adds extensive valid and invalid cases for TUri.From and TUri.FromLocation, including authority, IPv6, ports, query, fragment and relative resolution.
Tests
a22a5e2e+268-3
test: cover TUri.From/FromLocation methods as much as possible
Impact
No direct application change; the tests constrain the parser rewrite and expose regressions corrected by later commits.
24
Low
TUri.From coverage expands after the rewrite
Network tests add URI cases for credentials, IPv6 literals, explicit ports, paths, queries, fragments and malformed input after the parser rewrite.
Tests
d4c88e2e+33-2
tests: enhanced TUri.From() coverage
Impact
No application code impact; the expanded suite supports later parser corrections.
25
Low
FromScheme receives focused protocol tests
Network protocol tests add assertions for TUri.FromScheme across HTTP, HTTPS, WS, WSS, FTP, FTPS, LDAP and LDAPS before the final implementation fix.
Tests
5ffe448e+24-2
tests: validate TUri.FromScheme method
Impact
No application code changes; the added checks exposed the scheme-state defect fixed by the following commit.
26
Low
TFTP retry expectations are refined
TFTP server tests adjust retry and connection-count expectations to match additional request retransmissions observed by the integration suite.
Tests
4ba0e6f5+5-5
tests: refined TFTP server expectations
Impact
No application code changes; only test expectations become less brittle under retransmission.