We have released nghttp2 v1.48.0.

lib

This release adds RFC9218 Extensible Prioritization Scheme for HTTP. It is enabled by submitting NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES via nghttp2_submit_settings(). See Stream priorities section of Programmers’ Guide.

It fixes the stream stall bug when the initial window size is decreased.

build

Now applications can be built with Libressl 3.5.

If --enable-lib-only configure option is used, no application libraries are checked.

src

The default TLS cipher suites are updated.

ktls support has been added to nghttp, nghttpd, nghttpx, and h2load if they are built with OpenSSL >= 3.0.0.

nghttpd

This release fixes the bug that stalls TLS read operation.

nghttpx

nghttpx by default disables RFC 7540 tree based HTTP/2 priorities and uses RFC 9218 priorities instead. It has a fallback mechanism to RFC 7540 if client does not send SETTINGS_NO_RFC7540_PRIORITIES.

affinity-cookie-stickiness backend parameter has been added.

The session affinity feature which had been broken for quite some time has been fixed.

third-party

llhttp has been updated to the latest version.

mruby has been updated to 3.1.0.

neverbleed has been updated the latest version with some amends.