Hi, HAProxy 3.5-dev3 was released on 2026/07/22. It added 59 new commits after version 3.5-dev2.
A few bugs were fixed all over the place (20), nothing really important. Those using dynamic servers a lot could be interested because a few bugs possibly happening after a "delete server" operation were addressed. Another fix is a change of behavior when "stats admin" and "stats scope" are used together: while "stats scope" was meant (and documented) as only being used to filter the reported proxies, it sounds legit to expect it to also apply to proxies modified with "stats admin", which was not the case. This was changed to match natural expectations in the very unlikely case someone would expose both together in a public config, but anyway it was estimated that the risk that someone relies on these is even lower than the risk that someone uses them together (none found in 3k+ github issues). Regarding the other visible changes: - ssl: the aws-lc library can be built in FIPS mode or normal mode, but contrary to OpenSSL, it doesn't restrict usable ciphers. Now we are able to detect how it was built and to automatically restrict the list of usable ciphers to those permitted by FIPS. In addition, building with the aws-lc library without specifying USE_OPENSSL_AWSLC=1 will now report an error. It used to work by accident for a while thanks to the great API compatibility between the libs, and wouldn't necessarily use the correct versions of some functions. Since the addition of FIPS detection it's even more visible because the build would break on missing symbols when the option is missing, so instead we emit a clearer error message. - cache: the cache now supports storing and producing early-hints responses (HTTP 103): instead of completely purging objects from the cache to make room for new ones, those having Link headers can be stripped to keep only these headers and stay longer. This allows to keep entries for lots of objects, that can be found later upon a future lookup for the same object, allowing haproxy to immediately return a 103 with the Link headers before even passing the request to the server. This permits the client to preload the suggested objects while the server computes the response. By default the feature is off, but may be enabled with "early-hints on" or "early-hints only" in the cache section. A ratio of stripped objects can be specified as well. The stats page reports the number of hits on such objects below the other cache stats (under sessions/total). See also RFC 8297 for more details on this nice feature. - the rest is essentially doc and regtest updates. Things are pretty calm these days, so this is another good reason for updating at very low risk with the latest fixes and features, especially if your applications already emit Link headers and you want to experiment with the early-hints cache. Please find the usual URLs below : Site index : https://www.haproxy.org/ Documentation : https://docs.haproxy.org/ Wiki : https://github.com/haproxy/wiki/wiki Discourse : https://discourse.haproxy.org/ Slack channel : https://slack.haproxy.org/ Issue tracker : https://github.com/haproxy/haproxy/issues Q&A from devs : https://github.com/orgs/haproxy/discussions Sources : https://www.haproxy.org/download/3.5/src/ Git repository : https://git.haproxy.org/git/haproxy.git/ Git Web browsing : https://git.haproxy.org/?p=haproxy.git Changelog : https://www.haproxy.org/download/3.5/src/CHANGELOG Dataplane API : https://github.com/haproxytech/dataplaneapi/releases/latest OpenTelemetry : https://github.com/haproxytech/haproxy-opentelemetry Pending bugs : https://www.haproxy.org/l/pending-bugs Reviewed bugs : https://www.haproxy.org/l/reviewed-bugs Code reports : https://www.haproxy.org/l/code-reports Latest builds : https://www.haproxy.org/l/dev-packages Willy --- Complete changelog : Amaury Denoyelle (7): BUG/MINOR: ssl: fix proxy lookup for show ssl sni DOC: fix typo in "del ssl ech" command DOC: remove outdated experimental mention on dynamic backends BUG/MEDIUM: proxy: protect "show servers ..." against server deletion BUG/MEDIUM: proxy: protect "show servers ..." against backend deletion BUG/MEDIUM: proxy: protect show backend against be deletion MINOR: proxy: stress CLI commands with backends/servers loop Christopher Faulet (7): BUG/MINOR: hlua: Apply socket timeout on server side only BUG/MEDIUM: applet: Reenable reads in applet context if requesting a connection BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes() BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim() BUG/MINOR: sample: Fix bytes() when length it greater than remaining data Frederic Lecaille (3): BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift BUG/MEDIUM: protobuf: fix nested path bypass in field lookup REGTESTS: protobuf: add regression test for nested vs flat paths Maxime Henrion (22): BUG/MINOR: shctx: fix shctx_row_data_get() when offset exceeds a block MINOR: shctx: clamp shctx_row_data_get() reads against the offset DOC: stats: document the per-proxy byte count fields in the CSV list BUG/MEDIUM: cache: reattach the row when a secondary entry is incomplete MINOR: http: add two header parsing functions MINOR: cache: minor changes ahead of support for sending early hints MINOR: cache: add config options for early hints support MINOR: cache: add helper functions for early hints support MINOR: shctx: allow consumers to customize eviction strategy MINOR: cache: track full and hints entries in per-pool LRU lists MEDIUM: cache: early hints-aware eviction code MINOR: cache: indicate whether entries are stripped or not MINOR: http: factor 103 emission into start/end helpers MEDIUM: cache: emit early hints if configured to do so MINOR: cache: add a counter for cache hits serving early hints MINOR: cache: allow opting out of early hints at the rule level MINOR: cache: allow customizing ratio for early hints REGTESTS: cache: validate the emission of 103s MINOR: cache: factor cache_extract_link_hints out of cache_extract_hints MEDIUM: cache: add support for hints-only HTTP caches CLEANUP: cache: align the cache_hint_hits increment with its siblings DEBUG: add BUG_ON_STATIC(): a compile-time BUG_ON() Olivier Houchard (7): BUILD: haload: Increase a buffer size so that gcc will stop complaining BUILD: task: Fix build when no 8B CAS is available at all BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs DOC: stats: Document that stats admin is vulnerable to a CSRF attack BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done CLEANUP: event_hdl: Use BUG_ON_STATIC() BUG/MEDIUM: server: Properly check for streams before deletion William Lallemand (9): MEDIUM: ssl: introduce src/fips.c with TLS version check MEDIUM: ssl: add FIPS TLS 1.2 cipher check for AWS-LC MEDIUM: ssl: set FIPS-approved cipher defaults for AWS-LC FIPS builds MEDIUM: ssl: add FIPS TLS 1.3 ciphersuite check for AWS-LC MEDIUM: ssl: set FIPS-approved curve defaults for AWS-LC FIPS builds MEDIUM: ssl: add FIPS elliptic curve check for AWS-LC MEDIUM: ssl: set FIPS-approved sigalgs defaults for AWS-LC FIPS builds MEDIUM: ssl: add FIPS signature algorithm check for AWS-LC BUILD: Makefile: error when trying to build with aws-lc with the wrong flags Willy Tarreau (4): MINOR: stats: factor the proxy vs scope check into its own function BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope" filtering DOC: internals: update core-principles with initializations BUG/MINOR: resolvers: do not index resolvers names in the proxies ---
