- Upgraded to Netty 4.1.107
- No longer throw an
IllegalStateExceptionwhen setting the status on an errored response, as the exception will be thrown later in a more intuitive place when IO is attempted
- Allow custom
SecurityContextimplementations to be declared in jax-rs method parameters.
- Fixed bug (issue #45)
server.sslInfo().certificates()would fail to get cert info after the SSL certs are changed at runtime
- Upgraded to Netty 4.1.104
Breaking changes: this is the first major release of mu-server. There is no
new functionality since the previous version except to remove all methods, parameters and classes that were
@Deprecated in the
If you have been using deprecated methods, you may wish to:
- Use mu-server version
- Follow all the deprecation warnings. The javadoc will explain how to fix each deprecation warning.
- Upgrade to the latest version
Tip for maven users: to download sources for all dependencies, run
- Removed deprecated features
- Upgraded to Netty 4.1.101
- Upgraded to Netty 4.1.100
- When an exception is encountered when writing a jax-rs response entity and the response has not started, clear the added headers so that the exception handler can add its own headers without clashing.
- Upgraded to Netty 4.1.95
- Implemented the JAX-RS Response
readEntityand buffer options. Closing the response no longer throws an exception.
- Upgraded to Netty 4.1.94
- Bug fix: when no rate limiters are specified,
MuServer.rateLimiters()returns an empty list (instead of throwing an exception).
- OpenAPI JSON does not write values when no values are specified, allowing
clients to apply their own defaults. Fixes a bug where
explodewas incorrectly set sometimes causing queries from UIs such as swagger to add commas into array values rather than having multiple parameters.
- Upgraded to Netty 4.1.91
- Bug fix: when a request path starts with
//the request gets redirected with the extra slash removed, rather than the previous behaviour where the first path segment would be ignored.
- Upgraded to Netty 4.1.89
- Downgraded to Netty 4.1.84 (from 4.1.87) because versions 4.1.85 to 4.1.87 have a memory leak issue when reading request bodies.
- JAX-RS responses over HTTP2 will ignore
connectionheaders, as per HTTP2 spec.
- Added getters to
Http2ConfigBuilderto expose the current values on those builders.
0.73.1 and 0.73.2 were not released.
- Add support for Mutual TLS / client certificates
- Pre-constructed KeyStore objects can now be passed to the HttpsBuilder
- When reading binary data from a web socket, the binary data can optionally be held and released at a later time via a new callback
- Updated to Netty 4.1.87
Mutils.pathAndQuery(URI)method to quickly get the path with querystring from a URI.
- Updated to Netty 4.1.86
- mp4 files are now served with the
io.muserver.rest.CORSConfigBuilder.toHandlerso that CORS handlers can be more conveniently created from CORS config.
There were no releases for 0.72.18, and 0.72.19.
- Unmatched CORS responses will no longer put "null" as an allowed origin as per https://w3c.github.io/webappsec-cors-for-developers/#avoid-returning-access-control-allow-origin-null
- Updated to Netty 4.1.82
- Updated to Netty 4.1.78
UriBuilder.uri()method to handle encoded paths and query string values
- Added support for converting comma-separated
MuRequest.clientIP()to get an IP address taking into account forwarded headers.
- Bug fix: When a write fails, don't try to update the response state if the response state is already in an end state.
- Bug fix: Made it so unhandled exception handlers that stream custom errors get closed when completed.
- Bug fix: Made async SSE publishers (which includes jax-rs
SseSinks) detect client disconnections and mark the publisher as closed
- Allow collections of
UploadedFileobjects in JAX-RS method parameters to be wildcard types, primarily to make it work with Kotlin lists
- Changed default idle timeout from 5 mins to 10 mins as it appeared to be a little too aggressive for some use cases
- Upgraded to Netty 4.1.77
- Updated to Netty 4.1.75
MuServerBuilder.withExceptionHandlerto allow custom exception handlers
- Added ability to send partial websocket messages
- In web socket listeners, Continuation frames are no longer aggregated; instead an
isLastparameter has been added to
onText. This is non-breaking to existing implementations in that they will just ignore the
isLastflag. The existing callback functions are marked as deprecated and so implementers should move to the versions with the
- Added a few
toString()methods to various classes just to make logging and debugging a bit nicer
- #36 Allow JAX-RS resources to implement interfaces with default implementations
- Fixed bug where a request body input stream closed twice would cause an exception
- Fixed bug where request bodies that exceeded the maximum upload limit could leak memory for a time
- Improved the back pressure of HTTP/2 connections when request bodies are being uploaded
There was no releases for 0.72.3.
- HEAD responses that set no content-length no longer set a content-length of 0 (there should be no content-length header)
Versions from 0.71.4 to 0.72.0 included a change to enabled OCSP staping which was subsequently rolled back due to the reasons described here so this 0.72.1 release includes changes from 0.71.x.
Headers.toString()no longer prints the values of
authorizationheaders in order to reduce the chance of accidentally logging potentially sensitive information (the header names are still printed however the value printed will be
(hidden)). To customize (or disable) value redaction,
Headers.toString(Collection<String> toSuppress)can be used.
- Updated to Netty 4.1.72
- Updated to Netty 4.1.71
- Added support for JAX-RS
qsparameters to specify server-preferred types and uses same sorting algorithm as the JAX-RS method matching algorithm
JaxRSResponseset (rather than add) headers which should only ever have one value, such as
- Bug fix: in JAX-RS, when
SPLIT_ON_COMMAis on and an empty string is given an empty list (rather than a list with an empty string) is returned for collection parameters
- Older versions of Mu Server's JAX-RS implementation automatically split string collection query string
parameter values on commas, which while convenient was against the spec. This behaviour is now optional but
by default the only way to specify multiple query string parameters is by having multiple name-value pairs
of the parameter. In order to prevent this being a breaking change, upon starting the server if it is
detected that your server may be affected then the server will not start and you will be forced to set
the value of this with the
- Fix: Allow JAX-RS filters to change URI information and headers referenced by
HeaderParamannotations in resource methods
- Fix: Correct annotations are passed to custom message body readers and writers
- Cookies can be injected as JAX-RS parameters like so:
@CookieParam Cookie cookie
- Added support for path segments and matrix parameters in JAX-RS methods
- Allow custom annotations to be used on HTTP methods in JAX-RS (as long as they are supported by Mu Server).
The 0.70.x releases contained a breaking change that was reverted in 0.71.0 and so these releases should be skipped and ignored.
- Allow JAX-RS request precondition evaluation
- JAX-RS Content negotiation now supported
- Allow jax-rs
Requestobjects to be injected to methods with the
0.62.3 and 0.62.4 were not released.
- JAX-RS entity reader interceptors can now be registered on a
This includes changes in the 0.62.0 release which was not published.
- In OpenAPI JSON, custom schemas are now exposed in the
/components/schemassection of the JSON (although it is not currently referenced elsewhere).
- Upgraded to Netty 4.1.70
- Path params in sub resource locators are now documented in OpenAPI JSON documents
- Allow JAX-RS filters to retrieve the Mu Request and
ResourceInfoobjects from properties. Example:
ResourceInfo resourceInfo = (ResourceInfo) requestContext.getProperty(MuRuntimeDelegate.RESOURCE_INFO_PROPERTY);(or use
MuRuntimeDelegate.MU_REQUEST_PROPERTYto get the Mu Request).
- Upgraded to Netty 4.1.69
0.61.14 was not released
- Made it so when downloading a fixed-size file from the file system, but the file is being
written to, then only the number of bytes that were there when the download was started will be sent
(such that the
content-lengthheader won't clash with the response body size).
- Upgraded to Netty 4.1.66
0.61.11 was not released
- Fix: fixed bug where in certain issues HTTP2 data frames could be out of order
- Fixed bug in HTTP2 back pressure handling where frames waiting in a queue when writing is paused due to back pressure could be skipped.
0.61.6, 0.61.7 and 0.61.8 were not released.
- Fixed bug where during certain HTTP2 back pressure scenarios, the publishing of frames may be unduly delayed.
0.61.4 was not released.
- Fixed bug where a 408 Request Timeout may be sent even when a request body is being sent data faster than the request timeout.
- Fixed the completion state of request bodies which would not be marked as "complete" in certain situations.
- Fixed bug where serving static resources from multiple classpath jars would not work.
This includes changes from the unpublished 0.61.0 release
- Fixed memory leaks when using HTTP2
- When a JAX-RS filter uses
abortWith(Response)an exception mapper is no longer invoked with that Response mapped in a
- Fixed bug where a response thrown in a post-match filter that didn't have a
content-typeset was throwing a Server exception.
- Upgraded to Netty 4.1.63
0.60.7 was not released.
- Upgraded to Netty 4.1.62
0.60.5 and 0.60.4 were not released.
- JAX RS input streams are now closed even if the consumer doesn't. This prevents JAXRS requests that have unclosed input stream readers from hanging.
- Allow fixed-length request body uploads that are greater than around 2.6gb
(or to be specific, where the request size is greater than
This includes changes from the unpublished 0.60.0 version.
- Major changes to the way IO is working under the hood to fix several back-pressure related bugs and to make transferring of data in requests and responses more efficient.
- Allow form parameter uploads to be larger than the java heap size (when uploads are streamed to disk for example)
- Non-alphanumeric unreserved characters (
~_-.) are not percent encoded when passed to handlers. This allows non-urlencoded route declarations such as
image/avifas a supported mime type
- Fixed encoding issue where multibyte characters split over http chunks in result bodies would be corrupted when reading the body as a complete string
- If a connection dies between submitting it to the executor and the execution starting, then it should be considered rejected due to overload.
- Moved the websocket onConnection handler to only after an upgrade is successful
- Fixing disconnection-during-upgrade race condition on websockets
- Fixed oversized request bodies to be rejected correctly for various body readers
- The web socket session end state is ERROR or TIME_OUT when the API user doesn't close the socket
- Made JAX-RS string response size calculation more memory efficient
Fileobjects can be
@FormParamparameters in JAX RS methods
- Rate limit buckets are now exposed in the server interface so you can see how many requests are in progress for each bucket
- Upgraded to Netty 4.1.56
- In JAX-RS, if a sub-resource locator method throws a web application exception, then use that for the client response
- Better cancelling of in-flight requests when idle timeout hits in HTTP 1
0.56.1 contained changes in test code only.
- Fix: don't send 408s if the full request has been read
- Fixed bug where PKCS12 certs with no SANs could through a Null pointer exception on startup
- Added support for reading and writing
YearMonthobjects in JAX RS methods. For example you can use parameters such as
@QueryParam("date") LocalDate date