v1.2.1 (v1.2.1.2)

Note

v1.2.1.2 contains a bugfix for a problem with parallel HTTP requests.

What's Changed

This version of Crow needs at least C++ 17 compiler.

In addition there is an incompatible CMake option change,
starting with this version for enabling SSL is used:
CROW_ENABLE_SSL=ON
and for enabling compression:
CROW_ENABLE_COMPRESSION=ON

CI

• splitted crow features into two options by @gittiver in #770
• OSSFuzz Integration by @capuanob in #830
• OSS-Fuzz ASAN Fix by @capuanob in #844
• Enable suggest-override warning and fix instances by @fliiiix in #882
• Add compilation with libc++ and libstdc++ in CI (#785) by @StefanoPetrilli in #883
• updated CPM and Catch2, used CPM options to disable not needed catch2 options by @gittiver in #896

Packaging

• Add nixpkgs as distribution to docs by @fliiiix in #927
• Added homebrew icon and installation instructions by @The-EDev in #932
• add debian package building and upload to releases by @gittiver in #893

Bugfixes

• fixed warnings in mkdocs documentation generation by @gittiver in #820
• Improved crow/mustache.h file documentation by @8nvHHobXJ1KS in #817
• #839 Make multipart::message constructor from request explicit by @bgs99 in #842
• Fix wait of conditional variable to prevent spurious wakeup by @z16166 in #851
• Add gzip mime type by @summer-espresso in #857
• Make websocket close include the status code by @davidot in #854
• Fix 828 nested blueprints need static directory by @gittiver in #855
• Make Crow::port getter const by @bugdea1er in #863
• Multipart message view by @bgs99 in #862
• List all amalgamated headers manually by @bgs99 in #871
• Bugfix/cleanup whitespace by @fliiiix in #881
• Add const qualifier to rvalue lo method by @t-cadet in #892
• Update home.html by @jtlsc-net in #898
• #692 Add the possibility to specify "Sec-WebSocket-Protocol" by @KaSSaaaa in #693
• Return correct port if dynamic port allocation is used by @sandro97git in #901
• Makes task_timer generic by @StefanoPetrilli in #897
• Enable -Wshadow warnings by @fliiiix in #902
• changes sleep times and default timeout raised by @gittiver in #905
• Logging the missed key when accessing rvalue through operator[] by @faywong in #906
• made count method const and removed superfluous ; by @gittiver in #909
• Do not compress when body is empty by @paulharris in #921
• Tell Router to use https for the protocol, when enabled. by @paulharris in #922
• "crow::multipart::message throws when the boundary is empty or malformed by @Iuliean in #931
• fix failing task timer tests on OSX by @gittiver in #949
• Redirect to url with trailing slash, WITHOUT the protocol and host. by @paulharris in #945
• Use references explicitly, and avoid dangling references captured by complete_request_handler_ by @paulharris in #924
• added page with templates and crow applications to mkdocs by @gittiver in #950
• Check start tags were matched to an end tag by @paulharris in #923
• Fixed CMP0167 CMake warning by @bg-softcom in #964
• Remove CROW_CAN_USE_CPP14 and CROW_CAN_USE_CPP17 macros by @bugdea1er in #969
• Remove usage of deprecated Asio API by @bugdea1er in #971
• Mustache: fix segmentation fault for unexpected closing tag by @tyler92 in #977
• Add an option to expose headers for CORS by @bugdea1er in #978
• Credential is not supported if Allowed Origin is '*' by @bugdea1er in #979
• Possibility to mirror Sec-WebSocket-Protocols by @andrew-guz in #980
• added wait timeout to server start by @gittiver in #918
• Changed headers handling by @TiARETiK in #799
• replaced not reliable sleep by a asio::waitable_timer (steady_timer) … by @gittiver in #976
• Update testing documentation to use correct function by @fliiiix in #988
• replaced += by append and changed the order of strings to remove nece… by @gittiver in #974
• Refactor substr equals by find by @gittiver in #975
• added testcase for requested samples from issue by @gittiver in #991
• Fixed handling of origin when allow_credentials enabled by @TiARETiK in #985
• switch return code of OPTIONS request method between 200 and 204 depending on cmake option by @gittiver in #951
• fixed header length calculation in unittest by @gittiver in #995
• a hotfix to ssl test which depends also on the length of crow version… by @gittiver in #996

New Contributors

• @mcparry made their first contribution in #829
• @capuanob made their first contribution in #830
• @bgs99 made their first contribution in #842
• @z16166 made their first contribution in #851
• @summer-espresso made their first contribution in #857
• @davidot made their first contribution in #854
• @fliiiix made their first contribution in #882
• @jtlsc-net made their first contribution in #898
• @KaSSaaaa made their first contribution in #693
• @sandro97git made their first contribution in #901
• @faywong made their first contribution in #906
• @paulharris made their first contribution in #921
• @wsneijers made their first contribution in #940
• @bg-softcom made their first contribution in #964
• @tyler92 made their first contribution in #977
• @andrew-guz made their first contribution in #980
• @TiARETiK made their first contribution in #799

Full Changelog: v1.2.0...v1.2.1.2

v1.2.0

What's Changed

The release contains some fixes related to web sockets, a lot of small fixes and documentation improvements.

• Fix #754 by @bruvey37 in #755
• fix: minimize the precision loss when dumping double to string by @junekhan in #712
• Use const std::string& as argument to route() by @cschreib in #684
• Handle _CROW_ILL or _CROW_ICD being NOTFOUND by @DavidPetkovsek in #720
• fix: call after_handlers for legitimate requests without body part by @junekhan in #771
• add spdx license id to compiled header by @jdknight in #773
• Call middleware during upgrade request by @bruvey37 in #763
• Fixed some harmless typos. by @hporten in #776
• Allow multiple executions of validate() (#672) by @StefanoPetrilli in #676
• Add configurable exception handler by @cschreib in #637
• Add indentation to json dump method by @sina-rostami in #748
• fix: parse body when unsupported HTTP/2 upgrade is requested by @t-cadet in #783
• fix: compilation error with libc++ by @ItsAlbertZhang in #784
• Add HTTP status 406 by @ssams in #798
• Add option to use Boost.Asio by @bugdea1er in #790
• Header files documentation by @Nabzokek in #804
• Get rid of unnecessary string copies in the the keys() method by @AndreyTokmakov in #800

New Contributors

• @junekhan made their first contribution in #712
• @DavidPetkovsek made their first contribution in #720
• @jdknight made their first contribution in #773
• @hporten made their first contribution in #776
• @sina-rostami made their first contribution in #748
• @t-cadet made their first contribution in #783
• @ItsAlbertZhang made their first contribution in #784
• @ssams made their first contribution in #798
• @bugdea1er made their first contribution in #790
• @Nabzokek made their first contribution in #804
• @AndreyTokmakov made their first contribution in #800

Full Changelog: v1.1.0...v1.2.0

v1.1.0

After a long time this is the first new release, in the last year the team and all the (new) contributors fixed a lot of bugs.
Core does now only depend on standalone Casio library instead of the big boost dependencies. :)

Thanks to the The E-Dev, the Crow team and all the new contributors.

What's Changed

• Fix indentation & numbering in middleware by @bryceschober in #378
• Split up operator""_method by @beached in #383
• make multipart robust against ill-formed body, prevents SIGSEGV by @hsiegmund in #385
• #380: Update CMake config. by @luca-schlecker in #384
• documented CROW_FEATURES by @The-EDev in #392
• Fixed issue where SSL websockets wouldn't run due to HTTP upgrade by @The-EDev in #393
• Add inline decl to CORSRules helpers by @dranikpg in #395
• Add std::remove_reference to CROW_MIDDLEWARES by @The-EDev in #396
• Concatenate log into one string and sending to std::cerr instead of multiple << operator by @dhchen in #404
• Handle unknown static file extensions by @danielskeenan in #411
• Allow compiling on GCC 4.8 by @The-EDev in #399
• Fix for SecBug cpp/comparison-with-wider-type by @kingster in #416
• app: static can be an absolute path by @joelguittet in #419
• Multiple small changes by @The-EDev in #424
• Cookieparser attributes by @dranikpg in #409
• Documentation improvements by @The-EDev in #435
• Add reference to Crow in websocket connection by @The-EDev in #432
• Fix amalgamate by @The-EDev in #437
• Close websockets when app is terminated by @The-EDev in #269
• Add extra log when status code is not defined. by @konradkar2 in #434
• Add rudimentary support for websocket max payload by @DeuSCaNoN in #425
• added creating qs from request body functionality + updated doc by @The-EDev in #442
• Blueprint middleware by @dranikpg in #403
• Generic app constructor by @dranikpg in #408
• allow setting userdata in onaccept of websocket-connection by @MichaelSB in #447
• erase websocket::connection from vector in App::remove_websocket() by @MichaelSB in #450
• do not try to read from websocket after sending and receiving the clo… by @MichaelSB in #452
• Fix dead link (404) under Setting Up / Building. by @D7EAD in #459
• Webpage tutorial by @The-EDev in #451
• fix qs_parse eating first character in form keys by @aloussase in #464
• Fix failing unittests in master and 1.0 by @erikaldsund in #467
• Deboostify Crow by @luca-schlecker in #457
• Fix wvalue::operator = (wvalue && r); Number type loss problem by @wnself in #466
• overload template_t::render to accept context as an r-value by @aloussase in #465
• Add error message to Websocket onerror handler by @The-EDev in #476
• move includes outside namespace crow by @MichaelSB in #479
• rework the way asio is handled as a dependency. by @luca-schlecker in #482
• only allow regular files in set_static_file_info, return 404 in all o… by @MichaelSB in #470
• Optionally make use of Markdown 'warning' notation. by @D7EAD in #484
• Fixed issue where an index in qs_parse is incorrectly incremented beyond the maximum possible value by @The-EDev in #486
• fix CrowConfig.cmake not being able to find Findasio.cmake module. by @luca-schlecker in #492
• Fixed bug: Could not define route for HEAD method by @erikaldsund in #491
• Add response constructor overload by @aloussase in #495
• Added missing information and improved stylesheets for dark mode by @The-EDev in #496
• Sessions Middleware by @dranikpg in #448
• get_part_by_name doesn't crash on nonexistent keys by @Iuliean in #501
• Fix build warnings by @Phoenix-flame in #503
• Session fixes by @dranikpg in #505
• Find the route as soon as the URL is parsed by @The-EDev in #499
• Add template/typename keywords to crow macros by @dranikpg in #508
• static directory slash fix by @The-EDev in #507
• Fix compilation error: ambiguous overload by @erikaldsund in #513
• Cpp17 filesystem usage fixes by @erikaldsund in #514
• Fix merge_all.py by @deroskarmodulo in #518
• docs(compression): Fix vcpkg.json reference by @ryanrussell in #522
• Prevent HTTP pipelining by @The-EDev in #524
• Fix stack data disclosure when returning static files smaller than 16KiB by @mrozigor in #523
• Address #534 - handling missing mime types gracefully by @jake-arkinstall in #536
• docs(middlewares): readability improvements by @ryanrussell in #540
• websocket: Reduce number of re-allocation of string parameters by @kang-sw in #535
• refactor(websocket): readability improvements by @ryanrussell in #541
• Fix websocket crash from connection pointer dangling by @kang-sw in #530
• fix post method. by @lag945 in #550
• feat(cmake): improved debian packaging by @okaestne in #553
• Fix some valgrind reported issues by @okaestne in #560
• Fix warnings generated by clang++ by @okaestne in #561
• Fix use-after-move by @BoleynSu in #565
• Fix 381 by @hlmodi in #566
• fix optimizeNode to prevent a crash on MSVC by @leksiso in #568
• Adapt CROW_WEBSOCKET_ROUTE to accept app reference by @soehrl in #556
• Apply workaround for Apple to FreeBSD aswell by @puffetto in #578
• fix warning on non MS systems for using sprintf instead of snprintf by @gittiver in #580
• #585 : Resolves issue with blueprint assignments. by @xia-stan in #590
• fix #587 Render true and false Mustache tags by @queenstdev in #588
• Get server running port, bindaddr and threads by @xandross389 in #592
• Fix typo in unit test by @gfeyer in #595
• fix typos in app.md by @alex-lt-kong in #600
• Fix loghandler memleak by @IldarKashaev in #609
• Added possibility to return empty JSON object instead of NULL by @killoctal in #602
• add github action for build and test by @gittiver in #586
• Validate if CROW_ROUTE starts with a '/' by @StefanoPetrilli in #597
• Fixed compilation under android ndk, operator "=" was undefined by @marcrobm in #634
• Fix memory leaks caused from the http_connection by @anagno in #633
• Minor updates to docs by @robertgodfrey in #646
• Fix windows build and remove deprecated macOS10.15 builder in github action for build and test by @gittiver in #648
• Added an example for uploading files by @kiner-shah in #638
• use GNUInstallDirs for CMake installation by @topazus in #642
• Added Coveralls to GitHub Actions by @The-EDev in #657
• added const as in source by @gittiver in #659
• added cmake options for feature ssl and compression and crow amalgamate for windows in gh-actions by @gittiver in #655
• Add GitHub action for gh pages by @gittiver in #654
• added proper coveralls submission workflow by @The-EDev in #662
• fix diverse compiler warnings by @gittiver in https://github.com/CrowCpp/Crow...

v1.0+5 Security Patch

• Bug Prevent HTTP pipelining #524 CVE-2022-38667
• Bug Fix stack data disclosure when returning static files smaller than 16KiB #523 CVE-2022-38668

Thanks to hebi and Gynvael Coldwind for discovering and reporting the vulnerabilities.

v1.0+4 Security Patch

• Bug Fixed issue where an index in qs_parse is incorrectly incremented beyond the maximum possible value. #486

v1.0+3 Hotfix

• Bug Fixed multiple definition error for CORS middleware. @dranikpg #395

v1.0+2 QoL Hotfix

• Bug Fixed issue where Crow would not Compile on GCC 4.8 (due to a G++ bug). #399
• Bug Fixed exception when Crow doesn't know the extension of a static file. @danielskeenan #411
• Bug Fixed issue where Crow wouldn't compile when using CROW_MIDDLEWARES with a pass-by-reference app. #396
• Feature Allow using absolute file paths with static folders. @joelguittet #419
• Bug Fixed issue where SSL websockets wouldn't run due to HTTP upgrade. @jeanbiber #393
• Bug Fixed issue where Logs from multiple threads would be merged together. @dhchen #404
• Bug Fixed issue where responses to OPTIONS requests were missing a Content-Length header. @jeanbiber #424
• Feature Allow setting up HTTPS using SSL chain files. @jeanbiber #424
• Doxygen can now document SSL and Compression parts. #424
• Typo fixes. @stephanecharette #424

v1.0+1 Hotfix

• Bug Fixed issue where Crow wouldn't compile on GCC versions below 6.0. @sgoth #377

v1.0 Taking Flight

With this release, Crow is production ready. I'm amazed and thankful for how far this project has come and I would like to thank everyone who contributed their time, skills, and money to move this project forward.

A special thanks to Crow's newest member, @luca-schlecker. Without his work, much of this release wouldn't be possible.

Packages / Dependencies

• Proper CMake support (Crow is now a CMake target (library) as opposed to just using CMake to compile examples/tests). #228 #209 #218 #241
• Change Crow CMake dependencies based on downstream project requirements. @Leon0402 #231
• CMake install support. #228 #209 #218
• Crow can now be compiled using C++20. @Leon0402 #265
• Automated release process via release script. #162 #205 #228 #252
• CMake uninstall support. @navidcity #305
• Fixed local VCPKG manifest version. #207
• Fixed vcpkg.json to work on linux. @Borwe #330
• Added Crow license to crow_all.h. #165

Framework

• Feature Allowed multiple source files for projects using Crow without the need for #define CROW_MAIN. #280 #186 @danielytics #192 @nekoffski #354
• Feature Added a type of middleware that runs per route rather than globally. @dranikpg #327
• Feature Replaced dumb_timer_queue with new task_timer. #278
• Feature Replaced the round robin approach to assigning connections to threads to a load balancing system. @belugum #289
• Feature Improved and optimize filename sanitization function. @neumannt #321
• Feature Added Middleware to handle CORS rules. @dranikpg #348
• Bug fixed issue where absolute unix paths were not sanitized. #334
• Feature Added function to run the Crow app asynchronously. #359
• Feature Added unsafe file loading functions. @zefrenchy #339
• Feature Added Base64 decoder. #260 @neumannt #324
• Feature Added function to get the port Crow is using. @nx10 #276
• Bug Worked around GCC 8.3 bug that prevented Crow from compiling. @nx10 @CircuitCoder #287
• Feature Updated Crow's thread count process to reflect the actual number of threads being used. #307

Websockets

• Bug Fixed Issue where Crow assumes a single masked message means all other messages are masked as well. #282
• Feature Enforce Websocket protocol (opt-in). #282
• Feature Added functionality to get the remote IP address connected to the Websocket. #263

HTTP

• Feature Implemented Blueprints for project organization (similar to Flask's Blueprints). #181 #205 #208 #242
• Feature Upgraded, better integrated, and optimized the HTTP Parser Crow uses. #294 @navidcity #303 #349 @nekoffski #354 #371
• Feature Re-implemented the Trie crow uses to match rules with URLs. #166
• Bug Fixed problem where streaming a response would abruptly close the connection. #332
• Feature Crow now uses an enum for HTTP status codes (200 or status::OK can be used). #230
• Feature Added several HTTP status codes. @Zhavok92 #227 @kingster #367
• Bug Fixed issue where enabling SSL but not using it caused incorrect redirects. #281
• Feature Added app option to set threshold beyond which Crow streams a response. #245
• Feature Catch-all Routes now have receive the error code in their response object. #205
• Bug API Breaking Modified Parser to only allow GET method on HTTP/0.9. #262
• Bug Fixed problem where static file info wasn't being cleared if no file was found. #338
• Feature Added Automatic UTF-8 support through a middleware. #202
• Feature Added content type constructor for response. @hg333 #212
• Bug Replaced HTTPMethod::GET with HTTPMethod::Get in routing.h. @d35ha #191
• Feature Recognized cleartext and SSL versions of HTTP/2 upgrade header. #332
• API Breaking Fixed incorrect styling in for remote_ip_address. @himanshu007-creator #200

Multipart

• Feature API Breaking Part headers are now in a map rather than a vector. #358
• Feature Added function to get a part by name. #358
• Bug Fixed a problem where Crow failed to parse a multipart request made using .Net HttpClient. #332
• Feature API Breaking Added a boundary to the default content-type (gets set to the request's boundary if constructed from a request). #358
• Feature Parts and headers can be cast to integer or double. #358

Mustache

• Feature Added support for C++ lambdas in Mustache. #299
• Feature API Breaking Added function to set a templates directory. #362
• Bug Fixed missing ; in mustache escaping. #342
• Feature API Breaking returning page.render() from a route now sets Content-Type header to HTML. #346
• Bug Ensured const correctness in template_t. @neumannt #325

JSON

• Feature JSON values can now be initialized using initializer lists. @lcsdavid #190 #203 #242
• Bug Fixed problem where JSON would output nan or inf values. @Vhuynh25 @rremigius #328
• Bug Fixed problem with excess recursion when reading JSON. @neumannt #326
• Bug Made JSON float output faster and more accurate. #203

Logging

• Feature API Breaking Simplified creating a custom logger. #288 #290
• Feature Added Support for using local time in default logger. @kingster #368

Documentation

• Added Landing Page. #197 #201 #228
• Updated Site theme. #197 #228
• Placed financial and code contributors on landing page. #228 #311 #373
• Updated install documentation and separated instructions for different OSes. #228 #238 #293
• Added Social media cards. #197 #203 #270
• Added donate button to site header. #197
• Added indicator for features introduced after v0.1. #197
• Added HTTP Authentication tutorial. #293
• Updated documentation to mention new features. #203 #228 #372
• Made API reference more readable by removing parts only intended for internal use. #372
• Improved visibility on readme gitter badge. #228
• Fixed several typos. #297
• Used proper markdown syntax in documentation. #270

CI/CD

• Fixed issue where cpp-coveralls wasn't compatible with newer GCOV versions. #228
• Fixed issue where PR coverage would affect master coverage results. #228
• Fixed coveralls branch. #198
• Removed pip3 command from PR workflow. #270

Testing / Examples

• Examples can now compile on Windows. #209
• Tests can now compile without CROW_ENABLE_COMPRESSION being defined. #209
• Added Tests for HTTPS (SSL) version of Crow. #228 #130
• Bug Fixed issue where the response stream test would randomly fail. #234
• Tests now use Debug build (debug flags + without optimization). #228
• Added unit test for server timeout. #277
• Updated catch2 to v2.13.8. @neumannt #322
• Added tests for content type constructor for response. @hg333 #213
• Updated examples and tests to include JSON initializer lists. #190 #203
• Fixed typo in example_with_all.cpp. @odeits #161

Other

• Created a new logo. #172
• Updated Crow License. #172 #228
• Formatted framework source code using Crow's own clang-format rules (and created a bot to enforce the rules for all PRs). #286 #293

v0.3+4 Security patch

This release fixes major problems in Crow, from a potential memory leak to a few security vulnerabilities. Everyone using v0.3 is advised to update to this version as soon as possible.

This will most likely be the last update to v0.3 as we prepare for the next release.

• Bug Data leak when sending static files. #292
• Bug Incorrect handling of signal handlers. @mcopik #296
• Bug crow::json escapes UTF-8 characters above value 127. @mosolovsa #304
• Bug Path Traversal and Content Injection exploits patched. @snyk Team #317