v3.3-dev12

Breaking Changes

📅 Nov 8, 2025📦 haproxyView on GitHub →

⚠ 2 breaking✨ 14 features🐛 33 fixes⚡ 2 deprecations🔧 26 symbols

Summary

This release introduces automatic SSL on QUIC servers, optional AAD parameter support for AES-GCM, and various bug fixes including a crash fix on non-x86 platforms. Several configuration options and keywords have been deprecated or modified for improved compatibility and robustness.

⚠️ Breaking Changes

The 'master-worker' keyword in configuration files is now deprecated when used alone. To fix this, ensure 'master-worker' is used in conjunction with other relevant keywords or consider alternative configurations.
The 'daemon' configuration option is no longer compatible with the '-Ws' flag. Adjust your configuration or command-line arguments to avoid this conflict.

Migration Steps

If using 'master-worker' alone in your configuration, ensure it is used with other relevant keywords or adjust your configuration.
If using the 'daemon' configuration option with the '-Ws' flag, modify your configuration or command-line arguments to avoid this incompatibility.

✨ New Features

QUIC servers now automatically enable SSL.
Optional AAD parameter support has been added to aes_gcm_enc/dec.
A FIPS version can now be built without FIPS.
Temporary key pairs can be generated for ACME.
Key pairs can be generated for ACME when no files are available.
Counters for req_in/req_out/res_in/res_out have been added for fe/be/srv/li.
Stats about request and response bytes received and sent have been added.
A function to get the amount of data in the output buffer has been added to applets.
Support for 'ist' has been added to word fingerprinting functions.
env_suggest() has been added to suggest alternate variable names.
parse_line's error pointer now points to unknown variable names.
The cfgparse module now attempts to suggest correct variable names on errors.
Improved traces for peers.
The 'bytes' field has been added to req_{in,out} and res_{in,out} names in sample/stats.

🐛 Bug Fixes

Ensured fair round robin iteration in resolvers.
Fixed a crash on non-x86 platforms caused by an unaligned cast in stats-file.
Fixed a crash on client handshake abort in QUIC.
Fixed a 414 / 431 status code reporting issue in mux-h1.
Ensured that a dead connection is not moved to idle in mux-h2.
Permitted the permanent removal of an idle connection.
Ensured that expiration is handled on all stick tables.
Fixed a wrong function name in ckch_conf_kws during SSL/CKCH build.
Fixed signedness and unused variables in acme_gen_tmp_x509().
Fixed an initialization issue in acme_gen_tmp_x509().
Fixed ckch_conf_kws parsing without ACME during SSL/CKCH build.
Fixed a possible crash on error paths in ACME.
Fixed the wrong dns-01 challenge in ACME logs.
Fixed an update message parsing issue during a full resync in peers.
Ensured updates are seen as local in stick-tables.
Used aligned allocations for struct proxy.
Used aligned allocations for struct proxy_per_tgroup.
Closed a race around ready_srv when deleting a server.
Emitted a warning for empty args when not in discovery mode.
Resolved the empty argument problem again.
Fixed rpath in AWS-LC install for openssl and bssl bin during build-ssl script.
Fixed an issue where the connection argument was removed from qc_new_conn().
Fixed an issue where the conn member was not set if ssl_sock_ctx was present.
Added a rwlock to the path parameter in the server.
Ensured srv_reset_path_parameters() is called on srv up.
Made sure not to move a dead connection to idle in mux-h2.
Made sure we handle expiration on all tables in stick-tables.
Fixed ckch_conf_kws parsing without ACME.
Moved the lock inside srv_add_idle().
Allowed 'key' when generating a certificate in ACME.
Limited the 'tune.maxpollevents' parameter to 1000000.
Rejected configs with empty arguments.
Replaced offset calculation with offsetof to avoid UB in cebtree.

⚡ Deprecations

The 'master-worker' keyword in configuration files is deprecated when used alone.
The 'master-worker' keyword in configuration files is deprecated.