chore(release): prepare dhttp v0.7.1

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.7.1] - 2026-10-14
+
+### Fixed
+
+- Set DHTTP client and server QUIC idle timeouts to five minutes, allowing silent long-running handlers to finish without extra heartbeat requests. Both peers must adopt the setting; QUIC still negotiates the shorter advertised timeout.
+- Standardize the identity OCSP cache at `ssl/stapling.ocsp` for dhttp-home, Endpoint loads and SDK reloads; update credential fixtures and transport tests to use the same path.
+- Stop reading the old `ssl/ocsp.der` cache. Offline deployments must prepare a valid staple at the new path before loading an identity; online OCSP preparation validates or refreshes the new cache.
+
+### Release versions
+
+| Package | Previous published version | Prepared version |
+| --- | --- | --- |
+| `dhttp` | 0.7.0 | 0.7.1 |
+| `dhttp-home` | 0.6.0 | 0.6.1 |
+| `@genmeta/dhttp / dhttpy` | 0.7.0 | 0.7.1 |
+
+`dhttp-access` remains 0.5.0 and `dhttp-log` remains 0.2.0.
+The SDK bridge version is aligned; multi-platform npm/PyPI publishing remains separate.
+
 ## [0.7.0] - 2026-10-12
 
 ### Changed

Cargo.toml

@@ -3,7 +3,7 @@
 members = ["dhttp", "home", "access", "log", "api"]
 
 [workspace.package]
-version = "0.7.0"
+version = "0.7.1"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/genmeta/dhttp"
@@ -18,14 +18,14 @@
 serde = { version = "1", features = ["derive"] }
 futures = "0.3"
 netwatcher = { version = "0.8", features = ["tokio"] }
 matchit = "0.9"
 rustls = { package = "qrustls", version = "0.23.45", default-features = false }
 tokio = { version = "1" }
 toml = "1"
 tower-service = "0.3"
 tracing = "0.1"
 x509-parser = "0.18"
 bon = "3"
 http = "1"
 http-body = "1"
 http-body-util = "0.1"
@@ -39,7 +39,7 @@
 derive_more = "2"
 clap = { version = "4", features = ["derive"] }
 chrono = { version = "0.4", features = ["serde"] }
 tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt"] }
 
 # Release dependencies use compatible crates.io versions.
 qbase = { version = "0.7.0" }
@@ -51,7 +51,7 @@
 qrecovery = { version = "0.7.0" }
 qtls = { version = "0.1.0" }
 h3x = { version = "0.7.0" }
-dhttp-home = { path = "home", version = "0.6.0", default-features = false }
-dhttp = { path = "dhttp", version = "0.7.0" }
+dhttp-home = { path = "home", version = "0.6.1", default-features = false }
+dhttp = { path = "dhttp", version = "0.7.1" }
 dhttp-access = { path = "access", version = "0.5.0" }
 dhttp-log = { path = "log", version = "0.2.0" }

README.md

@@ -53,7 +53,7 @@ Add the library and the dependencies used by these examples:
 
 ```toml
 [dependencies]
-dhttp = "0.7.0"
+dhttp = "0.7.1"
 ddns = { package = "dyns", version = "0.8.0", features = ["h3"] }
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
 http-body-util = "0.1"
@@ -154,7 +154,7 @@ mappings, while the application owns name publication.
 ## Node.js and Python SDK
 
 The native bindings follow the same endpoint model using each language's
-standard request, response and asynchronous streaming conventions. The 0.7.0
+standard request, response and asynchronous streaming conventions. The 0.7.1
 bindings can be built from [api/](api/README.md); multi-platform npm/PyPI release
 packaging remains pending.
 

RELEASING.md

@@ -1,47 +1,39 @@
-# Release preparation for v0.7.0
+# Release preparation for v0.7.1
 
 | Package | Previous published version | Prepared version |
 | --- | --- | --- |
-| `dhttp` | 0.6.2 | 0.7.0 |
-| `dhttp-home` | 0.5.0 | 0.6.0 |
-| `dhttp-access` | 0.4.2 | 0.5.0 |
-| `dhttp-log` | 0.1.0 | 0.2.0 |
-| `@genmeta/dhttp / dhttpy` | 0.6.2 | 0.7.0 |
+| `dhttp` | 0.7.0 | 0.7.1 |
+| `dhttp-home` | 0.6.0 | 0.6.1 |
+| `dhttp-access` | 0.5.0 | unchanged |
+| `dhttp-log` | 0.2.0 | unchanged |
+| `@genmeta/dhttp / dhttpy` | 0.7.0 | 0.7.1 |
+
+## Scope and upgrade
+
+Client and server endpoints advertise a five-minute QUIC idle timeout. This permits five minutes without packets and does not send periodic keepalive traffic. Update both peers to use the full window; an older peer's shorter advertised timeout still applies. Connections created before the upgrade retain their negotiated timeout.
+
+This patch release standardizes the OCSP cache at `ssl/stapling.ocsp`. Identity loading and SDK reloads use this path; the old `ssl/ocsp.der` cache is no longer read. Offline deployments must prepare a valid staple at the new path before loading an identity. With online identity preparation enabled, the existing OCSP preparation validates or refreshes the new cache. No automatic rename or change to OCSP verification is introduced.
+
+The SDK bridge and Node.js/Python binding versions are aligned with dhttp. Multi-platform npm/PyPI publishing remains separate from the crates.io workflow.
 
 ## Dependency order
 
-dquic → h3x
+dquic → h3x → dhttp-home → dhttp
 
-Manifest versions use Cargo's compatible-version requirements, without `=`.
-They allow patch updates within the selected 0.x series. External Genmeta
-dependencies come from crates.io; no sibling checkout or Git patch is required.
-The dquic TLS backend is the published qrustls 0.23.45 package, used as `rustls`
-where the application exchanges TLS types with qtls.
+Manifest versions use Cargo's compatible-version requirements, without `=`. External Genmeta dependencies come from crates.io; no sibling checkout or Git patch is required. The TLS backend remains qrustls 0.23.45, used as `rustls` where the application exchanges TLS types with qtls.
 
 ## Validation and lockfiles
 
-This PR is release preparation. Unpublished upstream versions can make CI fail;
-such failures do not confirm compilation, tests or package verification.
-For tracked lockfiles, run `cargo generate-lockfile` after upstream publication,
-review and commit the resulting registry lockfile before tagging.
-Run Cargo from a checkout outside directories containing ancestor path patches.
-Never commit a lockfile generated with local transport path overrides as the
-registry release lockfile. Re-run the normal CI checks and publish dry run after
-upstream publication and lockfile refresh; merge and tag only that checked commit.
+The workspace Cargo.lock is tracked for locked platform checks and publication. Refresh it from the published registry graph outside directories containing ancestor path patches. Preserve unrelated dependency versions; never commit local transport overrides as the release lockfile.
 
-## Publication
+Android builds require qudp 0.8.1 from the dquic v0.8.1 patch release. Retain libc 0.2.189 while nix is incompatible with the Darwin constants removed from iOS in libc 0.2.190.
+
+Before merging and tagging, require the existing formatting, Clippy, test, platform and publish dry-run workflows to pass on the release commit. Local manifest, lockfile and package-content checks do not replace compilation or runtime tests. The dry run handles the new home and dhttp packages together; publication installs dependencies first.
 
-Planned tag: `v0.7.0`. Release through the repository's GitHub Actions workflow.
-Use an annotated tag with the changelog entry as its release notes. Actual
-publication and production deployment remain separate from this preparation PR.
+## Publication
 
-Publish crates in order: dhttp-home, dhttp-access, dhttp-log, dhttp.
-The dhttp-api bridge is not a crates.io package; Node.js and Python bindings
-use version 0.7.0. The removed dhttp-identity package is not republished.
+Planned tag: `v0.7.1`. After the preparation PR is merged and checks pass, use an annotated tag with the changelog entry as its release notes. Tag-triggered GitHub Actions publishes crates and creates the GitHub Release; preparation does not publish or deploy.
 
-The workspace Cargo.lock is tracked for locked platform checks and publication.
-Refresh it from the published registry graph before each release.
+Keep the existing publication order: dhttp-home, dhttp-access, dhttp-log, dhttp. The workflow skips the unchanged access/log versions already on crates.io, so this release publishes dhttp-home 0.6.1 before dhttp 0.7.1.
 
-Android builds require qudp 0.8.1 from the dquic v0.8.1 patch release.
-The registry lockfile retains libc 0.2.189 while nix is incompatible with the
-Darwin constants removed from iOS in libc 0.2.190.
+The dhttp-api bridge is not a crates.io package; Node.js and Python bindings use version 0.7.1. The removed dhttp-identity package is not republished.

api/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dhttp-api"
-version = "0.7.0"
+version = "0.7.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

api/README.md

@@ -73,7 +73,7 @@ peers 可增补或更新；addresses() 返回当前本地绑定，用于显式
 默认 H3 DNS、mDNS 和名称发布维护仍待接入，因此当前不是完整的开箱即用发现版本。
 
 Native Node build 产物是本机构建的 dhttp.node；npm pack 可用于本机安装验证。
-多平台 npm 二进制包、其他 Python wheel 平台和发布 CI 尚未恢复。当前绑定版本为 0.7.0；多平台 npm/PyPI 发布仍待完成。
+多平台 npm 二进制包、其他 Python wheel 平台和发布 CI 尚未恢复。当前绑定版本为 0.7.1；多平台 npm/PyPI 发布仍待完成。
 
 ## 流式请求
 

api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genmeta/dhttp",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "DHTTP HTTP/3 SDK",
   "license": "Apache-2.0",
   "main": "js/index.js",

api/tests/quic_roundtrip.rs

@@ -151,7 +151,7 @@ async fn acceptance() {
     assert!(matches!(second, Err(error) if error.code == ErrorCode::AlreadyListening));
     // A failed explicit-path reload retains the previous signing capability.
     let original = alice.local_authority().await.unwrap().unwrap();
-    let ocsp_path = root.join("alice/ssl/ocsp.der");
+    let ocsp_path = root.join("alice/ssl/stapling.ocsp");
     let ocsp = fs::read(&ocsp_path).unwrap();
     fs::write(&ocsp_path, b"invalid OCSP").unwrap();
     assert!(alice.reload().await.is_err());

dhttp/src/network.rs

@@ -103,8 +103,8 @@ impl DhttpNetwork {
         scopes: Scopes,
         service: BoxService,
     ) -> Result<crate::ListenFuture> {
-        let mut quic = qconn::QuicEndpoint::from(endpoint.identity.clone());
-        quic.set_alpn(vec![h3x::ALPN.to_vec()]);
+        let quic =
+            crate::transport::configure_quic(qconn::QuicEndpoint::from(endpoint.identity.clone()))?;
         let name: Arc<str> = Arc::from(endpoint.name());
         {
             let mut listeners = self.listeners.lock().unwrap();
@@ -203,8 +203,9 @@ impl Endpoint {
             let registered = qconn::ServerRegistry::global()
                 .get(self.name())
                 .ok_or_else(|| std::io::Error::other("listener TLS registration disappeared"))?;
-            let mut quic = qconn::QuicEndpoint::from(replacement.identity.clone());
-            quic.set_alpn(vec![h3x::ALPN.to_vec()]);
+            let mut quic = crate::transport::configure_quic(qconn::QuicEndpoint::from(
+                replacement.identity.clone(),
+            ))?;
             for (id, value) in registered.server_parameters.iter() {
                 quic.set_parameters(qbase::role::Role::Server, *id, value.clone())
                     .map_err(std::io::Error::other)?;

dhttp/src/network/connection.rs

@@ -97,13 +97,13 @@ pub(super) async fn connect(
     tracing::trace!(local = ?key.names().0, remote = ?key.names().1, "outgoing QUIC handshake started");
     let (local, remote, connection) = match local {
         Some(endpoint) => {
-            let mut quic = qconn::QuicEndpoint::from(endpoint.identity.clone());
-            quic.set_alpn(vec![h3x::ALPN.to_vec()]);
+            let quic = crate::transport::configure_quic(qconn::QuicEndpoint::from(
+                endpoint.identity.clone(),
+            ))?;
             quic.connect(remote.to_string()).await?
         }
         None => {
-            let mut quic = qconn::QuicEndpoint::anonymous();
-            quic.set_alpn(vec![h3x::ALPN.to_vec()]);
+            let quic = crate::transport::configure_quic(qconn::QuicEndpoint::anonymous())?;
             quic.connect(remote.to_string()).await?
         }
     };

dhttp/src/transport.rs

@@ -5,13 +5,34 @@ use std::{
     pin::Pin,
     sync::Arc,
     task::{Context, Poll},
+    time::Duration,
 };
 
 use bytes::Bytes;
 use h3x::{ErrorCode, Role, Transport, TransportError};
 use qrecovery::{recv::StopSending, send::CancelStream};
 use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
 
+/// DHTTP permits long-running handlers without requiring application heartbeat traffic.
+pub(crate) const CONNECTION_IDLE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+
+pub(crate) fn configure_quic(
+    mut endpoint: qconn::QuicEndpoint,
+) -> crate::Result<qconn::QuicEndpoint> {
+    endpoint.set_alpn(vec![h3x::ALPN.to_vec()]);
+    // QUIC negotiates the shorter of the two advertised idle timeouts.
+    for role in [qbase::role::Role::Client, qbase::role::Role::Server] {
+        endpoint
+            .set_parameters(
+                role,
+                qbase::param::ParameterId::MaxIdleTimeout,
+                CONNECTION_IDLE_TIMEOUT,
+            )
+            .map_err(io::Error::other)?;
+    }
+    Ok(endpoint)
+}
+
 #[derive(Clone)]
 pub(crate) struct QuicTransport {
     pub(crate) connection: Arc<qconn::ArcConnection>,

dhttp/tests/dns_bootstrap.rs

@@ -106,7 +106,7 @@ fn endpoint(root: &Path, directory: &str, name: &str) -> Endpoint {
         rustls_pemfile::private_key(&mut key.as_slice())
             .unwrap()
             .unwrap(),
-        fs::read(ssl.join("ocsp.der")).unwrap(),
+        fs::read(ssl.join("stapling.ocsp")).unwrap(),
     )
     .unwrap();
     Endpoint::new(identity)

dhttp/tests/listener_lifecycle.rs

@@ -51,7 +51,7 @@ async fn listener_registers_service_and_releases_it_on_exit() {
         )
         .unwrap();
     }
-    std::fs::write(ssl.join("ocsp.der"), b"test-ocsp").unwrap();
+    std::fs::write(ssl.join("stapling.ocsp"), b"test-ocsp").unwrap();
     let other_ssl = root.join("other").join("ssl");
     std::fs::create_dir_all(&other_ssl).unwrap();
     let other_cert =
@@ -71,7 +71,7 @@ async fn listener_registers_service_and_releases_it_on_exit() {
         )
         .unwrap();
     }
-    std::fs::write(other_ssl.join("ocsp.der"), b"other-ocsp").unwrap();
+    std::fs::write(other_ssl.join("stapling.ocsp"), b"other-ocsp").unwrap();
     // This test binary has one test and sets the home before starting network tasks.
     unsafe { std::env::set_var("DHTTP_HOME", &root) };
 
@@ -151,6 +151,14 @@ async fn listener_registers_service_and_releases_it_on_exit() {
         .get(endpoint.name())
         .unwrap();
     let second = qconn::ServerRegistry::global().get(other.name()).unwrap();
+    for listener in [&first, &second] {
+        assert_eq!(
+            listener
+                .server_parameters
+                .get::<Duration>(qbase::param::ParameterId::MaxIdleTimeout),
+            Duration::from_secs(5 * 60),
+        );
+    }
     // The new QUIC callback only delivers authenticated connections. Rejecting
     // an unsupported negotiated ALPN at the H3 boundary must still be local to
     // that connection and preserve the listener registration.

dhttp/tests/quic_roundtrip.rs

@@ -107,15 +107,21 @@ async fn injected_resolver_drives_authenticated_http3_over_udp() {
                         let handshake = request.extensions().get::<HandshakeSummary>().unwrap();
                         assert_eq!(handshake.alpn.as_deref(), Some(b"h3".as_slice()));
                         assert_eq!(handshake.local.as_ref().unwrap().name(), "server.dhttp.net");
-                        if request.uri().path() == "/anonymous" {
+                        if request.uri().path().starts_with("/anonymous") {
                             assert!(handshake.remote.is_none());
                         } else {
                             assert_eq!(
                                 handshake.remote.as_ref().unwrap().name(),
                                 "client.dhttp.net"
                             );
                         }
+                        let slow = matches!(request.uri().path(), "/slow" | "/anonymous-slow");
                         let bytes = request.into_body().collect().await?.to_bytes();
+                        if slow {
+                            // Exceed both old transport defaults (20s client / 30s server)
+                            // with no response bytes or application heartbeat requests.
+                            tokio::time::sleep(Duration::from_secs(35)).await;
+                        }
                         Ok::<_, dhttp::BoxError>(http::Response::new(Full::new(bytes)))
                     }),
                 )
@@ -254,6 +260,35 @@ async fn injected_resolver_drives_authenticated_http3_over_udp() {
         2,
         "anonymous requests need a distinct reusable connection"
     );
+    let (named, anonymous) = tokio::time::timeout(Duration::from_secs(45), async {
+        tokio::join!(
+            async { client.get("https://server~/slow".parse().unwrap()).await },
+            async {
+                dhttp::Anonymous
+                    .get("https://server~/anonymous-slow".parse().unwrap())
+                    .await
+            },
+        )
+    })
+    .await
+    .expect("silent handlers must finish within the application deadline");
+    for response in [named.unwrap(), anonymous.unwrap()] {
+        assert_eq!(response.status(), http::StatusCode::OK);
+        assert!(
+            response
+                .into_body()
+                .collect()
+                .await
+                .unwrap()
+                .to_bytes()
+                .is_empty()
+        );
+    }
+    assert_eq!(
+        resolutions.load(Ordering::SeqCst),
+        2,
+        "silent responses must use the original connections"
+    );
     let reverse = tokio::time::timeout(
         Duration::from_secs(3),
         server.get("https://client~/reverse".parse().unwrap()),

dhttp/tests/support/credentials.rs

@@ -157,7 +157,7 @@ pub fn generate(root: &Path, names: &[(&str, &str)]) {
                 "-cert",
                 &cert,
                 "-respout",
-                &format!("{directory}/ocsp.der"),
+                &format!("{directory}/stapling.ocsp"),
                 "-ndays",
                 "1",
             ],
@@ -167,7 +167,7 @@ pub fn generate(root: &Path, names: &[(&str, &str)]) {
             &[
                 "ocsp",
                 "-respin",
-                &format!("{directory}/ocsp.der"),
+                &format!("{directory}/stapling.ocsp"),
                 "-issuer",
                 "ca.crt",
                 "-cert",

home/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "dhttp-home"
 description = "Local identity home and profile management for DHttp"
-version = "0.6.0"
+version = "0.6.1"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true