On behalf of the OpenRresty team, I am happy to announce the new formal release, 1.27.1.1, of our OpenResty web platform based on NGINX and LuaJIT. You can check the full release note here:

http://openresty.org/en/ann-1027001001.html

Both the (portable) source code distribution, the Win32/Win64 binary distribution, and the pre-built binary Linux packages for all those common Linux distributions are provided on this Download page. You can download the software packages here:

http://openresty.org/en/download.html

Special thanks go to all our developers and contributors! And thanks OpenResty Inc. for sponsoring a lot of the OpenResty core development work.

Version highlights

The highlights of this release include:

  • OpenSSL: upgraded from version 1.1.1 to 3.0.15
  • PCRE: upgraded from version 8.45 to 10.42
  • Added http_v3_module to official prebuilt packages
  • Added http_slice_module to official prebuilt packages
  • LuaJIT
    • Improved error handling and stack overflow management
    • Enhanced cross-32/64 bit and deterministic bytecode generation
    • Disabled hash computation optimization in the OpenResty branch due to potential severe performance degradation (CVE-2024-39702). This issue only exists in the OpenResty branch (agentzh-v2.1) and not in upstream LuaJIT. We thank Zhongwei Yao from Kong Inc. for reporting this issue.
  • Improved keepalive and balancer functionality
  • New SSL-related features, including support for trusted certificates in client verification
  • Added support for deriving keys from TLS master secret
  • Implemented ngx_http_lua_ffi_ssl_client_random and related functions
  • lua-resty-websocket
    • Added send_continue method
    • Support for custom sec-websocket-key in client
    • Added support for connecting to unix sockets
  • lua-resty-string
    • Added AAD support in AES GCM
    • Made random.bytes cryptographically strong by default
  • lua-resty-redis
    • upgraded to v0.31 with performance optimizations
  • lua-cjson
    • updated to 2.1.0.14 with Lua 5.3 and 5.4 integer support For a comprehensive list of changes, please refer to the provided webpage.

Full Changelog

The HTML version of the change log with lots of helpful hyper-links can be browsed here:

https://openresty.org/en/changelog-1027001.html

Homepage

OpenResty is a full-fledged web platform by bundling the standard Nginx core, Lua/LuaJIT, lots of 3rd-party Nginx modules and Lua libraries, as well as most of their external dependencies. See OpenResty’s homepage for details:

https://openresty.org/

QA

We have run extensive testing on our Amazon EC2 test cluster and ensured that all the components (including the Nginx core) play well together. The latest test report can always be found here:

https://qa.openresty.org/

Commercial Version

We also always run our OpenResty Edge commercial software based on the latest open source version of OpenResty in our own global CDN network (dubbed “mini CDN”) powering our openresty.org and openresty.com websites. See https://openresty.com/ for more details.

Feedback

We appreciate your feedback on this release. Feel free to create new GitHub issues or send emails to one of our mailing lists.