v16.3.0+3.2.12

haproxy-boshrelease 16.3.0+3.2.12

Remark

According to the versioning guide, this should've been 16.4.0+3.2.12. As contents are not affected, we skip releasing again and stick to 16.3.0+3.2.12.

Upgrades

• HAProxy has been upgraded from v3.2.11 to v3.2.12
• socat has been upgraded from v1.8.1.0 to v1.8.1.1

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	3.2.12
keepalived	2.3.4
Lua	5.4.8
PCRE	10.47
socat	1.8.1.1

Deployment

releases:
- name: "haproxy"
  version: "16.3.0+3.2.12"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.3.0+3.2.12/haproxy-16.3.0+3.2.12.tgz"
  sha1: "6289f1da28f6c4f2669321c8cc008118bbb3dd90"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:ebf3e890cd8d2b41e7137796cd69227a6c94735ad6931e26e8920718816d7a11"

Deployment (patched)

releases:
- name: "haproxy"
  version: "16.3.0+3.2.12-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.3.0+3.2.12/haproxy-16.3.0+3.2.12-patched.tgz"
  sha1: "ab0cf2bf17fff5659bd2494a4c61f00a1bfe5868"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:6b55e7fdd205bdc5bebd3c445f0c3ce612afc0d5a6b9a6de01595a5a6c0f3270"

What's Changed

• chore(deps): bump github.com/pires/go-proxyproto from 0.9.2 to 0.10.0 in /acceptance-tests by @dependabot[bot] in #871
• chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 in /acceptance-tests by @dependabot[bot] in #872
• chore(deps): bump github.com/pires/go-proxyproto from 0.10.0 to 0.11.0 in /acceptance-tests by @dependabot[bot] in #873
• chore(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 in /acceptance-tests by @dependabot[bot] in #874
• Bump socat version to 1.8.1.1 by @CFN-CI in #875
• Bump haproxy version to 3.2.12 by @CFN-CI in #876

Full Changelog: v16.3.0+3.2.11...v16.3.0+3.2.12

v16.3.0+3.2.11

haproxy-boshrelease 16.3.0+3.2.11

Upgrades

• HAProxy has been upgraded from v3.2.9 to v3.2.11
• socat has been upgraded from v1.8.0.3 to v1.8.1.0

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	3.2.11
keepalived	2.3.4
Lua	5.4.8
PCRE	10.47
socat	1.8.1.0

Deployment

releases:
- name: "haproxy"
  version: "16.3.0+3.2.11"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.3.0+3.2.11/haproxy-16.3.0+3.2.11.tgz"
  sha1: "adad44383731c570ab711dde22e4c0ae8908fd94"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:5d5db001338672bdca5a8c36ba722a607c81efacfa098996144e9e2834eee319"

Deployment (patched)

releases:
- name: "haproxy"
  version: "16.3.0+3.2.11-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.3.0+3.2.11/haproxy-16.3.0+3.2.11-patched.tgz"
  sha1: "cd3ad078f51acf6677dabe18ca11e8e3c1a7c020"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:b82a3c9ea739ee20bf6b540c9a3197f4435b26005b4942d792fab8592f6feab9"

What's Changed

• Bump socat version to 1.8.1.0 by @CFN-CI in #852
• CI: Enhance Autobumper Script by @maxmoehl in #857
• Bump haproxy version to 3.2.10 by @CFN-CI in #858
• chore(deps): bump gitpython from 3.1.45 to 3.1.46 in /ci/scripts by @dependabot[bot] in #859
• chore(deps): bump packaging from 25.0 to 26.0 in /ci/scripts by @dependabot[bot] in #865
• Bump haproxy version to 3.2.11 by @CFN-CI in #869

Full Changelog: v16.2.0+3.2.9...v16.3.0+3.2.11

v16.2.0+3.2.9

haproxy-boshrelease 16.2.0+3.2.9

New Features

• feat: introduce a flag to enable an additional health check listener with use of the PROXY protocol by @b1tamara and @peanball in #850

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	3.2.9
keepalived	2.3.4
Lua	5.4.8
PCRE	10.47
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "16.2.0+3.2.9"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.2.0+3.2.9/haproxy-16.2.0+3.2.9.tgz"
  sha1: "cefd692671529b668c64d15e859c468fc9e76bcc"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:6b82bb02b39c902b1026b8a062772d788d84d412bf5f8de4b2cff511ae3e05ab"

Deployment (patched)

releases:
- name: "haproxy"
  version: "16.2.0+3.2.9-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.2.0+3.2.9/haproxy-16.2.0+3.2.9-patched.tgz"
  sha1: "b14481b5accecfd94ed3752608f0e10ab42aa611"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:3ab4f591b93e2cf1fe44fda13f798de64eb94b610cd3ead1d75e3eabb43dae3a"

What's Changed

• chore(deps): bump beautifulsoup4 from 4.14.2 to 4.14.3 in /ci/scripts by @dependabot[bot] in #849
• chore(deps): bump github.com/onsi/gomega from 1.38.2 to 1.38.3 in /acceptance-tests by @dependabot[bot] in #851
• chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 in /acceptance-tests by @dependabot[bot] in #853
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.3 in /acceptance-tests by @dependabot[bot] in #854
• feat: introduce additional flag for health check with proxy protocol by @b1tamara in #850

Full Changelog: v16.1.0+3.2.9...v16.2.0+3.2.9

v16.1.0+3.2.9

haproxy-boshrelease 16.1.0+3.2.9

ℹ️ Release notes are duplicated from v16.0.0+3.2.8 as "haproxy-16.0.0+3.2.8-patched.tgz" was not usable and "haproxy-16.1.0+3.2.9-patched.tgz" should be used if the patch is needed. "haproxy-16.0.0+3.2.8.tgz" from the last release can be consumed as well.

Breaking Changes

Breaking changes of haproxy 3.0:

• Stricter parsing of non-standard URIs
• Detecting accidental multiple commands sent to the Runtime API
• Rejecting the enabled keyword for dynamic servers:

Fixes

• Fixes the asset "haproxy-xx-patched.tgz" by updating the websocket patch to 3.2.x

New Features

• Requests that are too big (headers or request URL) are now appropriately handled with 414 and 431 status codes, instead of a 400 (Bad Request)

Upgrades

• HAProxy was bumped to 3.2.9 and will be maintained on the 3.2.x line of releases.

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	3.2.9
keepalived	2.3.4
Lua	5.4.8
PCRE	10.47
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "16.1.0+3.2.9"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.1.0+3.2.9/haproxy-16.1.0+3.2.9.tgz"
  sha1: "91d57dcd744fc5cfef0494a8a74072f56e5ee892"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:df372c94f694798a6a20bd6f0e6d560b20f96aef46d613c07213e38c9436f39c"

Deployment (patched)

releases:
- name: "haproxy"
  version: "16.1.0+3.2.9-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.1.0+3.2.9/haproxy-16.1.0+3.2.9-patched.tgz"
  sha1: "de88561998b14e21630d8e636da6331e8a556722"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:fc5ed39c9768db689b993dcb7b704953591c3db615f04282727b8e88c1142878"

What's Changed

• chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 in /acceptance-tests by @dependabot[bot] in #846
• fix: adjust websocket patch to 3.2 code base by @peanball in #848
• Bump haproxy version to 3.2.9 by @CFN-CI in #847

Full Changelog: v16.0.0+3.2.8...v16.1.0+3.2.9

v16.0.0+3.2.8

haproxy-boshrelease 16.0.0+3.2.8

ℹ️ The patch release "haproxy-16.0.0+3.2.8-patched.tgz" cannot be deployed, use the asset from https://github.com/cloudfoundry/haproxy-boshrelease/releases/tag/v16.1.0%2B3.2.9 instead. "haproxy-16.0.0+3.2.8.tgz" was verified and can be used.

Breaking Changes

Breaking changes of haproxy 3.0:

• Stricter parsing of non-standard URIs
• Detecting accidental multiple commands sent to the Runtime API
• Rejecting the enabled keyword for dynamic servers:

Fixes

New Features

• Requests that are too big (headers or request URL) are now appropriately handled with 414 and 431 status codes, instead of a 400 (Bad Request)

Upgrades

• HAProxy was bumped to 3.2.8 and will be maintained on the 3.2.x line of releases.

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	3.2.8
keepalived	2.3.4
Lua	5.4.8
PCRE	10.47
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "16.0.0+3.2.8"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.0.0+3.2.8/haproxy-16.0.0+3.2.8.tgz"
  sha1: "a313c9e6c85dae58a1e0f585f0646c667f6f780e"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:6818e9c1630c7391bb21a305f0cde0a60769a9a4d653118304b4cddb6ba78b39"

Deployment (patched)

releases:
- name: "haproxy"
  version: "16.0.0+3.2.8-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v16.0.0+3.2.8/haproxy-16.0.0+3.2.8-patched.tgz"
  sha1: "82973021ee13960fd5c1859e29a6b6f7f61bf4ab"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:f4ffb08036e20c90394962bd75c7cd18f8440396e72ad31ecdb9e4908a3c5081"

What's Changed

• ci autobumper: allow Haproxy 3.2 by @Dariquest in #838
• ci autobumper: Fix change log in the PR body in case of a major version jump by @Dariquest in #839
• Bump pcre2 version to 10.47 by @CFN-CI in #835
• Bump to version 3.2.8 with acceptance tests fix (431 response when HTTP request is too large) by @Dariquest in #844

Full Changelog: v15.3.0+2.8.16...v16.0.0+3.2.8

v15.3.0+2.8.16

haproxy-boshrelease 15.3.0+2.8.16

Upgrades

• HAProxy has been upgraded from v2.8.15 to v2.8.16: with the fix for CVE-2025-11230.

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.16
keepalived	2.3.4
Lua	5.4.8
PCRE	10.46
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.3.0+2.8.16"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.3.0+2.8.16/haproxy-15.3.0+2.8.16.tgz"
  sha1: "e4401238caf42a6a121da22a6457c6649fcc5943"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:3a721ddb75c34ce788b33fb21224af5ce99258a1792b125c4dee33fd1a2ce7e5"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.3.0+2.8.16-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.3.0+2.8.16/haproxy-15.3.0+2.8.16-patched.tgz"
  sha1: "68d5eb1ef01cac01140cea201614bba400f324b6"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:550b35764902fabf26a5f451326bd8e6c68ef45d9aa432d34cdcb0af9b33fd88"

v15.2.2+2.8.15

haproxy-boshrelease 15.2.2+2.8.15

Fixes

New Features

Upgrades

• pcre2 has been upgraded from v10.45 to v10.46

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.15
keepalived	2.3.4
Lua	5.4.8
PCRE	10.46
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.2.2+2.8.15"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.2+2.8.15/haproxy-15.2.2+2.8.15.tgz"
  sha1: "42161fe9e470ebd16d649ded2450cc7246d6084a"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:704d042cb23133115a0ee4f21c01e9d5a19db0983aba5b53437efe8159d42f4a"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.2.2+2.8.15-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.2+2.8.15/haproxy-15.2.2+2.8.15-patched.tgz"
  sha1: "36b2614ce604bd605c76285d73b2cc8285c565c9"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:81c6d0c57b59079092f6c1a9a8b08cc2ccfcd25c04f3444435770d265bd79019"

What's Changed

• chore(deps): bump github.com/onsi/gomega from 1.38.0 to 1.38.1 in /acceptance-tests by @dependabot[bot] in #817
• chore(deps): bump beautifulsoup4 from 4.13.4 to 4.13.5 in /ci/scripts by @dependabot[bot] in #818
• chore(deps): bump github.com/onsi/gomega from 1.38.1 to 1.38.2 in /acceptance-tests by @dependabot[bot] in #819
• Bump pcre2 version to 10.46 by @CFN-CI in #820
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.2 in /acceptance-tests by @dependabot[bot] in #821
• chore(deps): bump pygithub from 2.7.0 to 2.8.0 in /ci/scripts by @dependabot[bot] in #822
• chore(deps): bump pygithub from 2.8.0 to 2.8.1 in /ci/scripts by @dependabot[bot] in #823
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.25.2 to 2.25.3 in /acceptance-tests by @dependabot[bot] in #824

Full Changelog: v15.2.1+2.8.15...v15.2.2+2.8.15

v15.2.1+2.8.15

haproxy-boshrelease 15.2.1+2.8.15

Upgrades

• keepalived has been upgraded from v2.3.3 to v2.3.4
• Lua has been upgraded from v5.4.7 to v5.4.8

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.15
keepalived	2.3.4
Lua	5.4.8
PCRE	10.45
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.2.1+2.8.15"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.1+2.8.15/haproxy-15.2.1+2.8.15.tgz"
  sha1: "13aaf57852bd674751ae5040b1472e5b41205401"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:c4a228def5805b36765dc71bea31946f9a2cf85596783f7714a9f4ebe0741d06"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.2.1+2.8.15-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.1+2.8.15/haproxy-15.2.1+2.8.15-patched.tgz"
  sha1: "9fd1411cf4bde00172fd08fa6ed4aeb3f045bf15"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:f64dbc95c611938b037ea4374a70b0723b6b1eb9f6a72fdaa636aed5350071c4"

What's Changed

• doc: add release process doc by @Soha-Albaghdady in #798
• chore(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0 in /acceptance-tests by @dependabot[bot] in #800
• Bump lua version to 5.4.8 by @CFN-CI in #799
• chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 in /acceptance-tests by @dependabot[bot] in #801
• chore(deps): bump requests from 2.32.3 to 2.32.4 in /ci/scripts by @dependabot[bot] in #802
• Bump keepalived version to 2.3.4 by @CFN-CI in #803
• Add changelog to haproxy autobump PRs by @mtekel in #804
• chore(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 in /acceptance-tests by @dependabot[bot] in #805
• chore(deps): bump github.com/onsi/gomega from 1.37.0 to 1.38.0 in /acceptance-tests by @dependabot[bot] in #807
• chore(deps): bump gitpython from 3.1.44 to 3.1.45 in /ci/scripts by @dependabot[bot] in #809
• chore(deps): bump thor from 1.2.1 to 1.4.0 by @dependabot[bot] in #808
• chore(deps): bump pygithub from 2.6.1 to 2.7.0 in /ci/scripts by @dependabot[bot] in #810
• chore(deps): bump golang.org/x/crypto from 0.40.0 to 0.41.0 in /acceptance-tests by @dependabot[bot] in #811
• chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 in /acceptance-tests by @dependabot[bot] in #812
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.23.4 to 2.24.0 in /acceptance-tests by @dependabot[bot] in #813
• chore(deps): bump requests from 2.32.4 to 2.32.5 in /ci/scripts by @dependabot[bot] in #814
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.24.0 to 2.25.0 in /acceptance-tests by @dependabot[bot] in #815
• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.25.0 to 2.25.1 in /acceptance-tests by @dependabot[bot] in #816

Full Changelog: v15.2.0+2.8.15...v15.2.1+2.8.15

v15.2.0+2.8.15

haproxy-boshrelease 15.2.0+2.8.15

Fixes

• fix: properly check if TCP should be drained by @maxmoehl

New Features

• feat: add block reason for the cases where HAProxy denies the requests because of specific conditions, like Host header and SNI mismatch, or other custom deny conditions by @b1tamara

Upgrades

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.15
keepalived	2.3.3
Lua	5.4.7
PCRE	10.45
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.2.0+2.8.15"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.0+2.8.15/haproxy-15.2.0+2.8.15.tgz"
  sha1: "0349614ee0792305445416ceb7f95d8731c15834"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:f22816e9adf17ffb118e54e1e6f4da8b340833ff15d269778e295bc65ab331be"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.2.0+2.8.15-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.2.0+2.8.15/haproxy-15.2.0+2.8.15-patched.tgz"
  sha1: "c6b1f446955abf428d278b22d71de737312fd2e9"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:8bb9e24ac15698f8fab6872dd0b7def28f583561a95ddf3a3a8e075923c8572c"

What's Changed

• clean: remove long unmaintained docs and code by @maxmoehl in #794
• fix: properly check if TCP should be drained by @maxmoehl in #795
• feat: add block reason for http_request_deny_conditions by @b1tamara in #796
• feat: add block reason for http request deny by @b1tamara in #797

Full Changelog: v15.1.0+2.8.15...v15.2.0+2.8.15

v15.1.0+2.8.15

haproxy-boshrelease 15.1.0+2.8.15

Fixes

New Features

Upgrades

• HAProxy has been upgraded from 2.8.14 to 2.8.15

Versions

The following versions of upstream components are included in this haproxy-boshrelease:

Component	Version
HAProxy	2.8.15
keepalived	2.3.3
Lua	5.4.7
PCRE	10.45
socat	1.8.0.3

Deployment

releases:
- name: "haproxy"
  version: "15.1.0+2.8.15"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.1.0+2.8.15/haproxy-15.1.0+2.8.15.tgz"
  sha1: "87de2c7d011862eb5717654bf4a24aeec21ea41d"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:d62b2daf993789a0292a44f037d647fa14fae1fc5c6b01df2005ddc5bde4ab24"

Deployment (patched)

releases:
- name: "haproxy"
  version: "15.1.0+2.8.15-patched"
  url: "https://github.com/cloudfoundry/haproxy-boshrelease/releases/download/v15.1.0+2.8.15/haproxy-15.1.0+2.8.15-patched.tgz"
  sha1: "c2ab0453fa7a33e468140c86180cdca394406491"

# for deployments with sha256, use the following line instead:
# sha1: "sha256:abc6b4240a25b8c79ee8cb0ceff07d0dd543599e5d907ad72ae71897e5e973c0"

What's Changed

• Bump haproxy version to 2.8.15 by @CFN-CI in #791

Full Changelog: v15.0.0+2.8.14...v15.1.0+2.8.15