Releases

Enable TCP_NODELAY by default.
Enable automatic cleartext HTTP/2 detection for HttpServer::bind() and listen() when the http2 feature is enabled.
Deprecate HttpServer::bind_auto_h2c() and listen_auto_h2c() methods.
Add HttpServer::auto_h2c(bool) method.

Add support for extracting multi-component path params into a sequence (Vec, tuple, ...).
Minimum supported Rust version (MSRV) is now 1.89.

Add MultipartFormConfig::max_parts() with a default global limit of 100 parts per form.
Add MultipartCollect::max_parts() and support the derive attribute #[multipart(max_parts = 10)]. The lower of the form limit and the global limit applies.

Send GOAWAY to HTTP/2 connections during graceful server shutdown and close them once their in-flight streams finish.

Fix HTTP/1 client response framing for informational, 204, and 304 responses to prevent consumption of the next response.

Increase the default form payload limit to 32 KiB.
Bound decompressed request payloads using the same configured size limits for form, JSON, bytes, and string extractors. GHSA-qph8-7859-gq2f
Add UrlencodedError::OverflowUnknownLength error enum variant for form payloads that exceed the limit while streaming.
Add a UTF-8 encoded filename* parameter in ContentDisposition::attachment() for non-ASCII filenames.
Return 405 with an Allow header from the built-in app default when method guards reject matching resources, including macro routes.

Reject bare LF as last chunk terminator in chunked encodings. GHSA-2q7f-mf9f-5qhr

actix-multipart: v0.8.8