Skip to content

Commit a898c45

Browse files
committed
Update docs, changelog, clarify policy
1 parent d878b42 commit a898c45

4 files changed

Lines changed: 58 additions & 17 deletions

File tree

CHANGELOG.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog
22

3+
## v1.19.2 (2026-05-14)
4+
5+
### Security
6+
7+
* [Plug.Parsers.MULTIPART] Consider overall length when decoding multipart headers
8+
39
## v1.19.1 (2025-12-09)
410

511
### Bug fixes
@@ -23,6 +29,12 @@ This release requires Elixir v1.14+ and it bumps the recommended :strong and :co
2329

2430
* [Plug.Conn.Adapter] Deprecate `:owner` field
2531

32+
## v1.18.2 (2026-05-14)
33+
34+
### Security
35+
36+
* [Plug.Parsers.MULTIPART] Consider overall length when decoding multipart headers
37+
2638
## v1.18.1 (2025-07-01)
2739

2840
### Enhancements
@@ -38,6 +50,12 @@ This release requires Elixir v1.14+ and it bumps the recommended :strong and :co
3850
* [Plug.RequestID] Allow metadata key to be customizable
3951
* [Plug.Router] Allow match to dispatch to function plugs
4052

53+
## v1.17.1 (2026-05-14)
54+
55+
### Security
56+
57+
* [Plug.Parsers.MULTIPART] Consider overall length when decoding multipart headers
58+
4159
## v1.17.0 (2025-03-14)
4260

4361
### Enhancements
@@ -54,6 +72,12 @@ This release requires Elixir v1.14+ and it bumps the recommended :strong and :co
5472
* [Plug.Conn] Deprecate `owner` field. Tracking responses is now part of adapters
5573
* [Plug.Test] Deprecate `use Plug.Test` in favor of imports
5674

75+
## v1.16.3 (2026-05-14)
76+
77+
### Security
78+
79+
* [Plug.Parsers.MULTIPART] Consider overall length when decoding multipart headers
80+
5781
## v1.16.2 (2025-03-14)
5882

5983
### Bug fixes
@@ -81,6 +105,12 @@ This release requires Elixir v1.14+ and it bumps the recommended :strong and :co
81105
* Parse media types with underscores in them
82106
* Do not crash on `max_age` set to nil (for consistency)
83107

108+
## v1.15.4 (2026-05-14)
109+
110+
### Security
111+
112+
* [Plug.Parsers.MULTIPART] Consider overall length when decoding multipart headers
113+
84114
## v1.15.3 (2024-01-16)
85115

86116
### Enhancements

README.md

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -342,24 +342,15 @@ Finally, remember all interactions in our official spaces follow our [Code of Co
342342

343343
## Supported Versions
344344

345+
Bug fixes only for the current release. Security patches for the last four minor releases. For example:
346+
345347
| Branch | Support |
346348
|--------|--------------------------|
347-
| v1.15 | Bug fixes |
348-
| v1.14 | Security patches only |
349-
| v1.13 | Security patches only |
350-
| v1.12 | Security patches only |
351-
| v1.11 | Security patches only |
352-
| v1.10 | Security patches only |
353-
| v1.9 | Unsupported from 10/2023 |
354-
| v1.8 | Unsupported from 01/2023 |
355-
| v1.7 | Unsupported from 01/2022 |
356-
| v1.6 | Unsupported from 01/2022 |
357-
| v1.5 | Unsupported from 03/2021 |
358-
| v1.4 | Unsupported from 12/2018 |
359-
| v1.3 | Unsupported from 12/2018 |
360-
| v1.2 | Unsupported from 06/2018 |
361-
| v1.1 | Unsupported from 01/2018 |
362-
| v1.0 | Unsupported from 05/2017 |
349+
| v1.20 | Bug fixes |
350+
| v1.19 | Security patches only |
351+
| v1.18 | Security patches only |
352+
| v1.17 | Security patches only |
353+
| v1.16 | Security patches only |
363354

364355
## License
365356

lib/plug/conn.ex

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1215,6 +1215,11 @@ defmodule Plug.Conn do
12151215
* `:read_timeout` - sets the timeout for each socket read, defaults to
12161216
`5_000` milliseconds
12171217
1218+
> #### Request length {: .warning}
1219+
>
1220+
> The `:length` option tracks the maximum length within a single call.
1221+
> When doing multiple across to `read_part_headers/2` and `read_part_body/2`,
1222+
> it is your responsability to track the overall response length.
12181223
"""
12191224
@spec read_part_headers(t, Keyword.t()) ::
12201225
{:ok, headers, t} | {:error, :too_large, t} | {:done, t}
@@ -1258,6 +1263,21 @@ defmodule Plug.Conn do
12581263
if there is no more body.
12591264
12601265
It accepts the same options as `read_body/2`.
1266+
1267+
## Options
1268+
1269+
* `:length` - sets the maximum number of bytes to read from the body on
1270+
every call, defaults to `8_000_000` bytes
1271+
* `:read_length` - sets the amount of bytes to read at one time from the
1272+
underlying socket to fill the chunk, defaults to `1_000_000` bytes
1273+
* `:read_timeout` - sets the timeout for each socket read, defaults to
1274+
`15_000` milliseconds
1275+
1276+
> #### Request length {: .warning}
1277+
>
1278+
> The `:length` option tracks the maximum length within a single call.
1279+
> When doing multiple across to `read_part_headers/2` and `read_part_body/2`,
1280+
> it is your responsability to track the overall response length.
12611281
"""
12621282
@spec read_part_body(t, Keyword.t()) :: {:ok, binary, t} | {:more, binary, t} | {:done, t}
12631283
def read_part_body(%Conn{adapter: {adapter, state}} = conn, opts) do

mix.exs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
defmodule Plug.MixProject do
22
use Mix.Project
33

4-
@version "1.19.1"
4+
@version "1.20.0-dev"
55
@description "Compose web applications with functions"
66
@xref_exclude [Plug.Cowboy, :ssl]
77
@source_url "https://github.com/elixir-plug/plug"

0 commit comments

Comments
 (0)