All Versions
7
Latest Version
Avg Release Cycle
219 days
Latest Release
78 days ago
Changelog History
Changelog History
-
v1.3.2 Changes
March 29, 2026What's Changed
🚀 The main reason for this release is the the fix of a possible Header injection:
- 🔒 [Security] Prevent HTTP Response Header Injection by sanitizing CR/LF characters by @notfresh in #1167
🚀 These changes are also included in the release:
- Minor features to crow::json::wvalue by @CarloDG80 in #1143
- 📜 Fix heap-buffer-overflow in query_string when parsing malformed '%'Fix heap-buffer-overflow in query_string for malformed '%' by @shan-tanu-joshi-3010 in #1134
- 🔋 Feature#1129-CMake Error: ALIAS target "Boost::system" name collision… by @EmBachlitzanakis in #1133
- 🏗 Enable compiler sanitizers for test builds, fixed new bugs found with them by @shan-tanu-joshi-3010 in #1154
- 🛠 Fix build on OpenBSD by @Wisdurm in #1162
- Populate headers for HTTP OPTIONS requests by @DavidPetkovsek in #1062
🆕 New Contributors
- @CarloDG80 made their first contribution in #1143
- @shan-tanu-joshi-3010 made their first contribution in #1134
- @Wisdurm made their first contribution in #1162
- @notfresh made their first contribution in #1167
Full Changelog : v1.3.1...v1.3.2
-
v1.3.1 Changes
February 11, 2026🛠 This release is mainly a bugfix release which takes last fixes from master branch.
What's Changed
🛠 Most important fixes are these, they fix issues with websockets:
- Protect websockets_ by mutex by @andrew-guz in #1136
- 🛠 fix for #1107 - websocket failure by @gittiver in #1113
🛠 In addition these fixes are applied too:
- 🔀 bugfix for errors on asio::write on do_sync_write() by @gittiver in #1116
- 📜 Use string_view in CookieParser::before_handle parsing by @Sightem in #1024
- replaced old trim function based on std::string by one using string_view by @gittiver in #1105
- 🏗 move CPM to CROW_BUILD_TESTS scope by @amhenze in #1121
- Replace uint16_t with size_t for rule/blueprint routing to eliminate narrowing warnings by @boulabiar in #1118
- Alternative to uint16 t cast by @gittiver in #1117
- ✂ removed double lookup by count() and find() by @gittiver in #1131
- 🛠 fix for issue #1127 Small oob read in
qs_scanvaluewhen the key is not found - increment qs only if '&' was found by @gittiver in #1132 - ➕ added http status codes from RFC 2518 (WebDAV) by @gittiver in #1144
🆕 New Contributors
- @amhenze made their first contribution in #1121
- @boulabiar made their first contribution in #1118
Full Changelog : v1.3.0...v1.3.1
-
v1.3.0 Changes
October 13, 2025What's Changed
➕ Add unix domain socket support by @na-trium-144 in #803
🚀 The most important change in this release is support for unix domain sockets as server sockets.➕ Adds SBOM generation using cmake-sbom by @StefanoPetrilli in #1066
The CMake build scripts supports now the generation of an SBOM, there is a new CMake option CROW_GENERATE_SBOM for this.
🛠 A lot of outstanding small bugs was fixed, the most important are maybe these:
- 🛠 Fix "load balancing" not working by @ino-josh in #1050
- 🛠 fix for catch all route does not get fully parsed request by @gittiver in #1076
🏗 @StefanoPetrilli overhauled the GitHub CI scripts, we build now with Boost::asio, standalone asio, clang or gcc, libstdc++ or libc++.
🛠 A lot of other small fixes and improvements were done by the community of contributors:
- 🛠 Fix for middleware using unsteady clock by @finn-nerd in #999
- 🔀 Synchronious write stream handling fix by @TiARETiK in #1000
- ⬆️ Bumped the minimum C++ version from 11 to 17 in docs by @Guiorgy in #1001
- 📚 Update minimum ASIO version requirement in getting started documentation by @HiGuyJanni in #1008
- 🛠 Fix deprecated literal operator warning in Clang 20 by @HiGuyJanni in #1015
- Omit Server header when server_name is empty by @Sightem in #1021
- 🏗 [doc] Default CMake Build Requires Linking Against OpenSSL and Zlib by @jameshu15869 in #1030
- 🛠 FIX: "bind: Address already in use" by @nyaruku in #1028
- 🛠 Log invalid port (fixes #952) by @HiGuyJanni in #1037
- 🗄 corrected minimal asio version for deprecated functions by @gittiver in #1039
- ➕ Add new template project with Docker support out of the box by @landiluigi746 in #1041
- [SSL_MD] ADDED fullchain certificate usage in ssl.md by @OBEsensia in #1044
- ➕ Adding bazelmod by @sebastianbergt in #1009
- Clean up: Relocate Method to HTTP server by @EmBachlitzanakis in #1049
- ⚡️ Update socket_adaptors.h by @marcuradu2 in #1051
- ⚠ Compiler warning fixes by @gittiver in #870
- 👉 Use error_code from correct namespace by @hpcdgrie in #1055
- logger optimisation by @gittiver in #1056
- ⚡️ update OSS-Fuzz build script by @AdamKorcz in #1063
- ➕ Add is_bound() helper for checking server bind state by @maredman in #1065
- Solves compilation error when using Boost by @StefanoPetrilli in #1070
- ➕ Adds Boost to ci by @StefanoPetrilli in #1071
- 📚 Documentation Dark Mode Font/Background (Issue #695) by @Adrian1161 in #1073
- ➕ added star history diagram by @gittiver in #1072
- 🔨 Refactors Build and Test CI by @StefanoPetrilli in #1079
- include CPM via CMAKE_CURRENT_SOURCE_DIR by @aumuell in #1083
- 🛠 Fix Boost::system search for 1.89 and later by @IgnatSergeev in #1082
- ➕ Add option to search for boost if enabled by @bmarques1995 in #1085
- ➕ Add content type to set static file info by @mketas in #1086
- Solves websocket memory leak by @StefanoPetrilli in #1080
- ✅ Isolate utility tests by @nicholashanson in #1090
- 🔨 Refactor routing_params test and isolate HTTP response tests by @nicholashanson in #1088
- 🛠 Fix a regression on MacOS by @puffetto in #1095
- ➕ Add missing include to http_server.h by @beached in #1094
- 🔨 Refactor/isolate json tests by @nicholashanson in #1092
- 🔨 Refactor/isolate websocket tests by @nicholashanson in #1091
- 🔨 Refactor/isolate mustache tests by @nicholashanson in #1093
- url_display: correctly display v6 addresses by @autoantwort in #1096
- ➕ add nsis install step by @gittiver in #1102
- 🍎 gitignore: Add macOS files and more files from QtCreator by @autoantwort in #1100
- ➕ added test for issue #1042 by @gittiver in #1061
🆕 New Contributors
- @finn-nerd made their first contribution in #999
- @Guiorgy made their first contribution in #1001
- @HiGuyJanni made their first contribution in #1008
- @Sightem made their first contribution in #1021
- @jameshu15869 made their first contribution in #1030
- @nyaruku made their first contribution in #1028
- @landiluigi746 made their first contribution in #1041
- @OBEsensia made their first contribution in #1044
- @sebastianbergt made their first contribution in #1009
- @ino-josh made their first contribution in #1050
- @EmBachlitzanakis made their first contribution in #1049
- @marcuradu2 made their first contribution in #1051
- @hpcdgrie made their first contribution in #1055
- @AdamKorcz made their first contribution in #1063
- @maredman made their first contribution in #1065
- @Adrian1161 made their first contribution in #1073
- @aumuell made their first contribution in #1083
- @IgnatSergeev made their first contribution in #1082
- @bmarques1995 made their first contribution in #1085
- @mketas made their first contribution in #1086
- @nicholashanson made their first contribution in #1090
Full Changelog : v1.2.1.2...v1.3.0
-
v1.2.1 Changes
February 10, 2025Note
🛠 v1.2.1.2 contains a bugfix for a problem with parallel HTTP requests.
What's Changed
This version of Crow needs at least C++ 17 compiler.
In addition there is an incompatible CMake option change,
starting with this version for enabling SSL is used:
CROW_ENABLE_SSL=ON
and for enabling compression:
CROW_ENABLE_COMPRESSION=ONCI
- splitted crow features into two options by @gittiver in #770
- OSSFuzz Integration by @capuanob in #830
- OSS-Fuzz ASAN Fix by @capuanob in #844
- ⚠ Enable suggest-override warning and fix instances by @fliiiix in #882
- ➕ Add compilation with libc++ and libstdc++ in CI (#785) by @StefanoPetrilli in #883
- ⚡️ updated CPM and Catch2, used CPM options to disable not needed catch2 options by @gittiver in #896
Packaging
- ➕ Add nixpkgs as distribution to docs by @fliiiix in #927
- ➕ Added homebrew icon and installation instructions by @The-EDev in #932
- ➕ add debian package building and upload to releases by @gittiver in #893
🛠 Bugfixes
- 🛠 fixed warnings in mkdocs documentation generation by @gittiver in #820
- 👌 Improved crow/mustache.h file documentation by @8nvHHobXJ1KS in #817
- #839 Make
multipart::messageconstructor fromrequestexplicit by @bgs99 in #842 - 🛠 Fix wait of conditional variable to prevent spurious wakeup by @z16166 in #851
- ➕ Add gzip mime type by @summer-espresso in #857
- 👉 Make websocket close include the status code by @davidot in #854
- 🛠 Fix 828 nested blueprints need static directory by @gittiver in #855
- 👉 Make Crow::port getter const by @bugdea1er in #863
- Multipart message view by @bgs99 in #862
- List all amalgamated headers manually by @bgs99 in #871
- 🛠 Bugfix/cleanup whitespace by @fliiiix in #881
- ➕ Add const qualifier to rvalue lo method by @t-cadet in #892
- ⚡️ Update home.html by @jtlsc-net in #898
- #692 Add the possibility to specify "Sec-WebSocket-Protocol" by @KaSSaaaa in #693
- Return correct port if dynamic port allocation is used by @sandro97git in #901
- 👉 Makes task_timer generic by @StefanoPetrilli in #897
- ⚠ Enable -Wshadow warnings by @fliiiix in #902
- 🔄 changes sleep times and default timeout raised by @gittiver in #905
- 🌲 Logging the missed key when accessing rvalue through operator[] by @faywong in #906
- 🚚 made count method const and removed superfluous ; by @gittiver in #909
- Do not compress when body is empty by @paulharris in #921
- Tell Router to use https for the protocol, when enabled. by @paulharris in #922
- "crow::multipart::message throws when the boundary is empty or malformed by @Iuliean in #931
- 🛠 fix failing task timer tests on OSX by @gittiver in #949
- Redirect to url with trailing slash, WITHOUT the protocol and host. by @paulharris in #945
- Use references explicitly, and avoid dangling references captured by complete_request_handler_ by @paulharris in #924
- ➕ added page with templates and crow applications to mkdocs by @gittiver in #950
- Check start tags were matched to an end tag by @paulharris in #923
- 🛠 Fixed CMP0167 CMake warning by @bg-softcom in #964
- Remove
CROW_CAN_USE_CPP14andCROW_CAN_USE_CPP17macros by @bugdea1er in #969 - ✂ Remove usage of deprecated Asio API by @bugdea1er in #971
- Mustache: fix segmentation fault for unexpected closing tag by @tyler92 in #977
- ➕ Add an option to expose headers for CORS by @bugdea1er in #978
- 👍 Credential is not supported if Allowed Origin is '*' by @bugdea1er in #979
- Possibility to mirror Sec-WebSocket-Protocols by @andrew-guz in #980
- ➕ added wait timeout to server start by @gittiver in #918
- 🔄 Changed headers handling by @TiARETiK in #799
- replaced not reliable sleep by a asio::waitable_timer (steady_timer) … by @gittiver in #976
- 📚 Update testing documentation to use correct function by @fliiiix in #988
- 🚚 replaced += by append and changed the order of strings to remove nece… by @gittiver in #974
- 🔨 Refactor substr equals by find by @gittiver in #975
- ➕ added testcase for requested samples from issue by @gittiver in #991
- 🛠 Fixed handling of origin when allow_credentials enabled by @TiARETiK in #985
- switch return code of OPTIONS request method between 200 and 204 depending on cmake option by @gittiver in #951
- 🛠 fixed header length calculation in unittest by @gittiver in #995
- 🚑 a hotfix to ssl test which depends also on the length of crow version… by @gittiver in #996
🆕 New Contributors
- @mcparry made their first contribution in #829
- @capuanob made their first contribution in #830
- @bgs99 made their first contribution in #842
- @z16166 made their first contribution in #851
- @summer-espresso made their first contribution in #857
- @davidot made their first contribution in #854
- @fliiiix made their first contribution in #882
- @jtlsc-net made their first contribution in #898
- @KaSSaaaa made their first contribution in #693
- @sandro97git made their first contribution in #901
- @faywong made their first contribution in #906
- @paulharris made their first contribution in #921
- @wsneijers made their first contribution in #940
- @bg-softcom made their first contribution in #964
- @tyler92 made their first contribution in #977
- @andrew-guz made their first contribution in #980
- @TiARETiK made their first contribution in #799
Full Changelog : v1.2.0...v1.2.1.2
-
v1.2.0 Changes
May 28, 2024What's Changed
📚 The release contains some fixes related to web sockets, a lot of small fixes and documentation improvements.
- 🛠 Fix #754 by @bruvey37 in #755
- 🛠 fix: minimize the precision loss when dumping double to string by @junekhan in #712
- 👉 Use
const std::string&as argument toroute()by @cschreib in #684 - Handle _CROW_ILL or _CROW_ICD being NOTFOUND by @DavidPetkovsek in #720
- 🛠 fix: call after_handlers for legitimate requests without body part by @junekhan in #771
- ➕ add spdx license id to compiled header by @jdknight in #773
- ⬆️ Call middleware during upgrade request by @bruvey37 in #763
- 🛠 Fixed some harmless typos. by @hporten in #776
- 👍 Allow multiple executions of
validate()(#672) by @StefanoPetrilli in #676 - ➕ Add configurable exception handler by @cschreib in #637
- ➕ Add indentation to json dump method by @sina-rostami in #748
- 🛠 fix: parse body when unsupported HTTP/2 upgrade is requested by @t-cadet in #783
- 🛠 fix: compilation error with libc++ by @ItsAlbertZhang in #784
- ➕ Add HTTP status 406 by @ssams in #798
- ➕ Add option to use Boost.Asio by @bugdea1er in #790
- 📚 Header files documentation by @Nabzokek in #804
- Get rid of unnecessary string copies in the the keys() method by @AndreyTokmakov in #800
🆕 New Contributors
- @junekhan made their first contribution in #712
- @DavidPetkovsek made their first contribution in #720
- @jdknight made their first contribution in #773
- @hporten made their first contribution in #776
- @sina-rostami made their first contribution in #748
- @t-cadet made their first contribution in #783
- @ItsAlbertZhang made their first contribution in #784
- @ssams made their first contribution in #798
- @bugdea1er made their first contribution in #790
- @Nabzokek made their first contribution in #804
- @AndreyTokmakov made their first contribution in #800
Full Changelog : v1.1.0...v1.2.0
-
v1.1.0 Changes
January 23, 2024🚀 After a long time this is the first new release, in the last year the team and all the (new) contributors fixed a lot of bugs.
Core does now only depend on standalone Casio library instead of the big boost dependencies. :)Thanks to the The E-Dev, the Crow team and all the new contributors.
What's Changed
- 🛠 Fix indentation & numbering in middleware by @bryceschober in #378
- Split up operator""_method by @beached in #383
- 👉 make multipart robust against ill-formed body, prevents SIGSEGV by @hsiegmund in #385
- ⚡️ #380: Update CMake config. by @luca-schlecker in #384
- documented CROW_FEATURES by @The-EDev in #392
- 🛠 Fixed issue where SSL websockets wouldn't run due to HTTP upgrade by @The-EDev in #393
- ➕ Add inline decl to CORSRules helpers by @dranikpg in #395
- Add
std::remove_referenceto CROW_MIDDLEWARES by @The-EDev in #396 - 🌲 Concatenate log into one string and sending to std::cerr instead of multiple << operator by @dhchen in #404
- 🖐 Handle unknown static file extensions by @danielskeenan in #411
- 👍 Allow compiling on GCC 4.8 by @The-EDev in #399
- 🛠 Fix for SecBug cpp/comparison-with-wider-type by @kingster in #416
- app: static can be an absolute path by @joelguittet in #419
- Multiple small changes by @The-EDev in #424
- 📜 Cookieparser attributes by @dranikpg in #409
- 📚 Documentation improvements by @The-EDev in #435
- ➕ Add reference to
Crowin websocket connection by @The-EDev in #432 - 🛠 Fix amalgamate by @The-EDev in #437
- Close websockets when app is terminated by @The-EDev in #269
- ➕ Add extra log when status code is not defined. by @konradkar2 in #434
- ➕ Add rudimentary support for websocket max payload by @DeuSCaNoN in #425
- ➕ added creating qs from request body functionality + updated doc by @The-EDev in #442
- 🖨 Blueprint middleware by @dranikpg in #403
- Generic app constructor by @dranikpg in #408
- 👍 allow setting userdata in onaccept of websocket-connection by @MichaelSB in #447
- 🚚 erase websocket::connection from vector in App::remove_websocket() by @MichaelSB in #450
- do not try to read from websocket after sending and receiving the clo… by @MichaelSB in #452
- 🛠 Fix dead link (404) under Setting Up / Building. by @D7EAD in #459
- Webpage tutorial by @The-EDev in #451
- 🛠 fix qs_parse eating first character in form keys by @aloussase in #464
- 🛠 Fix failing unittests in master and 1.0 by @erikaldsund in #467
- Deboostify Crow by @luca-schlecker in #457
- 🛠 Fix wvalue::operator = (wvalue && r); Number type loss problem by @wnself in #466
- overload template_t::render to accept context as an r-value by @aloussase in #465
- ➕ Add error message to Websocket
onerrorhandler by @The-EDev in #476 - 🚚 move includes outside namespace crow by @MichaelSB in #479
- rework the way asio is handled as a dependency. by @luca-schlecker in #482
- only allow regular files in set_static_file_info, return 404 in all o… by @MichaelSB in #470
- ⚠ Optionally make use of Markdown 'warning' notation. by @D7EAD in #484
- 🛠 Fixed issue where an index in qs_parse is incorrectly incremented beyond the maximum possible value by @The-EDev in #486
- 🛠 fix CrowConfig.cmake not being able to find Findasio.cmake module. by @luca-schlecker in #492
- 🛠 Fixed bug: Could not define route for HEAD method by @erikaldsund in #491
- ➕ Add response constructor overload by @aloussase in #495
- ➕ Added missing information and improved stylesheets for dark mode by @The-EDev in #496
- Sessions Middleware by @dranikpg in #448
- get_part_by_name doesn't crash on nonexistent keys by @Iuliean in #501
- 🛠 Fix build warnings by @Phoenix-flame in #503
- 🛠 Session fixes by @dranikpg in #505
- 📜 Find the route as soon as the URL is parsed by @The-EDev in #499
- ➕ Add template/typename keywords to crow macros by @dranikpg in #508
- static directory slash fix by @The-EDev in #507
- 🛠 Fix compilation error: ambiguous overload by @erikaldsund in #513
- 🛠 Cpp17 filesystem usage fixes by @erikaldsund in #514
- 🛠 Fix merge_all.py by @deroskarmodulo in #518
- 📄 docs(compression): Fix
vcpkg.jsonreference by @ryanrussell in #522 - Prevent HTTP pipelining by @The-EDev in #524
- 🛠 Fix stack data disclosure when returning static files smaller than 16KiB by @mrozigor in #523
- ➕ Address #534 - handling missing mime types gracefully by @jake-arkinstall in #536
- 📄 docs(middlewares): readability improvements by @ryanrussell in #540
- websocket: Reduce number of re-allocation of string parameters by @kang-sw in #535
- 🔨 refactor(websocket): readability improvements by @ryanrussell in #541
- 🛠 Fix websocket crash from connection pointer dangling by @kang-sw in #530
- 🛠 fix post method. by @lag945 in #550
- feat(cmake): improved debian packaging by @okaestne in #553
- 🛠 Fix some valgrind reported issues by @okaestne in #560
- 🛠 Fix warnings generated by clang++ by @okaestne in #561
- 🛠 Fix use-after-move by @BoleynSu in #565
- 🛠 Fix 381 by @hlmodi in #566
- 🛠 fix optimizeNode to prevent a crash on MSVC by @leksiso in #568
- Adapt CROW_WEBSOCKET_ROUTE to accept app reference by @soehrl in #556
- ↪ Apply workaround for Apple to FreeBSD aswell by @puffetto in #578
- 🛠 fix warning on non MS systems for using sprintf instead of snprintf by @gittiver in #580
- 🖨 #585 : Resolves issue with blueprint assignments. by @xia-stan in #590
- 🛠 fix #587 Render true and false Mustache tags by @queenstdev in #588
- Get server running port, bindaddr and threads by @xandross389 in #592
- 🛠 Fix typo in unit test by @gfeyer in #595
- 🛠 fix typos in app.md by @alex-lt-kong in #600
- 🛠 Fix loghandler memleak by @IldarKashaev in #609
- ➕ Added possibility to return empty JSON object instead of NULL by @killoctal in #602
- ➕ add github action for build and test by @gittiver in #586
- Validate if CROW_ROUTE starts with a '/' by @StefanoPetrilli in #597
- 🛠 Fixed compilation under android ndk, operator "=" was undefined by @marcrobm in #634
- 🛠 Fix memory leaks caused from the http_connection by @anagno in #633
- ⚡️ Minor updates to docs by @robertgodfrey in #646
- 🛠 Fix windows build and remove deprecated macOS10.15 builder in github action for build and test by @gittiver in #648
- ➕ Added an example for uploading files by @kiner-shah in #638
- 👉 use GNUInstallDirs for CMake installation by @topazus in #642
- ➕ Added Coveralls to GitHub Actions by @The-EDev in #657
- ➕ added const as in source by @gittiver in #659
- ➕ added cmake options for feature ssl and compression and crow amalgamate for windows in gh-actions by @gittiver in #655
- ➕ Add GitHub action for gh pages by @gittiver in #654
- ➕ added proper coveralls submission workflow by @The-EDev in #662
- 🛠 fix diverse compiler warnings by @gittiver in https://github.com/CrowCpp/Crow...
-
v1.0 Changes
August 24, 2022BugPrevent HTTP pipelining #524 CVE-2022-38667BugFix stack data disclosure when returning static files smaller than 16KiB #523 CVE-2022-38668
Thanks to hebi and Gynvael Coldwind for discovering and reporting the vulnerabilities.