deps: bump pingora-timeout from 0.6.0 to 0.8.0

[dependabot]

Bumps pingora-timeout from 0.6.0 to 0.8.0.

Release notes

Sourced from pingora-timeout's releases.

Pingora 0.8.0

0.8.0 - 2026-03-02

🚀 Features

• Add support for client certificate verification in mTLS configuration.
• Add upstream_write_pending_time to Session for upload diagnostics.
• Pipe subrequests utility: creates a state machine to treat subrequests as a "pipe," enabling direct sending of request body and writing of response tasks, with a handler for error propagation and support for reusing a preset or captured input body for chained subrequests.
• Add the ability to limit the number of times a downstream connection can be reused
• Add a system for specifying and using service-level dependencies
• Add a builder for pingora proxy service, e.g. to specify ServerOptions.

🐛 Bug Fixes

• Fix various Windows compiler issues.
• Handle custom ALPNs in s2n impl of ALPN::to_wire_protocols() to fix s2n compile issues.
• Fix: don't use “all” permissions for socket.
• Fix a bug with the ketama load balancing where configurations were not persisted after updates.
• Ensure http1 downstream session is not reused on more body bytes than expected.
• Send RST_STREAM CANCEL on application read timeouts for h2 client.
• Start close-delimited body mode after 101 is received for WebSocket upgrades. UpgradedBody is now an explicit HttpTask.
• Avoid close delimit mode on http/1.0 req.
• Reject invalid content-length http/1 requests to eliminate ambiguous request framing.
• Validate invalid content-length on http/1 resp by default, and removes content-length from the response if transfer-encoding is present, per RFC.
• Correct the custom protocol code for shutdown: changed the numeric code passed on shutdown to 0 to indicate an explicit shutdown rather than a transport error.

⚙️ Miscellaneous Tasks

• Remove CacheKey::default impl, users of caching should implement cache_key_callback themselves
• Allow server bootstrapping to take place in the context of services with dependents and dependencies
• Don't consider "bytes=" a valid range header: added an early check for an empty/whitespace-only range-set after the bytes= prefix, returning 416 Range Not Satisfiable, consistent with RFC 9110 14.1.2.
• Strip {content, transfer}-encoding from 416s to mirror the behavior for 304 Not Modified responses.
• Disable CONNECT method proxying by default, with an option to enable via server options; unsupported requests will now be automatically rejected.

Pingora 0.7.0

0.7.0 - 2026-01-30

Highlights

• Extensible SslDigest to save user-defined TLS context
• Add ConnectionFilter trait for early TCP connection filtering

🚀 Features

• Add ConnectionFilter trait for early TCP connection filtering
• Introduce a virtual L4 stream abstraction
• Add support for verify_cert and verify_hostname using rustls
• Exposes the HttpProxy struct to allow external crates to customize the proxy logic.
• Exposes a new_mtls method for creating a HttpProxy with a client_cert_key to enable mtls peers.
• Add SSLKEYLOGFILE support to rustls connector

... (truncated)

Changelog

Sourced from pingora-timeout's changelog.

0.8.0 - 2026-03-02

🚀 Features

• Add support for client certificate verification in mTLS configuration.
• Add upstream_write_pending_time to Session for upload diagnostics.
• Pipe subrequests utility: creates a state machine to treat subrequests as a "pipe," enabling direct sending of request body and writing of response tasks, with a handler for error propagation and support for reusing a preset or captured input body for chained subrequests.
• Add the ability to limit the number of times a downstream connection can be reused
• Add a system for specifying and using service-level dependencies
• Add a builder for pingora proxy service, e.g. to specify ServerOptions.

🐛 Bug Fixes

• Fix various Windows compiler issues.
• Handle custom ALPNs in s2n impl of ALPN::to_wire_protocols() to fix s2n compile issues.
• Fix: don't use “all” permissions for socket.
• Fix a bug with the ketama load balancing where configurations were not persisted after updates.
• Ensure http1 downstream session is not reused on more body bytes than expected.
• Send RST_STREAM CANCEL on application read timeouts for h2 client.
• Start close-delimited body mode after 101 is received for WebSocket upgrades. UpgradedBody is now an explicit HttpTask.
• Avoid close delimit mode on http/1.0 req.
• Reject invalid content-length http/1 requests to eliminate ambiguous request framing.
• Validate invalid content-length on http/1 resp by default, and removes content-length from the response if transfer-encoding is present, per RFC.
• Correct the custom protocol code for shutdown: changed the numeric code passed on shutdown to 0 to indicate an explicit shutdown rather than a transport error.

⚙️ Miscellaneous Tasks

• Remove CacheKey::default impl, users of caching should implement cache_key_callback themselves
• Allow server bootstrapping to take place in the context of services with dependents and dependencies
• Don't consider "bytes=" a valid range header: added an early check for an empty/whitespace-only range-set after the bytes= prefix, returning 416 Range Not Satisfiable, consistent with RFC 9110 14.1.2.
• Strip {content, transfer}-encoding from 416s to mirror the behavior for 304 Not Modified responses.
• Disable CONNECT method proxying by default, with an option to enable via server options; unsupported requests will now be automatically rejected.

0.7.0 - 2026-01-30

Highlights

• Extensible SslDigest to save user-defined TLS context
• Add ConnectionFilter trait for early TCP connection filtering

🚀 Features

• Add ConnectionFilter trait for early TCP connection filtering
• Introduce a virtual L4 stream abstraction
• Add support for verify_cert and verify_hostname using rustls
• Exposes the HttpProxy struct to allow external crates to customize the proxy logic.
• Exposes a new_mtls method for creating a HttpProxy with a client_cert_key to enable mtls peers.
• Add SSLKEYLOGFILE support to rustls connector
• Allow spawning background subrequests from main session

... (truncated)

Commits

• faac65b Update changelog for 0.8.0
• 2b496bc Bump pingora to version 0.8.0
• 0f83728 Allow server bootstrapping to take place in the context of services with depe...
• 9740e8d strip {content, transfer}-encoding from 416s
• 0183503 don't consider "bytes=" a valid range header
• b85f724 fix: don't use all for socket
• 83029bf Recognize dcb/dcz in compression handling
• b0a9858 fix invalid CL option on ALPN fallbacks
• c3e6cee Add Windows support and block until main loop returns
• b40ba3d fix(windows): add missing RawStream::Virtual match arm in AsRawSocket impl
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kmesh-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dawid-nowak for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment