chore(release-next): release 3.0.0-alpha.4

[github-actions]

🤖 I have created a release beep boop

3.0.0-alpha.4 (2026-06-19)

Features

• benchmarks: add client-side benchmarks (--protocol client-h1|h2|h3) (c016e15)
• benchmarks: add H2 and H3 loadtest support (--protocol h2|h3) (961156d)
• benchmarks: add in-memory state-machine benchmarks (--protocol mem-h1|mem-h2) (04eef35)
• benchmarks: add per-type allocation profiling via BDN custom exporter (a1cd11c)
• body: add generic IBodyDrainTarget<T>, BodyDrainSlot<T>, BodyPumpHelper, ChunkedFramingHelper (adc53da)
• body: add IResettable to inbound types, create BodyReaderPoolExtensions (79120c2)
• body: add SerialBodyPump for H1.x body drain with capacity model and starvation guard (3ef519e)
• body: add shared drain interfaces, messages, and slot types (ad4d99f)
• body: refactor pumps to generic BodyDrainSlot<T> + BodyPumpHelper (1237e9d)
• docs: Add 'When to Use' page and nav link (bd5c6f3)
• h2: add BodyDrainScheduler with AIMD, limbo zero-copy, and slot pooling (c020598)
• h2: add GetStreamSendWindow to FlowController (c57d65b)
• h3: add MultiplexedBodyPump with fixed cap, slot pooling, and starvation guard (212ffb1)
• lifecycle: ClientStreamManager differentiated supervisor, Watch+Terminated cleanup (737be81)
• lifecycle: ServerSupervisorActor failure responses, drain timeout, Watch+Terminated (1baad6d)
• pooling: add Microsoft.Extensions.ObjectPool primitive (IResettable + policy) (cbad4d6)
• pooling: expose per-connection PoolContext on the server stage seam (af2c9ec)
• pooling: per-connection ConnectionPoolContext (2245c7f)
• server: Add ReceiveBufferHint option (6ebd4e3)
• server: handle ListenersFailed and DrainComplete.TimedOut in TurboServer (93ea515)

Bug Fixes

• benchmarks: add missing [GlobalSetup] to cold-start benchmark classes (54d85ac)
• benchmarks: clean up old trace files (1557008)
• benchmarks: prevent ActorSystem shutdown during BDN warmup iterations (8de9fd1)
• benchmarks: use per-connection SocketsHttpHandler for H2/H3 driver (3d86d7b)
• body: retain HttpContent reference in drain slots to prevent GC disposal race (9f3fa07)
• body: SerialBodyPump Cancel should not fire OnDrainComplete (2491a11)
• client: bound HTTP/1.1 request body pump with outbound flush backpressure (c76e9ee)
• client: Correct request cancellation logic (6c1b390)
• client: decouple substream source creation from upstream pull gating (7d0cb71)
• client: don't retry non-rewindable bodies; stop parked retries blocking intake (a468db0)
• client: resolve multi-connection pipeline deadlock in GroupByRequestEndpointStage (0549940)
• client: route responses by compacting consumer index to fix same-name misroute (f16d3a7)
• client: stamp cancellation token into request options before channel enqueue (28d422d)
• h10-client: use streaming CloseDelimitedFramingDecoder for connection-close bodies (d06db52)
• h2: Pass request cancellation to body drain (5e60f59)
• h2: prevent GC pressure from body buffering under high concurrency (7cc0841)
• h3: dispose decoded frames and copy blocked QPACK header blocks (e51ab5d)
• http11: Optimize request body pumping for synchronous reads (7db4edf)
• http1: stop chunked decoder duplicating a stashed partial control line (a1a58a5)
• http1: suppress response body for HEAD requests (42f3637)
• http2: enforce the advertised HEADER_TABLE_SIZE in the server HPACK decoder (4ad285c)
• http2: RFC 9113 frame compliance — settings overflow, padded DATA flow control, half-closed(remote) (d76c134)
• http2: size the HPACK encode buffer to the header block (38625ab)
• http2: stop returning in-use body-drain buffers to the shared pool on teardown (19b83c5)
• http2: suppress response body (DATA frames) for HEAD requests (26b7841)
• http3: process inbound QPACK encoder-stream and guard response body-drain UAF (server) (ea45c9c)
• http3: replay DATA received while response HEADERS are QPACK-blocked (ab401a8)
• http3: surface malformed frame bodies as HttpProtocolException (c0a0462)
• http: enforce body-size limit on Content-Length framed bodies (025fc6b)
• http: tighten Content-Length parsing, dup CL on H1.0, redirect credential leak (fd16691)
• lifecycle: ConnectionActor failure handler and PostStop cleanup (327a54f)
• lifecycle: consistent full exception logging in CleanupForRetry (0187c1d)
• lifecycle: Consumer stops on sink error instead of continuing (9fe8885)
• lifecycle: ListenerActor PipeTo throw bug, BindFailed message, supervisor logging (4e07e07)
• lifecycle: StreamOwner stops after retry exhaustion, actor-scoped materializer (4ef77cd)
• revert Servus 0.34.1 bump — caused 90% throughput regression (7b140f9)
• security hardening, body pump redesign, perf optimizations, and lifecycle reliability (#42) (c0f216e)
• server: await ActorSystem WhenTerminated in StopAsync, dispose responses in E2E tests (bb87acc)
• server: bound the cleartext protocol-sniffing window (DoS) (d82c37f)
• server: bound the routing Pending queue by propagating backpressure (c2965a8)
• server: check the cleartext sniff cap after protocol identification, not before (ab3a40c)
• server: defer H2 per-stream WINDOW_UPDATE until app consumes body (5bd80aa)
• server: empty-body responses, outbound queue drain, body-message ShouldComplete (94332f4)
• server: guard buffered body fast path and serve single-segment bodies zero-copy (3358b02)
• server: H1.x SerialBodyPump backpressure stall on streaming responses (25eeb7a)
• server: Pool CancellationTokenSource to reduce allocations (8c18619)
• server: recycle the FeatureCollection on body-suppressed (204/304/HEAD) responses (7eabbe5)
• server: remove response data-rate entry when body completes (61a4b1e)
• server: serialize HTTP/1.x pipelined dispatch and fix WirePipeliningSpec under-read (3429403)
• server: stop ApplicationBridgeStage double-emitting on handler timeout (51a1804)
• server: wire MaxConcurrentStreams to QUIC and MaxRequestBufferSize to the TCP input buffer (ffc4f88)
• test: H10 RequestCompressionSpec must accumulate multi-chunk requests (9456ce7)
• test: reduce H2 ConnectionWindowStarvation payload to prevent CI flake (fb21883)

Performance

• Add Kestrel benchmarks for HttpClient (539e99b)
• client: avoid CreateLinkedTokenSource when only caller token is cancelable (0ce8fc3)
• client: replace ConcurrentStack pools with ObjectPool in client path (f070894)
• h2,h3: add per-connection HeaderNameCache for HPACK/QPACK decoding (ddac45e)
• h2,h3: sync fast-path for body drain reads, remove .AsTask() allocations (fb19fd0)
• h3: decode inbound frames zero-copy from the transport buffer (1171012)
• h3: pre-compute QPACK static table name byte lengths and encoded sizes (1544580)
• h3: remove 4 allocating dead-code methods from H3 production pathr (9e8d511)
• h3: reuse HeaderEncodingEntry[] array in QpackEncoder.PlanEncodings (5903b56)
• h3: reuse QPACK encode buffer in Http3ServerEncoder (09bf2db)
• h3: reuse QpackInstructionDecoder in ProcessDecoderInstructions (7347319)
• http11: build request headers once and rent exact-size buffer (9983d41)
• pool QueuedBodyReader per-connection for H2/H3 request bodies (23ba3c0)
• protocol: drop per-response decode allocations (reason phrase + header value) (22ecdd1)
• protocol: rent body chunks from a cross-thread ArrayPool (e65bf75)
• quick-win allocation reductions across client and server (deb2530)
• replace H2/H3 pseudo-header Dictionary with typed fields (9fbf854)
• replace per-byte branching with lookup tables + H3 sawDate flag (372d623)
• replace QPACK per-decode MemoryPool.Rent with per-decoder scratch buffer (c637773)
• reuse content-header lists across pool cycles + Servus 0.34.1 (7367de0)
• round 3 quick wins — pre-encode, scratch buffers, O(1) lookups (61be7d5)
• round 4 — lock-free pending list, span-based parsing, pre-baked headers (50918ff)
• server: cache send delegate and pool PassthroughFramingEncoder (b29c23b)
• server: cut per-request allocations on the H1.1 hot path (05cbf9e)
• server: deduplicate data-rate timer scheduling and reuse response pipe writer (0c0e157)
• server: eliminate per-response pipe lock on the buffered write path (6104e05)
• server: H2 HPACK header block cache for repeated response patterns (29bf831)
• server: intern common request targets to avoid per-request string alloc (54d1355)
• server: pool H2 request feature + reduce QUIC receive buffer 64K→4K (813a730)
• server: pool the feature collection per connection (a9852ca)
• server: pool TurboHttpRequestFeature on the recycled feature-collection path (ab291ed)
• server: pre-bake H1.x status lines as static byte tables (22e192b)
• server: remove TryCoalesceOutbound memcpy — writev handles scatter natively (471c661)
• server: replace LINQ hot-path allocations in H1.1 state machine (274a48e)
• server: replace per-encode MemoryPool.Rent with scratch buffer in H2 encoder (b88e5d9)
• server: reuse the ASP.NET HttpContext per connection via IHostContextContainer (7da9755)
• server: short-circuit body classification for no-body requests (596e2da)

Documentation

• fix old docs (e025e18)
• fix stale integration-test commands in CLAUDE.md (fa76bf9)

Refactoring

• h10: use SerialBodyPump for known Content-Length, retain BufferedBodyWriter for unknown (e2bb318)
• h11: replace push-based body drain with SerialBodyPump (26cb252)
• h1x: eliminate writer layer, use ConnectionPoolContext + ChunkedFramingHelper (0ba8c0b)
• h2,h3: migrate to FlowControlledBodyPump/MultiplexedBodyPump with generic targets (82e5feb)
• h2: replace push-based body drain with BodyDrainScheduler (1d3b371)
• h3: replace push-based body drain with MultiplexedBodyPump (34f92da)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v3.0.0-alpha.4

🌻