Changes

• fix: match Origin scheme if defined in OriginPatterns by @mafredri in #536
• refactor: use context.AfterFunc to track timeouts instead of goroutine by @ash2k in #532
• refactor: add ErrMessageTooBig sentinel error for limited reads by @DanielleMaywood in #535
• build: update to Go 1.23 by @mafredri in #524
• build: add Makefile by @mafredri in #525
• chore: update LICENSE file by @mtojek in #526
• chore: apply various modernisations by @Jacalz in #531

New Contributors

• @mtojek made their first contribution in #526
• @ash2k made their first contribution in #532
• @DanielleMaywood made their first contribution in #535

Full Changelog: v1.8.13...v1.8.14

Contributors

• @ash2k
• @mafredri
• @mtojek
• @Jacalz
• @DanielleMaywood

Changes

• Use new atomic types from Go 1.19 by @Jacalz in #444
• Fix coverage by @mafredri in #466
• Clean out env passed to wasmbrowsertest in TestWasm by @mafredri in #469
• Sunset the dev branch by @mafredri in #471
• Replace filepath.Match with path.Match by @KianYang-Lee in #452
• internal/bpool: add New function by @bestgopher in #465
• accept: Add unwrapping for hijack like http.ResponseController by @mafredri in #472
• docs: Fix docs and examples related to r.Context() usage by @mafredri in #477
• Fix a typo in chat_test.go by @henrybear327 in #491
• fix: avoid writing messages after close and improve handshake by @FrauElster and @mafredri in #476
• Disable AppArmor in CI to allow chrome sandbox by @igolaizola in #511
• ci: disable AppArmor on daily and static workflows by @igolaizola in #513
• Fix build with Go 1.24 by @flyn-org in #508
• Add ping and pong received callbacks by @igolaizola in #509
• ci: update wasmbrowsertest to a specific commit by @igolaizola in #514
• ci: lock down staticcheck and govulncheck in lint.sh by @mafredri in #523

Full Changelog: v1.8.12...v1.8.13

Contributors

• @mafredri
• @flyn-org
• @henrybear327
• @igolaizola
• @FrauElster
• @Jacalz
• @bestgopher
• @KianYang-Lee

This release marks the repo's transfer from nhooyr to Coder. We want to update the import path as early as possible to minimize breakage.

Functional improvements coming soon :)

• Update import path to github.com/coder/websocket by @ammario in #462
• Add transfer notice to README by @ammario in #463

Contributors

• @ammario

• b0ec201 close.go: Rewrite how the library handles closing #427 #429 #434 #436 #437 (thanks @alixander, @creker, @ash2k, @haha454, @tomasji)
  • Apologies for the delay here, this fix should have been much faster.
• 8d2374e Fix unaligned load error on 32-bit architectures #438 (thanks @x0wllaar)
• d34e5d4 Benchmark json.NewEncoder vs json.Marshal #409 (thanks @maggie44)
• 52721a9 Use ws:// over http:// in example logs #412 (thanks @KunalSin9h)

Contributors

• @ash2k
• @creker
• @alixander
• @x0wllaar
• @haha454
• @tomasji
• @maggie44
• @KunalSin9h

• 454aee8 ws_js.go: Disable read limit on -1 #410 (thanks @oderwat)
  • Forgot to add #254 to WASM code earlier.

Contributors

• @oderwat

• b4e4f4f Don't embed noCopy...
  • Whoops, we don't want noCopy's Lock method to be public. Harmless as noCopy only exists to hint go vet but not appropriate.

My sincerest apologies for the 3 year delay. The last few years have been an extraordinarily challenging time for me personally and professionally. I've been experimenting nonstop to better understand what I need from my life and precisely how to attain it.

I moved across Canada from Ontario to British Columbia, taught myself photography, started working a new job at @terrastruct where I designed and wrote https://github.com/terrastruct/d2, taught myself to cook, taught myself to exercise, bought a house on a 20 acre property in the Canadian rockies, became a volunteer firefighter and now I'm working on becoming a paramedic and search and rescue volunteer. My house burnt up in a chimney fire just 1 year after moving in. My vehicle was taken by the fire too...

It's been up and down and round and round these last few years.

Anyway, I am now thankfully working on websocket full time for the foreseeable future. See #402. I'm working on v1.9.0 next. After which I need to finish some inventory work for my house fire insurance claim. Following that I'll be back full time until v2.0.0 is released :)

Thank you to everyone who contributed by reporting issues and opening pull requests.

Special thanks to my sponsors @alixander, @scsmithr, @tailscale and @coder.

note: If anyone is good with amd64 and arm64 assembly please give me a hand with reviewing #326.
I'm trying to confirm that it's correctly implemented in the most efficient way possible and that there is no unnecessary code.

Changelog

This release packs a ton of fixes and improvements. Please upgrade as soon as you can.

Breaking changes are prefixed with BREAKING.

API additions are prefixed with API.

• d7a55cf Ensure no goroutines leak after Close #330
• 25a5ca4 netconn.go: Fix panic on zero or negative deadline durations
• 50952d7 compress.go: Rewrite compression docs
• 5fe95bb write.go: Fix potential writeFrame deadlock #405
• 6cec2ca close.go: Fix mid read close #355
• 28c6709 conn_test: Add TestConcurrentClosePing #298 #394 @univerio @@bhallionOhbibi
• e361137 wsjs: Register OnError #400
• 1a344a4 Reject invalid "Sec-WebSocket-Key" headers from clients #360 @Emyrk
• 20b8838 Run autobahn-testsuite on dev daily
• 818579b Add TestDialViaProxy #395
• e314da6 Redirect wss/ws correctly by modifying the http client #333
• a94999f API Add CloseNow #384
• 1dbc141 Ensure Writer does zero alloc writes #354
• 97d7f90 Make compression negotiation more lenient #258 @abursavich
• 81afa8a Avoid returning 0, nil in NetConn.Read #367
• 4e15d75 Add ci/bench.sh
• a6b9464 Add noCopy to Conn #349
• b4b86b9 dial.go: Use timeout on HTTPClient properly #341
• 2598ea2 Remove all third party dependencies from go.mod and go.sum #297
• fecf26c netconn.go: Return real remote and local address where possible #299 @photostorm
• f7bed7c API Extend DialOptions to allow Host header override #336 @bendiscz
• 3f26c9f wsjson: Write messages in a single frame always #315
• ac38512 BREAKING Remove wspb #311 #297
  • See #420 (comment) for a standalone wspb copy.
• e9d0881 Use net.ErrClosed where possible #286 @emersion
• e1e65ad Run AUTOBAHN tests daily
• 2a5a566 Update Go module version to 1.19 #359 @Jacalz
• 118ea68 Add staticcheck and simplify and refactor CI
• b9a4d42 Switch to OpenBSD's license
• 6ead6aa Run the autobahn-testsuite in docker to avoid issues with python2 EOL #334
• e2bb5be Migrate from deprecated io/ioutil #371 @keystroke3
• 7fd6136 Fix dial panic when ctx is nil #365 @guseggert
• 65dfbdd Add wasm dial timeout test
• 29251d0 Improve unauthorized origin error message #247
• 482f584 Cleanup net.Conn context's on close #255
• ea87744 BREAKING Disable read limit on net.Conn #254 #245
  • This commit also allows passing -1 to disable the read limit generally. #322
• 085d46c Document context expirations wart #242
• 3b20a49 Document separate idle and read timeout #87
• fdc4079 Clone options correctly #259 @abursavich
• 897a573 Fix deadlock in writeFrame #253 #248
• 493ebbe Prevent net.Conn timer leakage #255 #243
• 0a61ffe Make SetDeadline on NetConn not always close Conn #228 #350
• 1695216 Add ping example #227
• 17cf0fe BREAKING The dependency on klauspost/compress has been removed and compression is disabled by default #220 #230 #218 #315
  • More reliable and idiomatic. See updated docs in compress.go
• b453d3e All Wasm code now lives in ws_js.go to avoid polluting the directory tree

Contributors

• @emersion
• @bendiscz
• @guseggert
• @univerio
• @abursavich
• @alixander
• @photostorm
• @scsmithr
• @Emyrk
• @Jacalz
• @bhallionOhbibi
• @keystroke3
• @tailscale
• @terrastruct
• @coder

• Fixes an easily exploitable DOS vulnerability #291 🔴
  • Please update ASAP!!!

• Fix deadlock introduced in v1.8.5 #231
  • Occured when you'd write at the same time as close
• Add support for gin-gonic/gin
• wsjson does not require that the message type read is text anymore #233
• Add automated test to echo example #224
• Undeprecate InsecureSkipVerify #225
  • It's more clear than * as an origin pattern.

In light of #231 and #205, I've opened #239 which will track a complete review to ensure there are no more such bugs from my rewrite in #163.

• Improve cross origin API and add example #194 #198
• Add automated test for chat example #201
• You can now pass http:// and https:// URLs to Dial
• Documentation fixes #212 #208
• Prevent all writes after close frame is written #213
• Ensure writes on a closed connection return the close error #215
• Disable compression for Safari due to bugs in its implementation #218