build(deps): bump pingora-runtime from 0.8.1 to 0.9.0

[dependabot]

Bumps pingora-runtime from 0.8.1 to 0.9.0.

Release notes

Sourced from pingora-runtime's releases.

Pingora 0.9.0

0.9.0 - 2026-09-04

✨ Highlights

• Reworked connection pooling with sharded storage and a true global LRU, addressing stale entries and race windows.
• Added an upstream module system that applies before upstream compression.
• More handling of HTTP parsing and framing edge cases, including non-origin-form request-target preservation, and hop-by-hop header sanitization, obsolete line-fold normalization, stricter request-target validation, and bounded default HTTP/2 limits.
• Split Prometheus integration into the pingora-prometheus crate and made Prometheus optional.
• Improved graceful shutdown and upgrade behavior, including responsive load-balancer shutdown, descriptor lifecycle fixes, and lower shutdown-notification contention.

⚠️ Potential Breaking Changes

• Minimum supported Rust version moves to 1.85 for some crates. pingora-foundations declares an MSRV of 1.88.
• RequestHeader and ResponseHeader no longer implement DerefMut because unrestricted mutation could violate internal invariants.
• Removed async_write_vec APIs; consumers should use tokio::io::AsyncWriteExt::write_all_buf.
• Prometheus integration moved from pingora-core to the separate pingora-prometheus crate; Prometheus is optional.
• tracing is now optional in pingora-cache.
• Upgraded to the boring-rs 5.x API.
• PeerOptions::curve now uses Cow.
• Upstream requests strip hop-by-hop and Connection-nominated headers by default; legacy behavior requires explicit compatibility settings.
• Default HTTP/2 server limits are bounded rather than unbounded.
• Removed the unused LruShard Default implementation and lifted Default bounds on sharded cache structures.
• Removed the CacheKey namespace parameter.
• PurgeOutcome enum gains an Expired variant.
• ForcedFreshness and hit-status reporting gain ForceExpiredServeStale variant.

🚀 Features — Proxy & Sessions

• Add abort-on-close session configurability.
• Support HTTP/1.1 downstream request pipelining.
• Add cancel-safe body and header writer primitives (proxy tasks) to prevent stalled cache misses from applying backpressure.
• Add an upstream module system and allow modules to adjust after receiving upstream response headers.
• Add proxy warning-log suppression hooks.
• Add keepalive-pool callbacks for tracking connection ages.
• Expose HTTP/1.x request-body bytes accepted by the upstream writer.
• Report point-in-time available HTTP/2 stream capacity.

🚀 Features — TLS

• Add ability to configure an offload thread pool for downstream TLS handshakes.
• Add Acceptor::from_server_config for runtime-built rustls ServerConfig values and in-memory key material.
• Export TLS keying material, including from pingora-s2n.
• Add per-peer CA configuration.
• Add a pre-TLS callback for PROXY protocol support.
• Expose the rustls certificate type.
• Add curve and second-keyshare settings to HttpPeer hashing.
• Avoid compiling aws-lc-rs when the ring provider is selected.

🚀 Features — Server, Runtime & Load Balancing

... (truncated)

Changelog

Sourced from pingora-runtime's changelog.

0.9.0 - 2026-09-04

✨ Highlights

• Reworked connection pooling with sharded storage and a true global LRU, addressing stale entries and race windows.
• Added an upstream module system that applies before upstream compression.
• More handling of HTTP parsing and framing edge cases, including non-origin-form request-target preservation, and hop-by-hop header sanitization, obsolete line-fold normalization, stricter request-target validation, and bounded default HTTP/2 limits.
• Split Prometheus integration into the pingora-prometheus crate and made Prometheus optional.
• Improved graceful shutdown and upgrade behavior, including responsive load-balancer shutdown, descriptor lifecycle fixes, and lower shutdown-notification contention.

⚠️ Potential Breaking Changes

• Minimum supported Rust version moves to 1.85 for some crates. pingora-foundations declares an MSRV of 1.88.
• RequestHeader and ResponseHeader no longer implement DerefMut because unrestricted mutation could violate internal invariants.
• Removed async_write_vec APIs; consumers should use tokio::io::AsyncWriteExt::write_all_buf.
• Prometheus integration moved from pingora-core to the separate pingora-prometheus crate; Prometheus is optional.
• tracing is now optional in pingora-cache.
• Upgraded to the boring-rs 5.x API.
• PeerOptions::curve now uses Cow.
• Upstream requests strip hop-by-hop and Connection-nominated headers by default; legacy behavior requires explicit compatibility settings.
• Default HTTP/2 server limits are bounded rather than unbounded.
• Removed the unused LruShard Default implementation and lifted Default bounds on sharded cache structures.
• Removed the CacheKey namespace parameter.
• PurgeOutcome enum gains an Expired variant.
• ForcedFreshness and hit-status reporting gain ForceExpiredServeStale variant.

🚀 Features — Proxy & Sessions

• Add abort-on-close session configurability.
• Support HTTP/1.1 downstream request pipelining.
• Add cancel-safe body and header writer primitives (proxy tasks) to prevent stalled cache misses from applying backpressure.
• Add an upstream module system and allow modules to adjust after receiving upstream response headers.
• Add proxy warning-log suppression hooks.
• Add keepalive-pool callbacks for tracking connection ages.
• Expose HTTP/1.x request-body bytes accepted by the upstream writer.
• Report point-in-time available HTTP/2 stream capacity.

🚀 Features — TLS

• Add ability to configure an offload thread pool for downstream TLS handshakes.
• Add Acceptor::from_server_config for runtime-built rustls ServerConfig values and in-memory key material.
• Export TLS keying material, including from pingora-s2n.
• Add per-peer CA configuration.
• Add a pre-TLS callback for PROXY protocol support.
• Expose the rustls certificate type.
• Add curve and second-keyshare settings to HttpPeer hashing.
• Avoid compiling aws-lc-rs when the ring provider is selected.

🚀 Features — Server, Runtime & Load Balancing

... (truncated)

Commits

• 702f690 Update changelog for 0.9.0
• 13ad329 Bump pingora to version 0.9.0
• b01edce Shard the HttpProxy shutdown Notify to cut lock contention
• accfac0 report available H2 stream capacity
• 1ed40d4 Prevent reuse after incomplete H1 responses
• b7ef13e Fix racy closes_only_unclaimed_fds tests
• 9c9acc3 Let a purge expire an asset instead of deleting it
• 6fa3835 Update default error_while_proxy retry conditions
• ee78ceb Represent the raw request-target as a single value
• baf4fe5 Parse non-origin-form request targets without mangling the URI
• Additional commits viewable in compare view