http-net 0.10.0

Sans-IO HTTP/1.1 server and client: strict RFC 9112 parsing, smuggling defences, bounded buffers, keep-alive, chunked bodies, upgrades, a blocking std adapter, no third-party dependencies.
Documentation
# http-net v0.8.0 - Alpha

**Date:** 2026-10-26
**Compare:** `v0.7.0...v0.8.0`

**The shared grammar moves to parse-net, and real consumers run on it.**
v0.8.0 takes the generic RFC 9110 field grammar (tokens, whitespace, the
field-value check, decimal and hex digits, the calendar behind `Date`) from
the first-party crate `parse-net` 0.7, as the specification planned from
the start, with every input accepted or refused exactly as before. Two of
the first consumers, serve-net and LexerSketch Studio, run end to end
against it with no change. Nothing a 0.7 user can notice changes. http-net
still has no third-party dependency and no `unsafe` code.

## What is http-net?

An HTTP/1.1 engine that does no I/O. Feed it the bytes a socket delivered;
it hands back requests or responses as borrowed views of those bytes,
decodes their bodies, and serializes what you send back. Parsing is strict:
a message two implementations could frame differently is refused with a
specific error, never repaired. Every buffer is bounded by configuration,
and each limit is checked before the bytes it governs are buffered.

## What changed since v0.7.0

### The shared grammar comes from parse-net

`parse-net` is the portfolio's shared grammar for Internet message formats:
cookie-net, form-net, h2-net, and smtp-net use the same tokens, whitespace,
field values, and dates. http-net now depends on it by published version
(`parse-net = { version = "0.7", default-features = false }`). It has no
dependencies of its own and builds without `std` or `alloc`, so `no_std`
builds are unaffected.

What moved: `tchar` and tokens, OWS and its trimming, the field-value check
(a CR is still `BareCr`, any other refused byte `InvalidHeaderValue`),
`qdtext`, hex digits, decimal parsing, and the civil calendar behind
`HttpDate`.

What stayed, and why:

- **List splitting.** parse-net's list parser follows the general RFC 9110
  grammar more strictly than the HTTP/1.1 framing fields need (it refuses
  an unterminated quote, treats parentheses as comments, and caps empty
  elements and members). http-net's walker keeps its exact 0.7 behaviour.
- **The `Date` layout.** parse-net's formatter writes the same bytes but
  is not a `const fn`, and `HttpDate::from_unix_seconds` and
  `DateCache::new` are; only the calendar arithmetic moved.
- **HTTP/1.1 framing and the hot path.** The request-target and `Host`
  checks, the reason phrase, the byte scanners of the head parser, the
  chunk-line grammar, and the number writers belong to HTTP/1.1, as the
  specification sets out.

Proof that nothing changed: each moved item has an equality test against a
verbatim copy of its 0.7 implementation (every classifier over every byte,
the field-value check at every position of a 17-byte value and on every
pair of refused bytes, OWS trimming at both ends, decimal parsing on
400,000 generated cases, the `Date` output for every day from 1970 to
9999), and the whole existing suite passes unchanged. The internal module
`syntax.rs` is renamed `scan.rs`; nothing public moved.

### Consumers

- **serve-net** (its `http1` engine over net-io): its whole test suite
  passes against 0.8 with no change, clippy clean.
- **LexerSketch Studio** (`ls-studio`, moved from http-net 0.2): builds
  with no error or warning and its 42 tests pass, with no change.

Neither reported a gap. The third planned consumer (the WASP `gateway-io`
skeleton or the first `fetch-net`) does not exist yet; it is verified in a
0.8.x release once it does (`dev/PLAN.md` D-62).

## Testing

361 tests plus 345 doctests, all passing (`cargo test --all-features`):
116 unit tests (7 new: the parse-net equality tests) and 245 integration
tests.

## Performance

Against 0.7.0, interleaved and pinned to one core in WSL: the 12-field
request head measured -0.3% to -0.6% across three long runs (15 rounds
each), client response parsing +1.1% to +1.7%, pipelined requests +0.9%.
The machine was shared with other builds (load average about 6), so single
rounds varied by up to 30%; at that noise a 15-round median resolves a few
percent, and the result is "no measurable difference" rather than a
strict 1% bound (`dev/PLAN.md` D-61). The 0.6 numbers in
`docs/PERFORMANCE.md` stand.

## Migration from v0.7.0

Nothing to do. See `docs/MIGRATION.md`.

## Stability commitment

Pre-1.0: the API may still change in the 0.x series, and every change is
listed in `CHANGELOG.md` and `docs/MIGRATION.md`. The API is frozen at
1.0.0 until 2.0. The MSRV is Rust 1.85; raising it after 1.0 is a major
change.

## Verification

Run on Windows x86_64 and in WSL Ubuntu (Linux x86_64), each on Rust
stable and the 1.85 MSRV toolchain:

```bash
cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo clippy --all-targets --all-features -- -D warnings
cargo clippy --all-targets --no-default-features -- -D warnings
cargo test
cargo test --all-features
cargo test --no-default-features
cargo build --examples
cargo build --lib --no-default-features --target thumbv7em-none-eabihf
RUSTDOCFLAGS="-D warnings" cargo doc --no-deps
RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features
RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --no-default-features
cargo package
cargo deny check
cargo audit
cargo +nightly fuzz run --target x86_64-unknown-linux-gnu <target> <corpus outside the repo> -- -max_total_time=60   # each of the eight targets, WSL
```

CI runs the same checks on Linux, macOS, and Windows, stable and 1.85,
plus the `no_std` build and the 60 s fuzz smoke run per target.

## What's next

- **0.9.x, beta and release candidates:** the API frozen as the 1.0
  candidate, fixes only, every documentation claim re-checked against the
  build, `docs/STABILITY-1.0.md` drafted, and HTTP Garden runs in CI.
- **1.0.0:** after the full audit, on James's decision.

## Installation

```toml
[dependencies]
http-net = "0.8"
```

MSRV: Rust 1.85.

**Full Changelog:** https://github.com/jamesgober/http-net/compare/v0.7.0...v0.8.0