[appendix]
== Migrating from Cowboy 2.16 to 2.17

Cowboy 2.17 fixes a number of security vulnerabilities
and improves the xref:security_checklist[security checklist].
The checklist is now included in the Hex package for
convenience.

Cowboy 2.17 updates Cowlib to 2.18.0. Both applications
must be updated as they both contain security fixes.

Cowboy 2.17 requires Erlang/OTP 24.0 or greater.

=== Features added

* Potential incompatibility: HTTP/2 now defaults
  `max_concurrent_streams` to 100.

* Potential incompatibility: Websocket now defaults
  `max_frame_size` to 1MB.

* Add the `invalid_response_headers` option to HTTP/2.

* Extend `invalid_response_headers` to responses sent
  following an `early_error` stream handler call.

* Document the `max_authority_length` option.
  It limits the length of the authority component,
  regardless of where that component is found (request
  line in absolute-form, host header, :authority
  pseudo-header).

* Defense-in-depth: Add the `max_keys` option to
  `cowboy_req` functions that parse the query string
  or form-urlencoded bodies. This new limit is applied
  in addition to existing length limits. It defaults
  to 100.

* Update Cowlib to 2.18.0.

=== Bugs fixed

* Defense-in-depth: Cowboy will reject some control
  characters early such as the NUL byte or CR and LF
  where they are not expected.

* Strengthen HTTP/1.1 request parsing. Note that
  request trailers will now be skipped up to a certain
  length, instead of triggering an error.
