Release v3.1.0 - #143
Merged
Merged
Conversation
…support. (#112) * Relative path support for SSL KeyStore/TrustStore * Improve SSL Keystore and Truststore support * Protection against failure when configuring TrustStore or KeyStore * Alias in the same JMeter thread
…115) * Gracefully handle JMeter keystore load failures * Reinitialize SSLManager and client for mTLS client cert test
* Preserve connection keep alive
* Catch HPACK errors and Set Dynamic Response Header Size
Bumps org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0. --- updated-dependencies: - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump org.assertj:assertj-core from 3.12.2 to 3.27.7 Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj) from 3.12.2 to 3.27.7. - [Release notes](https://github.com/assertj/assertj/releases) - [Commits](assertj/assertj@assertj-core-3.12.2...assertj-build-3.27.7) --- updated-dependencies: - dependency-name: org.assertj:assertj-core dependency-version: 3.27.7 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * fix: pin byte-buddy to 1.14.18 to resolve conflict between mockito-core 2.28.2 and assertj-core 3.27.7 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: David <dgiordano@perforce.com>
Bumps [guava](https://github.com/google/guava) from 29.0-jre to 32.0.0-jre. - [Release notes](https://github.com/google/guava/releases) - [Commits](https://github.com/google/guava/commits) --- updated-dependencies: - dependency-name: com.google.guava:guava dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: David <3dgiordano@gmail.com>
* Allow 401 without HTTP AUTH
* Customize header validation for HPACK. * Remove reflection and add shims to gain access * Test CustomHpackDecoder
* Delegate cached-resource sample result to JMeter HTTPHC4Impl * Fix flaky test
* Support file:// sampler URLs * Support file:// on embedded resources
…eter HTTP (#139) * Add headless CLI tool to migrate stock JMeter HTTP samplers to BlazeMeter HTTP * Cross compatibility 5.5 and 5.6.3
* Improved negotiation and embedded hanging
* Checkstyle update and fixes * Fix User Agent logic * Migration CLI * Fix initialization * Recover clearContentDecoders and comments * Cross compatibility 5.5 and 5.6.3 * Default minimum to JMeter to 5.5 * Compatibility with JMeter 5,5 * Matrix JMeter 5.5 and 5.6.3 for compatibility tests * Fix, cross platform path format * Renaming * Fix flaky tests in parity tests * RFC 9110 Redirection and Legacy JMeter Redirect
* Add Timers support toAsync Controller * Inherit from TransactionControler to reuse logic from JMeter
3dgiordano
changed the title
3dgiordano
marked this pull request as ready for review
August 5, 2026 17:15
* Performance improvements
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enhance JMeter SSL support, dependency updates, and HTTP improvements
This pull request introduces significant improvements to compatibility, testing, and documentation for the BlazeMeter HTTP Plugin. The main changes include expanding CI to cover multiple JMeter versions, adding a comprehensive HTTP regression parity test suite, updating dependencies for improved compatibility and reliability, and clarifying buffer/truncation behavior in documentation.
CI and Compatibility Improvements:
.github/workflows/ci-build.yamlto build and test against both JMeter 5.5 (minimum supported) and 5.6.3 (latest), ensuring the plugin works across supported versions. Artifacts are now version-tagged. [1] [2].github/workflows/ci-jmeter-compatibility.yamlto run HTTP parity regression tests and verify plugin compatibility against all supported JMeter versions.Testing Enhancements:
docs/jmeter-regression.md, a detailed guide and suite for HTTP regression parity tests, comparing plugin behavior with Apache JMeter’s HttpClient4 on official test plans. Supports core, extended, and external test groups, and JUnit-based parity tests.pom.xmlto define regression test groups and add required test dependencies, including byte-buddy, commons-io, and updated versions for assertj, guava, and Apache HttpClient. [1] [2] [3] [4] [5] [6]Documentation Updates:
README.md:Build and Coding Standards:
.gitattributesto enforce consistent line endings and text file handling.checkstyle.xmlto enforce a 100-character line length limit, improving code style consistency. [1] [2]Version Updates:
3.1.0-SNAPSHOTand updated default JMeter, Jetty, Brotli, and log4j versions for better alignment with upstream and improved runtime compatibility. [1] [2]Security
CVE-2026-2332 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') #119 and #121
CVE-2025-48924 - Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs #104
CVE-2026-24400 - AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion #105
CVE-2023-2976 - Guava vulnerable to insecure use of temporary directory #52
CVE-2020-8908 - Information Disclosure in Guava #52
CVE-2026-10051 - Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections #121
CVE-2026-6790 - Eclipse Jetty: HTTP Authority/Host mismatch #121
CVE-2026-8384 - Use of Non-Canonical URL Paths for Authorization Decisions #121
These changes collectively improve plugin quality, maintainability, and user guidance, while ensuring robust compatibility with current and future JMeter releases.