Apache PageSpeed (incubating) Release Notes

Please read the WIP-DISCLAIMER before using the Apache PageSpeed (incubating) releases below.

Release 1.14.36.1

This release published July 2020.

Changes

Updated Chromium url parser
pagespeed_libraries.conf: add jquery 3.4.1 (#1938)
Upgrade our re2 dependency to release 2019-07-01 (#1915)
Support data-srcset in img and amp-img (#1899)
Add support for specifying a TTL for redis keys (#1854)
Fix mismatch between decompression and headers (#1785)
Handle Apache >2.4 mod_authz_host (#1703)
Redis: Use Redis DB-Index when computing the SystemCache lookup key (#1776)
libwebp: update from v0.5.1 to v0.6.1 (#1759)
third party gprc library upgraded to version 1.6.0 (#1747)
upgrade libpng1.2 to 1.6

Any releases offered below are pre-apache releases.

Release 1.13.35.2-stable

This release made February 5, 2018. It is a clone of the 1.13.35.2-beta release.

Release 1.13.35.2-beta

This release was made January 10, 2018.

Issues Resolved

Issues Affecting both Nginx and Apache

Issues Affecting only Nginx

Release 1.13.35.1-beta

This release was made November 8, 2017.

New Features

Content Security Policy Support
Opt-in feature enabling optimizations to adapt to Content Security Policies.
Support specifying a Redis Database
It is now possible to specify which database will be used when configuring Redis as a cache.
Sync with WebP change in Chromium

The webp decoder is being updated to correct an issue where it can't play an animation exactly once, and requires an encoder update.

Background:
Log errors if serf error rate seems too high.
When over 50% of http fetch attempts inside a 30-minute period fail, pagespeed will now emit an error entry to the logs.
Off has been replaced by Standby
In standby mode PageSpeed is off, except it serves .pagespeed. resources and PageSpeed query parameters are interpreted. This is equivalent to "off" in mod_pagespeed. Previously, ngx_pagespeed had no equivalent. With this change, "off" in mod_pagespeed is deprecated, and "standby" should be used instead.
Allow UrlValuedAttribute:image on elements with children
Tags that have children are now considered acceptable targets for image optimization.

Deprecations

Standby has replaced Off
Pagespeed off has been deprecated and replaced with pagespeed standby.
Ubuntu 12.04 end of life
The platform used to build .deb files has moved to Ubuntu 14.04. This introduced a dependency on a glibc version which is not compatible with Ubuntu 12.04. Building from source is still possible.

Issues Resolved

Issues Affecting both Nginx and Apache

Issues Affecting only Nginx

Release 1.12.34.3-stable

This nginx-only release made September 28, 2017. As of nginx 1.13.4 building the module would fail. This release resolves the problem.

Issues Affecting Nginx

Release 1.12.34.2-stable

This release was made June 19, 2017. It is a clone of the 1.12.34.2-beta release.

Release 1.12.34.2-beta

This nginx-only bug-fix release was made December 15, 2016. It allows the precompiled PSOL library to be used with nginx's --with-debug.

Issues Resolved

Issues Affecting Nginx

Release 1.12.34.1-beta

This release was made December 7, 2016.

New Features

Redis Support
Support for Redis Cache and Redis Cluster as external caches.
Add preload hints
This is a new filter, off by default, that looks for declaratively included stylesheets and javascript to figure out the page's dependencies, and inserts preload headers so the browser can start loading them immediately.
Optimize Srcsets
PageSpeed now optimizes images referenced in srcset attributes.
Set s-maxage
To prevent CDNs and other shared caches from caching the unoptimized version of resources for a long time, PageSpeed now adds s-maxage=10 to the cache-control headers for unoptimized resources that we intend to optimize in-place.
Allow combining stylesheets with IDs
PageSpeed would previously refuse to combine stylesheets with IDs, which interacted poorly with WordPress and other content management systems putting IDs on all their CSS files. Setting PermitIdsForCssCombining wildcards allows you to indicate to PageSpeed which IDs on CSS files are ok to ignore.
FinderPropertiesCacheExpirationTimeMs
Configures the length of time the prioritize_critical_css beacons are valid.
AddResourceHeader
Allows setting headers on optimized resources for CORS support.
Shared Memory Cache Checkpointing
The shared memory metadata cache now checkpoints to disk every few minutes instead of writing all changes through as they happen. In our testing this improved performance on workloads that require many metadata writes by 21%.

Deprecations

Support for disabling InheritVHostConfig
For historical reasons, mod_pagespeed on Apache doesn't respect the global PageSpeed configuration when interpreting VHost configuration. Since 1.1 in 2012, however, it has shipped with a default configuration file that fixed this by setting InheritVHostConfig to "on". For the minority of installations that don't use the default configuration file, or explicitly set InheritVHostConfig to "off", PageSpeed will now log an error on startup warning that the setting will soon change. With the next major version release InheritVHostConfig will be forced to "on".
Centos 5 Support
CentOS 5, released in 2007, goes end-of-life at the end of March 2017. The 1.12 rpm packages are for CentOS 6 and later, and will fail to install on CentOS 5. The stable release track, 1.11, continues to support CentOS 5.

Issues Resolved

Issues Affecting both Nginx and Apache

Release 1.11.33.5-stable

This bug-fix release was made November 14, 2016. It is a clone of the 1.11.33.5-beta release and rebuilds the .deb packages to fix auto-updating for Ubuntu 16.10.

This release is only applicable to Debian and Ubuntu; release 1.11.33.4 is still the most up-to-date stable release for RedHat, CentOS, PSOL, and ngx_pagespeed.

Release 1.11.33.5-beta

This bug-fix release was made November 14, 2016. It rebuilds the .deb packages to fix auto-updating for Ubuntu 16.10.

This release is only applicable to Debian and Ubuntu; release 1.11.33.4 is still the most up-to-date beta release for RedHat, CentOS, PSOL, and ngx_pagespeed.

Issues Resolved

Release 1.11.33.4-stable

This release was made October 3, 2016. It is a clone of the 1.11.33.4-beta release.

In addition to being the latest stable release for Apache, this is the first stable release for Nginx.

Release 1.11.33.4-beta

This bug-fix release was made September 15, 2016.

Issues Resolved

Release 1.11.33.3-beta

This bug-fix release was made August 16, 2016.

Issues Resolved

Release 1.11.33.2-stable

This release was made May 12, 2016. It is a clone of the 1.11.33.2-beta release.

Release 1.11.33.2-beta

This security update release was made May 12, 2016.

Issues Resolved

Release 1.11.33.1-stable

This bug-fix release was made May 2nd, 2016. It is a clone of the 1.11.33.1-beta release.

This release depends on glibc >= 2.14 and will no longer run on Debian Wheezy, (7.0) which is also no longer officially supported by the Debian security team.

Release 1.11.33.1-beta

This bug-fix release was made May 2nd, 2016.

Issues Resolved

Release 1.11.33.0-beta

This release was made March 30, 2016.

This release targets users on mobile devices and low-bandwidth networks by adding Save-Data support. Save-Data is a new Client Hint that allows site visitors to indicate that they would prefer lower-quality resources in order to save data. Sites are most likely to see requests to save data today from visitors who have turned on Data Saver mode in Chrome or the equivalents in Opera and Yandex Browser, often because they're on slow or expensive connections. Now, with 1.11, when such a user comes to your site asking it to save data, mod_pagespeed will compress images to a lower quality level than it would typically, decreasing their size further at the cost of slightly more image distortion.

New Features

Save-Data Support
Serve more thoroughly compressed images to browsers that request lowered data usage via client hints.

Issues Resolved

Issues Affecting both Nginx and Apache

Issues Affecting Nginx

Release 1.10.33.7-beta

This security update release was made March 28, 2016. It resolves the same issues as the 1.9.32.14 stable release, and has the same patch.

Release 1.9.32.14-stable

This security update release was made March 28, 2016.

All previously released versions of PageSpeed are vulnerable to CVE-2016-3626. This permits a hostile third party to trick PageSpeed into making arbitrary HTTP requests on arbitrary ports and re-hosting the response, allowing cross site scripting. If the machine running PageSpeed has access to services that are not otherwise available, this can reveal those resources.

Users are strongly encouraged to update immediately. If this isn't possible, a workaround is available.

Issues Resolved

Issues Affecting both Nginx and Apache

Release 1.10.33.6-beta

This bug-fix release was made March 3, 2016, and is Nginx-only

Several nginx-specific bug-fixes were accidentally ommitted from the 1.10.33.5 ngx_pagespeed release. This release contains those fixes, plus an additional nginx-specific memory safety fix.

Issues Resolved

Issues Affecting Nginx

Release 1.10.33.5-beta

This bug-fix release was made February 16, 2016

This bug-fix release fixes several bugs in both ngx_pagespeed and mod_pagespeed. The release allows ngx_pagespeed to be built as a dynamic module, for compatibility with nginx version 1.9.11.

Update 2016-03-02: This release accidentally ommited fixes for ngx_pagespeed issues 1081, 1096, and 1099. Release 1.10.33.6 includes these fixes.

Issues Resolved

Issues Affecting both Nginx and Apache

Issues Affecting Apache

Issues Affecting Nginx

Release 1.10.33.4-beta

This security update release was made February 3rd, 2016. It resolves the same issues as the 1.9.32.13 stable release, and has the same patches.

Release 1.9.32.13-stable

This security update release was made February 3rd, 2016.

All previously released versions of PageSpeed are vulnerable to HTTPS-fetching vulnerability CVE-2016-2092. This permits a hostile third party who can man-in-the-middle the connection between PageSpeed and an HTTPS server to substitute arbitrary content in responses. PageSpeed is not vulnerable in its default configuration, but several filters and options can enable this vulnerability. See our CVE-2016-2092 announcement for more details and workarounds.

LibPNG has been updated to 1.2.56. Previous versions had an out-of-bounds read (CVE-2015-8540) which a hostile third party could trigger if they were in a position to supply images for PageSpeed to optimize.

The latest version of Chrome for iOS (M48) switched to the WKWebView for rendering, dropping support for WebP images. Prior versions of PageSpeed will send WebP to Chrome on iOS, giving broken images to these users. While this isn't a security vulnerability, this is a serious enough breakage that we're including it in this security release.

Issues Resolved

Issues Affecting both Nginx and Apache

Issues Affecting Apache

Release 1.10.33.2-beta

This bug-fix release was made December 21st, 2015.

Issues Resolved

Issues Affecting both Nginx and Apache

Issues Affecting Apache

Issues Affecting Nginx

Release 1.10.33.1-beta

This bug-fix release was made December 16th, 2015.

Issues Resolved

Release 1.10.33.0-beta

This release was made December 14th, 2015.

With the 1.10 release we have several high-impact features to share. We're most excited about Responsive Image Support, which delivers high resolution images to high pixel-density screens by automatically generating html5 srcset attributes for images. Other big changes include Caching Gzip Output, which lets us run gzip at the most aggressive encoding level, Remote Config, which lets you load additional configuration over the network, and converting Animated GIF to WebP, which reduces the size of animated GIFs by 65%.

New Automatically Enabled Features

Cache Gzip Output
Compress rewritten resources at the highest compression setting and store them compressed in cache.
Insert Universal Analytics
If enabled, the Insert Google Analytics filter will now insert Universal Analytics (analytics.js) instead of the legacy ga.js. This should have no impact on reporting, and gives you access to the benefits of Universal Analytics.
Fetch resources over HTTPS
HTTPS fetching is now enabled in the default configuration.
Switch to new JS Minifier
The JavaScript minifier introduced in 1.8 is now the default.
Add PageSpeedNoop Query Parameter
Add query parameter for cache busting.
HTML5-compliant attribute names
HTML5 requires all custom attributes to be prefixed with data-, and with this release PageSpeed generates data-pagespeed-foo attributes. Old-style pagespeed_foo attributes are still accepted.

New Opt-In Features

Remote Configuration
Fetch additional configuration directives over HTTPS.
Responsive Image Support
Make images responsive by adding srcset attributes for different pixel densities.
Animated WebP
Convert animated GIF to animated WebP for browsers that can render it.
Make showads.js Asynchronous
Convert the blocking showads.js snippet into the asynchronous adsbygoogle.js snippet.
HTTP/2-specific configuration in ngx_pagespeed
Allow configuring filters and sharding differently depending on whether the browser connection is HTTP/2.
Request-specific downstream caching configuration
Allow script variables in the downstream caching configuration. (Nginx only)
Content Experiments
Allow PageSpeed experiments to log data to a Google Analytics Content Experiment.

Issues Resolved

Issues Affecting both Nginx and Apache

Apache-specific Issues

Nginx-specific Issues

Release 1.9.32.11-stable

This release was made December 9, 2015. It is a clone of the 1.9.32.11-beta release.

Release 1.9.32.11-beta

This security update release was made December 9, 2015.

Issues Resolved

Release 1.9.32.10-stable

This bug-fix release was made October 27th, 2015. It is a clone of the 1.9.32.10-beta release.

Issues Resolved

Issues Affecting both Nginx and Apache

Apache-specific Issues

Nginx-specific Issues

Release 1.9.32.10-beta

This bug-fix release was made October 8th, 2015.

Issues Resolved

Release 1.9.32.6-beta

This bug-fix release was made July 29, 2015.

Issues Resolved

Issues Affecting both Nginx and Apache

Apache-specific Issues

Nginx-specific Issues

Release 1.9.32.4-stable

This release was made Jun 17, 2015. It is a clone of the 1.9.32.4-beta release.

Release 1.9.32.4-beta

This security update release was made June 17, 2015.

In versions between 1.7 and 1.9.32.3, PageSpeed was built with a version of OpenSSL that was vulnerable to the issues detailed in the June 11, 2015 security advisory. We have updated our crypto library to fix these issues. PageSpeed now builds with Google's BoringSSL, an OpenSSL fork which includes this fix, and is expected to be more stable in future.

In versions between 1.8.31.2 and 1.9.32.3 it was possible to cause a crash by requesting JavaScript source maps when source mapping had been turned off.

We recommend that all users upgrade. If this is not possible, however, the following workarounds are available:

Issues Resolved

Release 1.9.32.3-stable

This release was made January 14, 2015. It is a clone of the 1.9.32.3-beta release.

Release 1.9.32.3-beta

This bug-fix release was made January 5th, 2015.

Issues Resolved

Release 1.8.31.6-stable

This bug-fix release was made January 5th, 2015.

Issues Resolved

Release 1.9.32.2-beta

This security update release was made October 27, 2014.

Issues Resolved

Release 1.8.31.5-stable

This security update release was made October 20, 2014.

Issues Resolved

Release 1.9.32.1-beta

This release was made September 16, 2014.

New Features

Support nginx script variables in LoadFromFile
Allows configuration like LoadFromFile "http://$host/" "$document_root"
Support HTTP Persistent Connections
When using the native fetcher for Nginx, advertise Connection: Keep-Alive and keep active connections around for reuse.
Improved debug filter support
Many more filters now support debug logging, emitting explanatory comments inline when the debug filter is enabled.
Enabled InPlaceResourceOptimization by default
In Place Resource Optimization is now enabled by default.
Purge individual URLs from cache
Allows cache entries to be purged by PageSpeed administrators.
Improved PageSpeed admin site
Admin page improved to show more information, provide graphs, and perform cache-purging operations.
"Sticky" Query Parameters
Set query parameters in cookies for persisting options across queries.
Signing resource URLs
Optionally cryptographically sign and verify resource URLs.
Restrict query params
Optionally restrict interpretation of query parameters.

Issues Resolved

Release 1.8.31.4-stable

This release was made August 5, 2014. It is a clone of the 1.8.31.4-beta release.

Release 1.8.31.4-beta

This security update release was made June 17th, 2014.

Issues Resolved

Release 1.7.30.5-stable

This security update release was made June 17th, 2014.

Issues Resolved

Release 1.8.31.3-beta

This bug-fix release was made May 30th, 2014.

Issues Resolved

Release 1.8.31.2-beta

This release was made on May 6th, 2014.

New Features

New rewrite level OptimizeForBandwidth
Safe rewrite level in which HTML is not altered, but CSS, JS, and images are rewritten in place to conserve bandwidth.
New admin pages
Admin consoles at pagespeed_admin and pagespeed_global_admin simplify system configuration.
JavaScript source map support
New filter include_js_source_maps allows debugging of PageSpeed-minified code.
Image classification
PageSpeed now uses a classification algorithm to decide when to convert a lossless image (png or gif) to a lossy format (jpeg or lossy WebP).
WebP conversion on by default
The convert_jpeg_to_webp filter is now on by default as a core rewriter and as part of rewrite_images.
Serve WebP URLs to any browser
Enable users with older browsers to view .webp URLs, making it easier for visitors to share image links.
Inline resources without explicit authorization
Permits inlining of CSS and JavaScript from domains that are not directly authorized for rewriting (for example because they belong to a third party).
Downstream cache rebeaconing support
Allows filters that depend on beaconing (such as lazy loading and inlining of images) to interact correctly with downstream caches such as Varnish.
Browser-dependent in-place optimization
Enabling in_place_optimize_for_browser permits browser-dependent CSS and image optimizations such as WebP conversion.
Configurable location for static assets
New option StaticAssetPrefix specifies the path to PageSpeed-specific static assets.
Cache sharing among domains
New option CacheFragment allows multiple domains to share a portion of the cache, enabling them to share common resources.
Ability to set options in experiment specs
Experiment specifications can now include a comma-separated list of option settings similar to those in query parameters.
Optional Host: header in MapOriginDomain
The MapOriginDomain directive can now include a Host: header to be used by PageSpeed when fetching resources.
Fetch HTTPS resources in ngx_pagespeed
Support secure resource fetching using HTTPS in the nginx web server (supported in mod_pagespeed since version 1.7).
LazyloadImagesAfterOnload on by default
After onload, load all images even if some are not yet visible.

Issues Resolved

Release 1.7.30.4-stable

This release was made March 24, 2014. It is a clone of the 1.7.30.4-beta release.

Release 1.7.30.4-beta

This bug-fix release was made March 13, 2014.

Issues Resolved

Release 1.7.30.3-beta

This bug-fix release was made January 16, 2014.

Issues Resolved

Release 1.7.30.2-beta

This bug-fix release was made January 7, 2014.

Issues Resolved

Release 1.6.29.7-stable

This release was made November 13th, 2013. It is a clone of the 1.6.29.7-beta release.

Release 1.7.30.1-beta

This release was made on November 7th, 2013.

New Features

Default shared memory metadata cache
Create an on-by-default memory cache shared by all server processes.
Fetch HTTPS resources for Apache server
Support secure resource fetching using HTTPS for Apache server.
Fetch HTTPS resources using mod_spdy for Apache server
Support faster HTTPS resource fetching, if you also use mod_spdy version 0.9.4.1 or higher.
Inline Google Fonts API CSS
Reduce the number of blocking round trips required to start rendering a web page using the Google Fonts API.
Preserve URL relativity
Specify whether to preserve the relative URLs or convert them to absolute URLs.
Optimize multiple URL-valued attributes
Support optimizing more than one URL-valued attribute per element.
Implicit cache-lifetime for resources
Specify the cache lifetime for resources that do not have "Expires" or "Cache-Control" headers.
Maximum time for inplace resource rewriting
Specify the maximum time to wait for a resource to be rewritten. If the rewriting completes within this time, the rewritten resource will be served, otherwise the original resource will be served and rewriting will continue in the background.
Maximum size of the combined CSS
Specify the maximum size that CSS files may be combined to.
Maximum size of images that will be optimized
Specify the maximum size of decompressed images that PageSpeed will try to optimize.
Minimum size of JPEG images that will be compressed in progressive format
Specify the size threshold that determines when to use progressive format for compressing images to JPEG. Progressive JPEG is more effective for compressing large images, while non-progressive JPEG works better for smaller ones.
Resize images to rendered dimensions
Resize images to, or close to, the actual dimensions that they will be displayed. The rendered dimension may be smaller than that specified by the width and height attributes.
Better image compression and resizing
Use more optimized image resizing technique and remove OpenCV. Replace libjpeg with the more efficient libjpeg-turbo.
Configuration defaults updated
Starting in this release, we combine JavaScript and convert PNG images to JPEG by default.
In-Place Resource Optimization for Nginx
ngx_pagespeed can now optimize resources accessed directly from their original URLs, not just those rewritten with the PageSpeed URL format. This can be useful for optimizing resources referenced from other sites and from JavaScript.

Issues Resolved

mod_pagespeed October 2013 Security Update

mod_pagespeed releases 1.6.29.7-beta, 1.5.27.4-beta, 1.4.26.5-stable, 1.3.25.5-stable, 1.2.24.2-stable, 1.0.22.8-stable fix critical cross-site scripting (XSS) vulnerability.

ngx_pagespeed Release 1.6.29.7-beta

ngx_pagespeed release 1.6.29.7-beta fixes critical cross-site scripting (XSS) vulnerability.

Release 1.4.26.4-stable

This release was made August 7th, 2013. It contains one additional bug fix compared to version 1.4.26.3-stable, but is otherwise identical.

Issues Resolved

Release 1.6.29.5-beta

This bug-fix release was made July 25, 2013.

Issues Resolved

Release 1.6.29.4-beta

This bug-fix release was made July 11, 2013.

Issues Resolved

Release 1.6.29.3-beta

This release was made July 10, 2013.

New Features

PageSpeed Console
The PageSpeed Console monitors your installation's performance and links to general information on how to improve the performance.
Supporting downstream caches
Experimental feature for supporting caching proxy servers to allow HTML to be cached in these servers.
dedup_inlined_images
Filter that removes redundant inlined images and replaces them with JavaScript that loads all subsequent uses from the first.
Randomly drop expensive rewrites
To reduce processing load, PageSpeed can be configured to optimize the most frequently fetched resources, leaving infrequently fetched resources alone. This is accomplished by randomly dropping expensive (CSS and image) rewrites. Frequently fetched resources will have a higher probability of being rewritten than infrequently fetched resources. Over time, frequently accessed resources will be optimized and cached so a page will be fully optimized. Infrequently accessed pages will be left unoptimized or partially optimized, saving CPU time and cache space.
DisableRewriteOnNoTransform
Default on, but may be turned off to allow PageSpeed to rewrite resources even if they have a Cache-Control: no-transform header.
Configuration defaults updated
Starting in this release, we enable lossy image compression by default and update several other default configurations values. Updates:

Issues Resolved