Raphael Kabo

I recently rebuilt this website, including its blog, in Lua. Partly this was because I wanted my blog to appear on the Fediverse, which it now does! You'll find my posts if you search for @blog@raphaelkabo.com. The site was previously built with Eleventy, a lovely static site generator, and while it's not impossible by any means to make a static website appear on the Fediverse (for example, and some more thoughts here), it's a fair bit easier on a dynamic server. But mostly it was because I wanted to code something in Lua, a fun, smart language I admire. I called the resulting app Lunette, because it's a tiny moon-shaped window on the Fediverse.

Look, there I am!

The new site worked beautifully for a few days, and then crashed with an infinite loop which ate up all of the container's processor allotment.

Lua is a great language, but it has an almost nonexistent stdlib because it's so small. The tradition in the Lua ecosystem has therefore always been to create your own little helper functions for the simple stuff, and to hope that someone has created a library for the more complicated stuff and that the library is still maintained and feature-complete, because there are far fewer Lua developers out there than for some of the more popular languages.

This is what bit me with lua-http, a venerable library which I decided to use for Lunette's underlying HTTP server stack. The repo recommends installing the last published version via luarocks, but that version, 0.4, was released in 2021. My infinite loop turned out to be a known bug - so well known, in fact, that it was given a CVE number, CVE-2023-4540! The fix was committed in August 2023, before the CVE was even published. But three years have gone by, and it still hasn't been released in a new version.

For me, the solution was simple: rather than pulling the last published version from the registry, I could instruct luarocks to pull a version which included the commit with the bugfix, and build that directly:

ARG LUA_HTTP_REF=ee3cf4b4992479b8ebfb39b530694af3bbd1d1eb
RUN curl -sfL "https://github.com/daurnimator/lua-http/archive/${LUA_HTTP_REF}.tar.gz" | tar xz -C /tmp \
  && cd "/tmp/lua-http-${LUA_HTTP_REF}" \
  && luarocks --lua-version=5.4 make http-scm-0.rockspec \
  && cd / && rm -rf "/tmp/lua-http-${LUA_HTTP_REF}"

The command luarocks make builds the spec from the checked-out source rather than fetching anything from the luarocks server, so what ends up installed is the current main branch, bugfix included, rather than 0.4.

I continue to have worries about lua-http, though. When I was building Lunette I also hit another bug for which there isn't yet a fix, and development on lua-http looks to have stalled - the last commit was two years ago. How many more bugs around recent HTTP features and protocols might I hit in the future? The benefit of a statically built site was that I never had to worry about this sort of thing. And an HTTP library is not an easy thing to get right, because modern HTTP protocols are a moving target. While I love lending a hand to open source projects, I don't have the experience to help with the development of lua-http, which makes me a passive consumer hoping that it hasn't been abandoned completely! ActivityPub is quite hard too, and also constantly evolving, but between Gathio, MixPal, and now Lunette, at least I know my way around it.

Abandoned libraries are one of the oldest problems of the free software movement. They're a labour of love, and their builders and maintainers should be structurally supported. For large languages like TypeScript, I sometimes see this happening - a 'software tax' of sorts where successful companies give back to the libraries which underpin their software. But Lua is a tiny ecosystem of hackers - mostly game developers - and very few of them need an HTTP library!

If you're running lua-http in 2026, have you had any issues? And if you've switched to another library, which one, and how have you found it? Let me know!