*) Security: nginx now checks URI got from a backend in
       "X-Accel-Redirect" header line or in SSI file for the "/../" paths
       and zeroes.

    *) Change: nginx now does not treat the empty user name in the
       "Authorization" header line as valid one.

    *) Feature: the "ssl_session_timeout" directives of the
       ngx_http_ssl_module and ngx_imap_ssl_module.

    *) Feature: the "auth_http_header" directive of the
       ngx_imap_auth_http_module.

    *) Feature: the "add_header" directive.

    *) Feature: the ngx_http_realip_module.

    *) Feature: the new variables to use in the "log_format" directive:
       $bytes_sent, $apache_bytes_sent, $status, $time_gmt, $uri,
       $request_time, $request_length, $upstream_status,
       $upstream_response_time, $gzip_ratio, $uid_got, $uid_set,
       $connection, $pipe, and $msec. The parameters in the "%name" form
       will be canceled soon.

    *) Change: now the false variable values in the "if" directive are the
       empty string "" and string starting with "0".

    *) Bugfix: while using proxied or FastCGI-server nginx may leave
       connections and temporary files with client requests in open state.

    *) Bugfix: the worker processes did not flush the buffered logs on
       graceful exit.

    *) Bugfix: if the request URI was changes by the "rewrite" directive
       and the request was proxied in location given by regular expression,
       then the incorrect request was transferred to backend; the bug had
       appeared in 0.2.6.

    *) Bugfix: the "expires" directive did not remove the previous
       "Expires" header.

    *) Bugfix: nginx may stop to accept requests if the "rtsig" method and
       several worker processes were used.

    *) Bugfix: the "\"" and "\'" escape symbols were incorrectly handled in
       SSI commands.

    *) Bugfix: if the response was ended just after the SSI command and
       gzipping was used, then the response did not transferred complete or
       did not transferred at all.

    *) Change: the "bl" and "af" parameters of the "listen" directive was
       renamed to the "backlog" and "accept_filter".

    *) Feature: the "rcvbuf" and "sndbuf" parameters of the "listen"
       directive.

    *) Change: the "$msec" log parameter does not require now the
       additional the gettimeofday() system call.

    *) Feature: the -t switch now tests the "listen" directives.

    *) Bugfix: if the invalid address was specified in the "listen"
       directive, then after the -HUP signal nginx left an open socket in
       the CLOSED state.

    *) Bugfix: the mime type may be incorrectly set to default value for
       index file with variable in the name; the bug had appeared in 0.3.0.

    *) Feature: the "timer_resolution" directive.

    *) Feature: the millisecond "$upstream_response_time" log parameter.

    *) Bugfix: a temporary file with client request body now is removed
       just after the response header was transferred to a client.

    *) Bugfix: OpenSSL 0.9.6 compatibility.

    *) Bugfix: the SSL certificate and key file paths could not be relative.

    *) Bugfix: the "ssl_prefer_server_ciphers" directive did not work in
       the ngx_imap_ssl_module.

    *) Bugfix: the "ssl_protocols" directive allowed to specify the single
       protocol only.

    *) Feature: the Sun Studio 10 C compiler support.

    *) Feature: the "proxy_upstream_max_fails",
       "proxy_upstream_fail_timeout", "fastcgi_upstream_max_fails", and
       "fastcgi_upstream_fail_timeout" directives.

    *) Change: the 10-days live time limit of worker process was
       eliminated. The limit was introduced because of millisecond timers
       overflow.

    *) Change: while using load-balancing the time before the failed
       backend retry was decreased from 60 to 10 seconds.

    *) Change: the "proxy_pass_unparsed_uri" was canceled, the original URI
       now passed, if the URI part is omitted in "proxy_pass" directive.

    *) Feature: the "error_page" directive supports redirects and allows
       more flexible to change an error code.

    *) Change: the charset in the "Content-Type" header line now is ignored
       in proxied subrequests.

    *) Bugfix: if the URI was changed in the "if" block and request did not
       found new configuration, then the ngx_http_rewrite_module rules ran
       again.

    *) Bugfix: if the "set" directive set the ngx_http_geo_module variable
       in some configuration part, the this variable was not available in
       other configuration parts and the "using uninitialized variable"
       error was occurred; the bug had appeared in 0.2.2.

    *) Change: if the request header has duplicate the "Host",
       "Connection", "Content-Length", or "Authorization" lines, then nginx
       now returns the 400 error.

    *) Change: the "post_accept_timeout" directive was canceled.

    *) Feature: the "default", "af=", "bl=", "deferred", and "bind"
       parameters of the "listen" directive.

    *) Feature: the FreeBSD accept filters support.

    *) Feature: the Linux TCP_DEFER_ACCEPT support.

    *) Bugfix: the ngx_http_autoindex_module did not support the file names
       in UTF-8.

    *) Bugfix: the new log file can be rotated by the -USR1 signal only if
       the reconfiguration by the -HUP signal was made twice.

    *) Feature: the "working_directory" directive.

    *) Feature: the "port_in_redirect" directive.

    *) Bugfix: the segmentation fault was occurred if the backend response
       header was in several packets; the bug had appeared in 0.1.29.

    *) Bugfix: if more than 10 servers were configured or some server did
       not use the "listen" directive, then the segmentation fault was
       occurred on the start.

    *) Bugfix: the segmentation fault might occur if the response was
       bigger than the temporary file.

    *) Bugfix: nginx returned the 400 response on requests like
       "GET http://www.domain.com/uri HTTP/1.0"; the bug had appeared in
       0.1.28.

    *) Bugfix: the worker process may got caught in an endless loop if the
       big response part were include by SSI.

    *) Bugfix: the variables set by the "set" directive were not available
       in SSI.

    *) Feature: the "autoindex_localtime" directive.

    *) Bugfix: the empty value of the "proxy_set_header" directive forbids
       the client request header line passing.

    *) Bugfix: nginx could not be built with the --without-pcre parameter;
       the bug had appeared in 0.1.29.

    *) Bugfix: 3, 4, 7, and 8 the "proxy_set_header" directives in one
       level cause the bus fault on start up.

    *) Bugfix: the HTTP protocol was specified in the HTTPS redirects.

    *) Bugfix: if the "rewrite" directive used the captures inside the "if"
       directive, then the 500 error code was returned.

    *) Bugfix: the arguments were omitted in the redirects, issued by the
       "rewrite" directive; the bug had appeared in 0.1.29.

    *) Feature: the "if" directive supports the captures in regular
       expressions.

    *) Feature: the "set" directive supports the variables and the captures
       of regular expressions.

    *) Feature: the "X-Accel-Redirect" response header line is supported in
       proxy and FastCGI mode.