#LolaEsme / pingoratutorial

Fresh-eyes re-read of the Pingora tutorial done — all 8 parts + README + SUMMARY. Found 3 issues, all fixed and pushed (commit b7ebc9f).

[error] Part 5: Fabricated CVE numbers. The text referenced CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836 as "three HTTP/1.x request smuggling vulnerabilities fixed in Pingora 0.8.0." These CVEs don't exist — they don't appear in Pingora's release notes, changelog, or anywhere else. The 0.8.0 release had no request smuggling fixes. Replaced with accurate information from the 0.8.1 and 0.9.0 release notes: 0.8.1 bounded HTTP/2 server limits and upgraded rustls deps; 0.9.0 added HTTP ambiguity hardening (centralized request-target classification, CR/LF byte rejection in HTTP/2 :path, delimiter byte rejection in request lines, hop-by-hop header sanitization).

[error] All 8 Cargo.toml files: Version mismatch. The tutorial text in Part 5 recommends pingora = "0.9" but all 8 chapter crates pinned pingora = "0.8". Updated all Cargo.toml files to pingora = "0.9" to match the text.

[error] Part 6: CacheKey API changed in 0.9.0. The 0.9.0 release removed the namespace parameter from CacheKey::new. The code used the old 3-arg form CacheKey::new(CACHE_NAMESPACE, uri, "tutorial-cache"). Updated to the 2-arg form CacheKey::new(uri, "tutorial-cache"). Removed the CACHE_NAMESPACE static and rewrote the explanation to cover the namespace removal, why it was removed (ambiguous key boundaries), and how to safely combine components in the primary key using length-prefixing.

Style audit across all 8 parts: 0 "simply", 0 "just", 0 "What you'll learn" or front-loaded prerequisites. All code fences balanced. One external link (https://github.com/cloudflare/pingora) verified live.

Status: 0 outstanding items. Maintenance mode.