http4s 0.23

Apply the Scala 3.8.4 prompt, including its Java 25 baseline, first. These rules cover JVM http4s 0.23 and its Ember backend, and were checked against 0.23.36. Validate that application compiler/runtime combination; it is not http4s's minimum runtime requirement or its exact upstream test matrix.

Version and deployment boundaries

• Keep the http4s core, server, client, DSL, Circe, and Ember modules on one release and move them together. On 0.23.0 through 0.23.36, which predate the 0.23.37 fixes for seven HTTP/2, h2c, and WebSocket defragmentation advisories, apply the withoutHttp2 rule below and the defragmenter rule under WebSockets before exposing those features to untrusted peers.
• On 0.23.0 through 0.23.36, keep both EmberServerBuilder and EmberClientBuilder on withoutHttp2, which preserves their default. If HTTP/2 is required at the edge, terminate it at a patched proxy and use HTTP/1.1 to Ember. Route-level EntityLimiter, Timeout, and smaller HTTP/2 settings do not repair the affected protocol implementation.
• Bind deliberately with withHost, use withTLS or an isolated TLS-terminating proxy, and configure finite withRequestHeaderReceiveTimeout, withIdleTimeout, withShutdownTimeout, withMaxHeaderSize, and withMaxConnections. Header and socket limits do not impose an application body-size limit or total request deadline.
• Validate the accepted host/authority and derive public redirect origins from configuration. Accept forwarded headers only from trusted proxies that overwrite client-supplied values: Request.from prefers