v0.27.1

What's Changed

• fix: enforce ECH requirements for HTTP/3 by @ryanfowler in #942
• fix: escape untrusted TLS diagnostic text by @ryanfowler in #943
• Verify TLS handshake signatures with --insecure by @ryanfowler in #944
• fix: preserve ECH discovery timeout errors by @ryanfowler in #945
• fix(tls): stop inferring inspection trust anchors by @ryanfowler in #946
• fix(tls): avoid unverified OCSP status claims by @ryanfowler in #947
• chore(deps): bump base64 from 0.23.0 to 0.23.1 by @dependabot[bot] in #940
• chore(deps): bump taiki-e/install-action from 2.85.7 to 2.85.8 by @dependabot[bot] in #941
• fix(dns): support custom transports for HTTPS records by @ryanfowler in #948
• fix(dns): prevent authenticated SVCB downgrade by @ryanfowler in #949
• fix(dns): stop waiting on stalled address families by @ryanfowler in #950
• fix(dns): validate CNAME chain authorization by @ryanfowler in #951
• fix(dns): bound CNAME graph traversal by @ryanfowler in #952
• fix(dns): follow HTTPS AliasMode records by @ryanfowler in #953
• Reject malformed SVCB RRsets atomically by @ryanfowler in #954
• Supplement SVCB address hints with target resolution by @ryanfowler in #955
• fix(dns): validate DoH JSON answer owners by @ryanfowler in #956
• fix(dns): account for HTTP age in DoH TTLs by @ryanfowler in #957
• fix(dns): add default DoH transaction timeout by @ryanfowler in #958
• fix(dns): harden DoH protocol handling by @ryanfowler in #959
• fix(dns): discard mismatched UDP responses by @ryanfowler in #960
• fix(dns): retry dropped UDP queries by @ryanfowler in #961
• fix(dns): query inspection records concurrently by @ryanfowler in #962
• fix(dns): include resolver bootstrap in inspection budget by @ryanfowler in #963
• Honor system resolver policy for HTTPS records by @ryanfowler in #964
• fix(dns): validate custom resolver URLs by @ryanfowler in #965
• fix(dns): harden DNS name parsing by @ryanfowler in #966
• test: handle Windows connection refusal errors by @ryanfowler in #967
• fix(update): avoid flaky timestamp assertions by @ryanfowler in #968
• fix(dns): classify extended response codes by @ryanfowler in #970
• test: drain PTY output before assertions by @ryanfowler in #969
• fix(http): replace cached HTTPS DNS records by @ryanfowler in #971
• fix(dns): deduplicate platform addresses by @ryanfowler in #972
• fix(tls): warn when ECH uses unverified DNS by @ryanfowler in #973

Full Changelog: v0.27.0...v0.27.1

v0.27.0

What's Changed

• fix: retain digest retry client through response body by @ryanfowler in #873
• chore(deps): bump psl from 2.1.218 to 2.1.219 by @dependabot[bot] in #872
• chore: update Rust to 1.97.1 by @ryanfowler in #874
• chore(deps): bump clap from 4.6.1 to 4.6.2 by @dependabot[bot] in #875
• Harden install.sh replacement with atomic staging by @ryanfowler in #876
• chore(deps): bump tokio from 1.52.3 to 1.53.0 by @dependabot[bot] in #877
• fix: preserve Happy Eyeballs resolver preference by @ryanfowler in #878
• fix: handle digest quoted strings correctly by @ryanfowler in #879
• fix: resolve ECH and address records concurrently by @ryanfowler in #880
• fix: avoid DNS stream transaction ID collisions by @ryanfowler in #881
• fix: bound external image adapter execution by @ryanfowler in #882
• Add HAR 1.2 sidecar recording for HTTP exchanges by @ryanfowler in #883
• docs: document HAR support in agent skill by @ryanfowler in #884
• chore(deps): bump serde_json from 1.0.150 to 1.0.151 by @dependabot[bot] in #890
• chore(deps): bump thiserror from 2.0.18 to 2.0.19 by @dependabot[bot] in #885
• chore(deps): bump futures-util from 0.3.32 to 0.3.33 by @dependabot[bot] in #886
• chore(deps): bump anyhow from 1.0.103 to 1.0.104 by @dependabot[bot] in #888
• chore(deps): bump webpki-roots from 1.0.8 to 1.0.9 by @dependabot[bot] in #889
• chore(deps): bump serde from 1.0.228 to 1.0.229 by @dependabot[bot] in #887
• chore(deps): bump tokio from 1.53.0 to 1.53.1 by @dependabot[bot] in #895
• chore(deps): bump clap from 4.6.2 to 4.6.3 by @dependabot[bot] in #894
• chore(deps): bump libc from 0.2.186 to 0.2.188 by @dependabot[bot] in #892
• chore(deps): bump tokio-util from 0.7.18 to 0.7.19 by @dependabot[bot] in #891
• docs: simplify CLI documentation language by @ryanfowler in #896
• chore(deps): bump hyper from 1.10.1 to 1.11.0 by @dependabot[bot] in #893
• fix: stabilize compressed SSE retry test by @ryanfowler in #897
• test: speed up integration suite by @ryanfowler in #898
• chore(deps): bump psl from 2.1.219 to 2.1.220 by @dependabot[bot] in #899
• chore(deps): bump clap from 4.6.3 to 4.6.4 by @dependabot[bot] in #901
• chore(deps): bump libc from 0.2.188 to 0.2.189 by @dependabot[bot] in #900
• chore(deps): bump base64 from 0.22.1 to 0.23.0 by @dependabot[bot] in #902
• chore(deps): bump psl from 2.1.220 to 2.1.221 by @dependabot[bot] in #903
• chore(deps): bump htmd from 0.5.4 to 0.5.5 by @dependabot[bot] in #905
• chore(deps): bump psl from 2.1.221 to 2.1.223 by @dependabot[bot] in #904
• Enforce timeout for system DNS resolution by @ryanfowler in #906
• chore(deps): bump rustls from 0.23.42 to 0.23.43 by @dependabot[bot] in #909
• chore(deps): bump async-compression from 0.4.42 to 0.4.43 by @dependabot[bot] in #908
• chore(deps): bump http from 1.4.2 to 1.5.0 by @dependabot[bot] in #907
• Simplify agent development guidance by @ryanfowler in #910
• chore(deps): bump taiki-e/install-action from 2 to 2.85.3 by @dependabot[bot] in #911
• fix: harden WebSocket handling by @ryanfowler in #912
• fix: do not record update timestamp during dry-run by @ryanfowler in #913
• chore(deps): bump legible to 0.4.3 by @ryanfowler in #914
• chore(deps): bump taiki-e/install-action from 2.85.3 to 2.85.5 by @dependabot[bot] in #915
• chore(deps): bump clap from 4.6.4 to 4.6.5 by @dependabot[bot] in #916
• chore(deps): bump taiki-e/install-action from 2.85.5 to 2.85.6 by @dependabot[bot] in #917
• fix: keep HTTP version flags for TLS inspection by @ryanfowler in #918
• fix: derive insecure TLS schemes from crypto provider by @ryanfowler in #919
• fix: avoid waiting for QUIC inspection cleanup by @ryanfowler in #920
• fix: report ECH DNS discovery failures by @ryanfowler in #921
• fix: apply CLI TLS settings to ECH DoH discovery by @ryanfowler in #922
• fix: report TLS cipher suite in inspection by @ryanfowler in #923
• fix: use platform verifier for TLS inspection by @ryanfowler in #924
• fix: mark OCSP inspection status unverified by @ryanfowler in #925
• fix: reject schemeless IPv6 loopback TLS URLs by @ryanfowler in #926
• fix: avoid guessing omitted TLS trust roots by @ryanfowler in #927
• fix: escape untrusted DNS inspection output by @ryanfowler in #928
• fix: use platform resolver for default DNS inspection by @ryanfowler in #931
• fix: skip malformed resolv.conf nameservers by @ryanfowler in #932
• fix: report partial DNS inspection failures by @ryanfowler in #933
• chore(deps): bump ipnet from 2.12.0 to 2.12.1 by @dependabot[bot] in #930
• fix: bound DNS RDATA decoding by @ryanfowler in #934
• fix: defer encrypted DNS bootstrap for IP inspection by @ryanfowler in #935
• fix: reuse DNS inspection connections by @ryanfowler in #936
• fix: preserve DoH TTL presence by @ryanfowler in #937
• fix: bound DoH error excerpts by @ryanfowler in #938
• chore(deps): bump taiki-e/install-action from 2.85.6 to 2.85.7 by @dependabot[bot] in #929
• feat: upgrade legible to 0.5.0 and remove htmd dependency by @ryanfowler in #939

Full Changelog: v0.26.0...v0.27.0

v0.26.0

What's Changed

• docs: add portable fetch skill by @ryanfowler in #857
• chore(deps): bump memchr from 2.8.1 to 2.8.3 by @dependabot[bot] in #858
• chore(deps): bump tokio-tungstenite from 0.29.0 to 0.30.0 by @dependabot[bot] in #859
• feat: add agent skill installation by @ryanfowler in #860
• feat: add article Markdown output by @ryanfowler in #861
• docs: document article mode in agent skill by @ryanfowler in #862
• docs: streamline documentation structure by @ryanfowler in #863
• fix: share connect timeout with DNS resolution by @ryanfowler in #864
• fix: persist sessions after response errors by @ryanfowler in #865
• fix: reject premature EOF in file request bodies by @ryanfowler in #871
• chore(deps): bump http-body-util from 0.1.3 to 0.1.4 by @dependabot[bot] in #866
• chore(deps): bump rustls from 0.23.41 to 0.23.42 by @dependabot[bot] in #870
• chore(deps): bump htmd from 0.5.1 to 0.5.4 by @dependabot[bot] in #869
• chore(deps): bump socket2 from 0.6.4 to 0.6.5 by @dependabot[bot] in #868
• chore(deps): bump http-body from 1.0.1 to 1.1.0 by @dependabot[bot] in #867

Full Changelog: v0.25.2...v0.26.0

v0.25.2

What's Changed

• chore: update Rust to 1.96.1 by @ryanfowler in #832
• refactor: simplify MIME rule table by @ryanfowler in #833
• refactor: remove custom main thread stack by @ryanfowler in #834
• fix: reject non-regular request body files by @ryanfowler in #835
• fix: preserve fragments in curl GET query parsing by @ryanfowler in #836
• fix: harden remote filename sanitization by @ryanfowler in #837
• fix: create update temp files exclusively by @ryanfowler in #838
• feat: thread DoH TLS config through transport and dialing stack by @ryanfowler in #839
• fix: harden integration tests against macOS port reuse races by @ryanfowler in #840
• fix: guard streaming stdout against binary chunks by @ryanfowler in #841
• docs: remove stale ECH scoping document by @ryanfowler in #842
• chore(deps): bump psl from 2.1.216 to 2.1.217 by @dependabot[bot] in #843
• test: avoid retrying digest auth replay server by @ryanfowler in #845
• chore(deps): bump bytes from 1.12.0 to 1.12.1 by @dependabot[bot] in #844
• chore(deps): bump psl from 2.1.217 to 2.1.218 by @dependabot[bot] in #846
• chore: upgrade Rust to 1.97.0 by @ryanfowler in #847
• fix: share DNS dialing with TLS inspection by @ryanfowler in #848
• chore(deps): bump prost-reflect from 0.16.4 to 0.16.5 by @dependabot[bot] in #849
• fix: preserve methods across 301 and 302 redirects by @ryanfowler in #850
• fix: cap Retry-After delays by @ryanfowler in #851
• fix: parse NDJSON streams linearly by @ryanfowler in #852
• fix: validate DNS answer names by @ryanfowler in #853
• fix: prevent HTTP/3 cache symlink traversal by @ryanfowler in #854
• fix: move HTTP/3 cache I/O off runtime workers by @ryanfowler in #855
• fix: strip Host on cross-origin redirects by @ryanfowler in #856

Full Changelog: v0.25.1...v0.25.2

v0.25.1

What's Changed

• fix: avoid libresolv FFI for HTTPS records by @ryanfowler in #831

Full Changelog: v0.25.0...v0.25.1

v0.25.0

What's Changed

• Bump prost-types from 0.14.3 to 0.14.4 by @dependabot[bot] in #747
• Include library unit tests in CI by @ryanfowler in #748
• Bump psl from 2.1.212 to 2.1.213 by @dependabot[bot] in #749
• Handle split UTF-8 in SSE stream formatting by @ryanfowler in #750
• Propagate multipart Content-Length errors by @ryanfowler in #751
• Support URL credentials in WebSocket handshakes by @ryanfowler in #752
• Reuse multipart file metadata across previews, streaming, and length checks by @ryanfowler in #753
• Handle curl JSON defaults and cap update metadata by @ryanfowler in #755
• Refactor image decoding and rendering modules by @ryanfowler in #756
• Fix piped formatting examples in docs by @ryanfowler in #757
• Fix from-curl JSON example quoting by @ryanfowler in #758
• Clarify configuration merge order by @ryanfowler in #759
• Clarify fetch exit codes in troubleshooting docs by @ryanfowler in #760
• Return 130 on interrupted requests by @ryanfowler in #761
• Clarify --discard body handling docs and help text by @ryanfowler in #762
• Document decoded output-file downloads by @ryanfowler in #763
• Default schemeless IP URLs to HTTP by @ryanfowler in #764
• Use shlex to parse PAGER values by @ryanfowler in #765
• Bump h2 from 0.4.14 to 0.4.15 by @dependabot[bot] in #768
• Bump brotli from 8.0.3 to 8.0.4 by @dependabot[bot] in #767
• Bump time from 0.3.47 to 0.3.49 by @dependabot[bot] in #766
• [codex] fix image rendering edge cases by @ryanfowler in #769
• Fix from-curl proto schemeless URL handling by @ryanfowler in #770
• Add update documentation for manual and automatic updates by @ryanfowler in #771
• Clarify configuration precedence and list merging by @ryanfowler in #772
• Reject duplicate host config sections during parsing by @ryanfowler in #773
• Document pager environment variables in the CLI reference by @ryanfowler in #774
• Warn on ignored request flags during inspect modes by @ryanfowler in #775
• Add plaintext URL hints for schemeless HTTPS failures by @ryanfowler in #776
• Add HTTP version aliases and clearer protocol errors by @ryanfowler in #777
• Bump webpki-roots from 1.0.7 to 1.0.8 by @dependabot[bot] in #778
• Use rustls platform verifier for WebSocket TLS by @ryanfowler in #779
• Remove stale core type definitions by @ryanfowler in #780
• Centralize ignored inspection flag handling by @ryanfowler in #781
• Box async dispatch futures in request and inspection paths by @ryanfowler in #782
• Unify happy eyeballs connection racing by @ryanfowler in #783
• Add automatic HTTP/3 discovery and racing by @ryanfowler in #784
• Skip auto-H3 target DNS while normal lookup runs by @ryanfowler in #785
• Bump bytes from 1.11.1 to 1.12.0 by @dependabot[bot] in #786
• Preserve connect budget across happy-eyeballs races by @ryanfowler in #787
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #788
• Persist learned HTTP/3 alternatives in cache by @ryanfowler in #789
• Consolidate response streaming copy helpers by @ryanfowler in #790
• Refactor DNS and TLS inspection into focused modules by @ryanfowler in #791
• Refactor terminal size plumbing for image rendering by @ryanfowler in #792
• Handle MessagePack binary map key strings by @ryanfowler in #793
• Bump quinn from 0.11.9 to 0.11.11 by @dependabot[bot] in #794
• Bump time from 0.3.49 to 0.3.51 by @dependabot[bot] in #795
• Split HTTP transport into focused modules by @ryanfowler in #796
• Refactor staggered connect races into a shared helper by @ryanfowler in #797
• Refactor flag conflict validation for curl and WebSocket paths by @ryanfowler in #798
• Refactor home-path expansion into fileutil by @ryanfowler in #799
• Refactor proto support into focused submodules by @ryanfowler in #800
• Fix gRPC JSON-to-protobuf conversion to use direct serde deserialization by @ryanfowler in #801
• Refactor config option descriptors in config parsing by @ryanfowler in #802
• Refactor gRPC descriptor formatting to stream printers by @ryanfowler in #805
• Bump rustls from 0.23.40 to 0.23.41 by @dependabot[bot] in #803
• Bump psl from 2.1.213 to 2.1.214 by @dependabot[bot] in #804
• Fix image option help spacing by @ryanfowler in #806
• Document proxy environment precedence and lowercase variables by @ryanfowler in #807
• Bump psl from 2.1.214 to 2.1.215 by @dependabot[bot] in #808
• Bump anyhow from 1.0.102 to 1.0.103 by @dependabot[bot] in #809
• Sanitize self-update networking from request TLS overrides by @ryanfowler in #810
• Bump quick-xml from 0.40.1 to 0.41.0 by @dependabot[bot] in #812
• Add DNS over TCP, TLS, and QUIC support by @ryanfowler in #813
• Verify self-update artifact checksum before extraction by @ryanfowler in #814
• Add ECH (Encrypted Client Hello) support by @ryanfowler in #815
• centralize color_for_status in core.rs by @ryanfowler in #816
• Compact agent guidance by @ryanfowler in #818
• dedupe: remove three private copies of flush_stderr by @ryanfowler in #817
• dedupe: replace 5 duplicated flag-check functions with unified registry by @ryanfowler in #819
• refactor: replace config option macros by @ryanfowler in #820
• fix: include config file path in missing config error by @ryanfowler in #821
• fix: treat --timeout 0 and --connect-timeout 0 as no timeout (curl-compatible) by @ryanfowler in #822
• fix: make --connect-timeout/--retry-delay error messages consistent with clap style by @ryanfowler in #823
• fix: simplify binary response warning message by @ryanfowler in #824
• feat: add verbose help menu by @ryanfowler in #825
• fix: include --http in --inspect-tls ignored flag warning by @ryanfowler in #826
• fix: show proper conflict error between --output and --remote-name by @ryanfowler in #827
• test: speed up integration tests with channel notification and parallel execution by @ryanfowler in #828
• Bump rand from 0.10.1 to 0.10.2 by @dependabot[bot] in #830
• Bump psl from 2.1.215 to 2.1.216 by @dependabot[bot] in #829

Full Changelog: v0.24.12...v0.25.0

v0.24.12

What's Changed

• Harden install.sh checksum verification and completion handling by @ryanfowler in #730
• Add SECURITY.md for vulnerability reporting by @ryanfowler in #731
• Bump http from 1.4.1 to 1.4.2 by @dependabot[bot] in #733
• Bump prost from 0.14.3 to 0.14.4 by @dependabot[bot] in #732
• Infer POST for body flags when --method is omitted by @ryanfowler in #734
• Clarify forced HTTP version behavior in docs by @ryanfowler in #735
• Reject non-GET WebSocket methods by @ryanfowler in #736
• Document the output model and clarify binary warnings by @ryanfowler in #737
• Clarify HTTP 4xx/5xx exit behavior in docs and help text by @ryanfowler in #738
• Limit compressed SSE auto-retries to safe methods by @ryanfowler in #739
• Warn when -J falls back from Content-Disposition by @ryanfowler in #740
• Respect PAGER, LESS, and NO_PAGER for response paging by @ryanfowler in #741
• Clarify Windows config file search order by @ryanfowler in #742
• Correct silent mode docs to say only errors are shown by @ryanfowler in #743
• Streamline AGENTS.md test guidance by @ryanfowler in #744
• Fix WebSocket spacing and Ctrl-C shutdown behavior by @ryanfowler in #745
• Color descriptor-backed gRPC JSON output by @ryanfowler in #746

Full Changelog: v0.24.11...v0.24.12

v0.24.11

What's Changed

• Simplify URL parsing detection in metadata by @ryanfowler in #719
• Expand the README with key feature examples by @ryanfowler in #720
• Refresh fetch tagline and project description by @ryanfowler in #721
• Centralize config option handling in config parsing by @ryanfowler in #722
• Use typed Clap error context for parse diagnostics by @ryanfowler in #723
• Refactor shared file lock handling by @ryanfowler in #724
• Refactor HTTP response handling into focused modules by @ryanfowler in #725
• Deduplicate output install pipeline by @ryanfowler in #726
• Refactor update logic into modular files by @ryanfowler in #727
• Centralize stderr status rendering through core::Printer by @ryanfowler in #729
• Split integration test support into domain modules by @ryanfowler in #728

Full Changelog: v0.24.10...v0.24.11

v0.24.10

What's Changed

• Limit WebSocket and gRPC request bodies by @ryanfowler in #711
• Protect self-update redirects from HTTP downgrade by @ryanfowler in #712
• Preserve explicit config in background auto-update by @ryanfowler in #713
• Harden Windows archive path extraction by @ryanfowler in #714
• Fix WebSocket header handling and tighten update archive checks by @ryanfowler in #715
• Stop tar.gz update downloads after unpack failure by @ryanfowler in #716
• Bound dry-run request body previews by @ryanfowler in #717
• Reserve capacity for split gRPC frames by @ryanfowler in #718

Full Changelog: v0.24.9...v0.24.10

v0.24.9

What's Changed

• Ignore untracked files in buildinfo VCS status by @ryanfowler in #691
• Pin Cargo dependencies to exact latest versions by @ryanfowler in #692
• Bound self-update archive extraction by @ryanfowler in #693
• Protect concurrent session cookie saves by @ryanfowler in #694
• Handle broken pipes cleanly on stdout writes by @ryanfowler in #695
• Bound clipboard clipboard backend waits to avoid hangs by @ryanfowler in #696
• Add session cookie support to WebSocket handshakes by @ryanfowler in #697
• Cap gRPC reflection response buffering by @ryanfowler in #698
• Bound WebSocket text stdin lines and document binary fallback by @ryanfowler in #699
• Abort HTTP/3 upload tasks on drop by @ryanfowler in #700
• Bound session and update lock waits by @ryanfowler in #701
• Fix proxy-aware DNS pre-resolution for env proxies by @ryanfowler in #703
• Support port-qualified NO_PROXY entries by @ryanfowler in #704
• Reject TLS key-only config from merged sources by @ryanfowler in #705
• Harden self-update extraction temp handling by @ryanfowler in #706
• Bound SSE formatted stream buffer growth by @ryanfowler in #707
• Stream self-update artifact downloads during update by @ryanfowler in #708
• Stream single-file from-curl bodies by @ryanfowler in #709
• Add explicit WebSocket receive caps by @ryanfowler in #710

Full Changelog: v0.24.8...v0.24.9