Release v3.60.0 Release · imroc/req

Breaking Changes

SetTLSFingerprintSpec API change — The signature changed from SetTLSFingerprintSpec(spec *utls.ClientHelloSpec) to SetTLSFingerprintSpec(fn func() utls.ClientHelloSpec). This fixes a bug where reusing the same spec across multiple TLS handshakes caused the second handshake to fail (#504). The factory function ensures a fresh spec is generated per connection. PR #507 by @1992w.

SetMaxResponseSize — Limit response body size at the client or request level. When Content-Length is known and exceeds the limit, the body is closed without reading. For chunked responses, a streaming limit reader stops at the configured size and returns ErrResponseBodyTooLarge. Closes #406. PR #512 by @ManuelReschke.
SOCKS4 and SOCKS4a proxy support — socks4:// and socks4a:// proxy URLs are now supported. SOCKS4 resolves domain names locally to IPv4; SOCKS4a sends the domain name to the proxy for remote resolution. Closes #473. PR #510 by @ManuelReschke.
HTTP QUERY method — Added Request.Query(url) and Request.MustQuery(url) for the HTTP QUERY method defined in RFC 10008 (Proposed Standard, June 2026). PR #508 by @thatwasyahya.
Retry on before-request errors — Retry logic now covers errors from before-request middleware, not just transport errors. PR #499 by @bao-io.

Stream multipart uploads without buffering files — Multipart uploads now stream directly to the HTTP transport via io.Pipe instead of building the complete body in a bytes.Buffer. Memory usage is bounded for large file uploads. Fixes #433. PR #505 by @ManuelReschke.