v0.1.2

Security

• leyline-bssl-sys carries BoringSSL's fix for CVE-2026-35189. A peer
  certificate with many nameRelativeToCRLIssuer CRL distribution points
  could make certificate verification allocate memory without bound. CRL
  distribution points that use a relative name are now ignored.

Added

• A Firefox 157 profile, Browser::Firefox157, from captures of Firefox 157.0
  on macOS and Linux.

Changed

• leyline-bssl-sys ships pre-generated BoringSSL bindings for each
  supported target, so a build no longer compiles or runs bindgen, and
  links the BoringSSL source into the build directory instead of copying
  it. Cold builds are faster. To generate the bindings at build time, for
  example for another target, enable the new bindgen feature. CMake uses
  the Ninja generator when ninja is on PATH and CMAKE_GENERATOR is
  not set.

Fixed

• leyline-http builds again with default features off and http3 left
  out. 0.1.1 did not compile in that configuration.
• RequestBuilder::send boxes its request state, so nesting a few requests
  in one task no longer overflows a 2 MB thread stack.
• RetryPolicy::retry_unsent(true) no longer replays a non-idempotent
  request after a redirect leg got a response. A connection failure on a
  later leg used to resend the original request, for example a POST that
  the server had already processed and answered with a 303. A 401 digest
  challenge does not count as an answer, so a request whose authorized leg
  could not connect is still retried.
• error_for_status reads and decodes at most max_error_body bytes of an
  error response, within the error-body timeout, on HTTP/1.1, HTTP/2, and
  HTTP/3. It used to read and decode the whole body first, so a large, slow,
  or highly compressed error body ran to the body timeout or returned a body
  error instead of the status error. A response below 400 is still read in
  full, with its trailers and connection reuse. The error's headers no longer
  list a content-encoding that its decoded body does not have.
• Each Browser variant keeps a fixed discriminant, listed in
  profiles/browser_ids.toml, so adding a profile no longer changes the
  value of the variants after it.
• The leyline-bssl-sys build script reruns when a patch is added to
  patches/. Before, a new patch was not applied to an existing build
  directory.