v1.21.2

Fixes:

• Form body limits to respect max body size settings.
• If non-JSON is received, but that is expected, then respond with 415 instead of 400.

Improvements:

• Minor documentation update.

v1.21.1

Empty body decoding fix, HTTP status 204 and similar cases.

v1.21.0

Improvements

• Go 1.27 json/v2 explicit support.
• Created JSONOptions to set default marshal/unmarshal options
• Improved handling of too big body received. Works both for streaming and non-chunked transmissions. Both client and server. Error ErrContentTooLarge is returned in many cases.
• Redirect: Client may return ErrNonHTTPSURL on redirects even if the original URL is https.
• Redirect: MaxRedirect can be set. Defaults to 10. If redirects are beyond that, client returns ErrMaxRedirectsExceeded.
• CRL: limit max file size that can be processed using MaxCRLHTTPBodyBytes. On error the client returns ErrCRLHTTPBodyTooBig and the response body is not read.
• CRL: HTTP timeout is configurable using CRLHTTPTimeout.
• CRL: If read interval is not set by the user, it defaults to 24h.
• Server: ServerWriteTimeout and ServerIdleTimeout timeouts are configurable and have reasonable defaults.

Dropped

• Drop experimental msgpack support. It was a neat idea, but benchmarks never proved it to have serious advantage.

Fixes

• Missing response closes
• Redirect: HTTPS checking is still applied. Client may return ErrNonHTTPSURL on redirects even if the original URL is https.
• Client: Put() context fix.
• Client: SendRecvListFirst2xxParallel() used to leave dangling responses.
• Client: IPv6 URL syntax fix for Retry().
• Server: Keep TLS config if Restart() is used.
• Old (non-OTel) tracer: Validate the headers before using.

Other

• HTTP2 transport rewritten for Go 1.27. It should work just like before.
• Consistent cleartext protocol checking for OAuth2 token request. No h2 specific code but relies on client HTTPS().

v1.20.0

Client HTTPS has a new option AllowPrivateHTTP.

v1.19.1: CRL related fixes (#120)

Certificate Revocation List (CRL) https URL handling and resource leak fix.

v1.19.0

Breaking changes:

Dropping "Sanitize JSON" feature. It was deprecated for a while. If you still use it, check your data structures: For scalars (e.g. strings) and containers (e.g. slices) use omitempty tag, and structs are to be pointers, again with omitempty tag.

Deprecated SendResponse (now same as SendJSONResponse) and SendLocationResponse (no one uses that).

v1.18.2

What's Changed

• fix(logging): use logrus.WithContext and transport-level client logging by @unseen2004 in #115
• Fixes by @Som-Som-CC in #116
• Enhance TraceB3 by adding SpanID initialization by @zombi-HU in #117

New Contributors

• @unseen2004 made their first contribution in #115

Full Changelog: v1.18.1...v1.18.2

v1.18.1

Update packages due to GO-2026-4559

v1.18.0

Added lambda.RequestBodyQueryParameters. It returns values of the request body query parameters when Content-Type is application/x-www-form-urlencoded.

v1.17.6

What's Changed

• Sanitize JSON deprecated by @Som-Som-CC in #110
• Otel off by @Som-Som-CC in #111
• Methodnotallowedhandler added by @zombi-HU in #112

Full Changelog: v1.17.5...v1.17.6