v1.5.0

Response examples

Kurlo can now keep what an endpoint actually returned, next to the request that
asked for it.

Capture a response from the response panel or from a history entry, edit its
status and body by hand, and keep as many as the endpoint has interesting
outcomes. Examples are stored in the workspace files — one file per example,
with the body in a sibling file named for its media type — so changing one is a
reviewable diff in Git rather than something only you can see.

Capturing redacts in three passes: the exact values of your secret environment
variables, then the same key sweep the export paths use, then a warning for
anything credential-shaped that survived. A response body is the most likely
place for a token to slip into a commit.

Examples come in with your collections, from every import path that carries
them and previously threw them away: Postman saved responses, OpenAPI
responses (including a value derived from the schema when the spec writes no
example), OpenCollection, and HAR — a HAR file is a recording of real
request/response pairs, and Kurlo was importing only the request half.

The Diff tab can use an example as its baseline instead of the previous
response, which is how you notice an API that changed shape without anyone
saying so.

If you use manual saving, this is the release to take

An explicit save could write the previous version of a request. In manual-save
mode the store deliberately keeps the last saved version of anything with
unsaved edits — that is what stops a half-typed change reaching disk — but the
mark was cleared only after the write finished, so a save you asked for was
still counted as unsaved while the file was being assembled. It wrote the older
version, reported success, and cleared the unsaved indicator. The change was
gone on the next load, with nothing saying so.

Autosave was never affected.

Other fixes

• AWS Signature v4 signed a fixed list of headers, so DynamoDB, Lambda and
  S3 with any of its option headers rejected every request with
  SignatureDoesNotMatch. Signing also no longer reads a large upload into
  memory before sending it.
• A JSON body left empty sent no Content-Type, so servers that check the
  header before reading the body answered 415.
• Digest auth with no username sent nothing at all and came back 401 without
  explanation.
• pm.sendRequest ignored your proxy and client certificate, so a script
  could not reach an endpoint the request beside it reached fine.
• Send-and-Download saved the compressed bytes when the request asked for an
  encoding explicitly, producing a gzip file named report.json.
• Importing a Postman collection dropped per-request redirect and TLS
  settings, and the values behind :pathVariable — leaving a URL that still
  said :id and could not be sent.
• Multipart parts can carry their own Content-Type, so an API that validates
  the MIME type of an upload stops rejecting them.
• The header buttons moved when you opened the runner, leaving a gap at the
  right edge.

The full list is in CHANGELOG.md.