2.14.1

2.14.1 / 2026-08-22

Security

• Strip both Proxy-Authorization and Cookie2 headers on a cross-origin redirect. GHSA-2mwr-xjcg-37j7
• Headers set through Mechanize#request_headers= now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. GHSA-2mwr-xjcg-37j7
• A redirect is now considered cross-origin when the scheme, the host or the port changes, per RFC 6454. Previously only a host change discarded cookies, and an https: to http: redirect to the same host carried credentials in cleartext. GHSA-5jgv-wc2m-xv99
• A meta refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through Mechanize#request_headers= followed it unconditionally. GHSA-c6rp-p8xm-4q9f

Improved

• A meta refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through Mechanize#request_headers=.
• robots.txt is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through Mechanize#request_headers=. It is a request mechanize makes on its own behalf.