Skip to content

v5.4.54

Latest
Latest

Choose a tag to compare

View all tags
@fabpot fabpot released this 15 Oct 06:52
· 996 commits to 8.2 since this release
Immutable release. Only release title and notes can be modified.
v5.4.54
This tag was signed with the committer’s verified signature.
fabpot Fabien Potencier
SSH Key Fingerprint: 2Epes5EqLalzBuDpYoQuproz9c57CsymvlzEGYtOXJw
Verified
Learn about vigilant mode.
240dce3

Changelog (v5.4.53...v5.4.54)

  • bug #66938 Don't add the query option again to redirect targets in NoPrivateNetworkHttpClient (@nicolas-grekas)
  • bug #66270 Don't reject highly compressed responses (@nicolas-grekas)
  • bug #66080 Add missing non-routable ranges to NoPrivateNetworkHttpClient (@nicolas-grekas)
  • bug #65751 Reject decompression bombs (@nicolas-grekas)
  • bug #65740 Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
  • bug #65731 Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
  • bug #65742 Reject 3xx pushed responses (@nicolas-grekas)
  • bug #65704 Drop credentials when a redirect changes the scheme (@nicolas-grekas)

[SECURITY] Security release

Contributors

nicolas-grekas
Assets 3
Loading