v6.4.45
·
463 commits
to 8.2
since this release
Immutable
release. Only release title and notes can be modified.
Changelog (v6.4.44...v6.4.45)
- bug #65751 Reject decompression bombs (@nicolas-grekas)
- bug #65740 Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
- bug #65731 Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
- bug #65742 Reject 3xx pushed responses (@nicolas-grekas)
- bug #65704 Drop credentials when a redirect changes the scheme (@nicolas-grekas)
Contributors
nicolas-grekas