v7.4.18
·
152 commits
to 8.2
since this release
Immutable
release. Only release title and notes can be modified.
Changelog (v7.4.17...v7.4.18)
- bug #65751 Reject decompression bombs (@nicolas-grekas)
- bug #65740 Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
- bug #65731 Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
- bug #65742 Reject 3xx pushed responses (@nicolas-grekas)
- bug #65704 Drop credentials when a redirect changes the scheme (@nicolas-grekas)
Contributors
nicolas-grekas