v0.24.2

What's Changed

• Stream response bodies end to end for non-formatted output by @ryanfowler in #577
• Bound retry and digest auth body draining by @ryanfowler in #578
• Bump reqwest from 0.13.3 to 0.13.4 by @dependabot[bot] in #579
• Stream request bodies instead of fully buffering uploads by @ryanfowler in #581
• Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #580
• Enforce gRPC message limits before buffering frames by @ryanfowler in #582

Full Changelog: v0.24.1...v0.24.2

v0.24.1

What's Changed

• Use Bash for Windows release asset upload by @ryanfowler in #576

Full Changelog: v0.24.0...v0.24.1

v0.24.0

What's Changed

• Fix content detection and validation edge cases by @ryanfowler in #539
• Bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #540
• Bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #541
• Bump golang.org/x/image from 0.40.0 to 0.41.0 by @dependabot[bot] in #543
• Rewrite fetch in Rust by @ryanfowler in #544
• Bump prost-reflect from 0.16.3 to 0.16.4 by @dependabot[bot] in #546
• Bump sha1 from 0.10.6 to 0.11.0 by @dependabot[bot] in #547
• Bump rcgen from 0.13.2 to 0.14.8 by @dependabot[bot] in #545
• Reduce formatter allocation overhead by @ryanfowler in #548
• Run CI only for pull requests to main by @ryanfowler in #549
• Implement clipboard support for --copy by @ryanfowler in #550
• Implement terminal pager routing for response output by @ryanfowler in #551
• Enforce DNS timeouts during pre-resolution by @ryanfowler in #552
• Fix SigV4 canonical query sorting for duplicate parameters by @ryanfowler in #553
• Prefer filename* over filename in Content-Disposition parsing by @ryanfowler in #554
• Add AWS_SESSION_TOKEN support to SigV4 signing by @ryanfowler in #555
• Harden session cookie file permissions on Unix by @ryanfowler in #556
• Reject control characters in multipart disposition parameters by @ryanfowler in #557
• Make external image decoders opt-in by @ryanfowler in #558
• Bypass the pager for terminal image responses by @ryanfowler in #559
• Add UDP DNS receive timeouts and random query IDs by @ryanfowler in #560
• Avoid showing compressed lengths for decoded download progress by @ryanfowler in #561
• Replace --no-encode with --compress modes by @ryanfowler in #562
• Replace --no-pager with --pager auto|on|off by @ryanfowler in #563
• Add --sort-headers for sorted verbose header output by @ryanfowler in #564
• Add brotli compression negotiation and decoding by @ryanfowler in #565
• Simplify the default Accept header by @ryanfowler in #566
• Align OCSP status output with SANs in TLS inspection by @ryanfowler in #567
• Align --inspect-dns output labels and record rows by @ryanfowler in #568
• Add manual dry-run mode to release workflow by @ryanfowler in #569
• Fix SigV4 canonical query encoding for literal plus signs by @ryanfowler in #570
• Fix release builds by preserving reqwest unstable cfg by @ryanfowler in #571
• Harden installer archive extraction by @ryanfowler in #572
• Cap self-update artifact downloads by @ryanfowler in #573
• Set edit temp files to 0600 on Unix by @ryanfowler in #574
• Include effective WebSocket handshake headers in dry-run output by @ryanfowler in #575

Full Changelog: v0.23.4...v0.24.0

v0.23.4

What's Changed

• Align ALPN output with TLS line in inspect-tls by @ryanfowler in #533
• Fix session cookie persistence to match cookiejar validation by @ryanfowler in #534
• Use QUIC for TLS inspection with --http 3 by @ryanfowler in #535
• Fix exact 1 MiB response formatting boundary by @ryanfowler in #536
• Make multipart bodies replayable for 307 and 308 redirects by @ryanfowler in #537
• Allow inspection modes to ignore request-only flags by @ryanfowler in #538

Full Changelog: v0.23.3...v0.23.4

v0.23.3

What's Changed

• Stop signal handling after first Ctrl-C by @ryanfowler in #525
• Fix metadata commands to bypass auto-update startup by @ryanfowler in #526
• Fix -- handling for normal CLI parsing by @ryanfowler in #527
• Fix SigV4 canonical path handling for escaped URLs by @ryanfowler in #528
• Fix EDITOR path parsing for unquoted paths with flags by @ryanfowler in #529
• Validate header names during config parsing by @ryanfowler in #530
• Refactor ignored inspection warnings by @ryanfowler in #531
• Close idle HTTP transports before shutting down client transports by @ryanfowler in #532

Full Changelog: v0.23.2...v0.23.3

v0.23.2

What's Changed

• Bump github.com/quic-go/quic-go from 0.59.0 to 0.59.1 by @dependabot[bot] in #513
• Bump golang.org/x/image from 0.39.0 to 0.40.0 by @dependabot[bot] in #511
• Bump golang.org/x/term from 0.42.0 to 0.43.0 by @dependabot[bot] in #509
• Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #510
• Bump golang.org/x/net from 0.53.0 to 0.54.0 by @dependabot[bot] in #508
• Drain suppressed binary responses before copying to clipboard by @ryanfowler in #514
• Allow --copy to copy empty responses by @ryanfowler in #515
• Dispatch final SSE event at EOF by @ryanfowler in #516
• Set ALPN protocols for TLS inspection by @ryanfowler in #517
• Handle compressed gRPC frames in response formatting by @ryanfowler in #518
• Fix --from-curl redirect handling to match curl semantics by @ryanfowler in #519
• Handle explicit directory entries during update archive unpacking by @ryanfowler in #520
• Speed up CI integration tests with higher parallelism and shorter waits by @ryanfowler in #521
• Fix config-file color handling in startup by @ryanfowler in #522
• Expose replayable bodies through Request.GetBody by @ryanfowler in #523
• Fix DNS inspection fallback when no system nameserver is discovered by @ryanfowler in #524

Full Changelog: v0.23.1...v0.23.2

v0.23.1

What's Changed

• Tighten WebSocket UX and dry-run behavior by @ryanfowler in #496
• Improve WebSocket interactive terminal behavior by @ryanfowler in #497
• Handle Host overrides via req.Host by @ryanfowler in #498
• Fix persisted session cookie default paths by @ryanfowler in #499
• Fix no-clobber output writes to avoid overwriting newly created files by @ryanfowler in #500
• Fix Windows self-update rollback after mid-update failures by @ryanfowler in #501
• Wrap gRPC streaming request bodies for replay by @ryanfowler in #502
• Move AWS SigV4 signing to the final request mutation point by @ryanfowler in #503
• Honor environment proxy settings in the HTTP client by @ryanfowler in #504
• Use the challenged request for digest retries after redirects by @ryanfowler in #505
• Pass Host overrides into WebSocket dial options by @ryanfowler in #506
• Decode percent-encoded gRPC status messages by @ryanfowler in #507

Full Changelog: v0.23.0...v0.23.1

v0.23.0

What's Changed

• Consolidate DNS resolution into internal/resolver by @ryanfowler in #492
• Add DNS inspection mode with TTL-aware record rendering by @ryanfowler in #493
• Add min and max TLS flags by @ryanfowler in #494
• Remove the CLAUDE.md file by @ryanfowler in #495

Full Changelog: v0.22.1...v0.23.0

v0.22.1

What's Changed

• Fix redirect default limit by @ryanfowler in #483
• Fix temp file leak on rare error path in editRequestBody by @ryanfowler in #484
• Fix curl -G data expansion for file-backed payloads by @ryanfowler in #485
• Reuse native multipart validation for curl imports by @ryanfowler in #486
• Bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in #487
• Upgrade Go to v1.26.3 by @ryanfowler in #488
• Preserve host-only cookie scope in session persistence by @ryanfowler in #490
• Bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in #489
• Make host-specific config matching case-insensitive by @ryanfowler in #491

Full Changelog: v0.22.0...v0.22.1

v0.22.0

What's Changed

• Fix response body leak on decoder setup failures by @ryanfowler in #470
• Fix stacked content encoding decoding by @ryanfowler in #471
• Fix gRPC request body leaks by @ryanfowler in #472
• Fix AWS SigV4 header whitespace canonicalization by @ryanfowler in #473
• Fix update lock retry backoff by @ryanfowler in #474
• Fix orphaned temp files on atomic replace failure by @ryanfowler in #475
• Fix --output clobber handling by @ryanfowler in #476
• Fix Max-Age session cookie persistence by @ryanfowler in #477
• Fix multipart filename leak by @ryanfowler in #478
• Fix explicit empty long-flag values by @ryanfowler in #479
• Fix byte-range validation for range flags by @ryanfowler in #480
• Fix dropped WebSocket stdin messages by @ryanfowler in #481
• Add HTTP Digest Authentication support by @ryanfowler in #482

Full Changelog: v0.21.0...v0.22.0