[dependabot]

Updates the requirements on HTTP to permit the latest version.

Release notes

Sourced from HTTP's releases.

v2.9.0

HTTP v2.9.0

Diff since v2.8.0

Added

• The allow_h2c keyword on Server, listen!, serve! and serve. Setting it to false stops plain TCP listeners from serving cleartext HTTP/2 (h2c). The default is unchanged. (#1385)

Changed

• After HTTP.startwrite(stream), a fixed-length HTTP/1 response streams once its body passes 4 KiB. Smaller responses still go out in one write. HTTP.streamhandler now streams bodies that are not already in memory, such as fileserver files. (#1384)
• HTTP/1 server read deadlines now apply only to the matching phase of a request. read_header_timeout no longer limits the request body or the idle wait between keep-alive requests. When an idle connection times out or the client closes it between requests, the server no longer sends a 408 or 400. (#1381)
• When a response has an error status, a byte-buffer response_stream (a vector or a view) is left untouched. The body goes to response.body and a StatusError is raised, as in HTTP.jl 1.x. IO sinks still receive every body. (#1387)
• Repeated Cookie lines and values are now joined with "; " instead of a comma. (#1386)

Fixed

• Redirects resolve Location as RFC 3986 specifies: repeated slashes, empty queries and dot segments are handled, and fragments are never sent to the server. (#1383)
• An empty write to a server stream does nothing. Before, it ended a chunked response body early. (#1391)
• HTTP/1 uploads no longer hang in trimmed executables on Julia 1.13. (#1390)
• Requests with a zero-length streaming body can be retried and redirected. (#1394)
• Loading HTTP no longer invalidates eltype(::AbstractArray). (#1395)

Merged pull requests:

• Keep HTTP/1 read deadlines within their request phase (#1382) (@​quinnj)
• Preserve redirect path and query components (#1383) (@​quinnj)
• Join repeated HTTP/1 Cookie lines with "; " (#1386) (@​youdie006)
• Keep failing response bodies out of byte-buffer response_stream sinks (#1387) (@​quinnj)
• Add allow_h2c option to turn off cleartext HTTP/2 on plain listeners (#1388) (@​quinnj)
• Stream fixed-length HTTP/1 responses after an explicit startwrite (#1389) (@​quinnj)
• Make empty writes to a server stream a no-op (#1391) (@​pfitzseb)
• Retain HTTP/1 upload tasks in trimmed executables (#1392) (@​quinnj)
• Reuse buffers for fixed-length HTTP/1 streams (#1393) (@​quinnj)
• Replay requests with empty streaming bodies (#1394) (@​quinnj)
• Remove redundant eltype method for Headers (#1395) (@​Beforerr)
• Fix Expect: 100-continue hang after startwrite; release 2.9.0 (#1396) (@​quinnj)

Closed issues:

• HTTP/1.1 server: read_header_timeout also times the request body, idle_timeout is overridden, and an idle keep-alive timeout writes an unsolicited 408 (#1381)
• HTTP/1.1 stream handlers buffer a fixed-length response body whole until closewrite, with no way to stream it (#1384)
• Option to disable cleartext HTTP/2 (h2c prior knowledge) on plain listeners (#1385)
• cannot trim any HTTP/1.1 request code (#1390)

Commits

• 52ba567 Fix Expect: 100-continue hang after startwrite; release 2.9.0 (#1396)
• b2ed4c5 Remove redundant eltype method for Headers (#1395)
• c27667f Stream fixed-length HTTP/1 responses after an explicit startwrite (#1389)
• 55686da Replay requests with empty streaming bodies (#1394)
• 216df83 Reuse fixed-length HTTP/1 stream buffers (#1393)
• d71ae8d Retain HTTP/1 upload tasks in trimmed executables
• 9cbeeb0 Make empty writes to a server stream a no-op (#1391)
• 9b55109 Add allow_h2c server option to turn off cleartext HTTP/2 (#1388)
• 11d61cf Keep HTTP/1 read deadlines within their request phase (#1382)
• 983a4d7 Preserve redirect path and query components (#1383)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #197.