v1.1.3
stableHardens HTTP connections, refuses tokens over plain HTTP by default, and adds a request timeout.
Security
auth_tokenis refused over plain HTTP unlessinsecure=trueis also set.- Redirects from HTTPS to HTTP are rejected, so a connection can no longer be downgraded to plain HTTP.
- Error responses from the server are bounded in size and sanitized before they are reported.
New
- The
timeoutoption limits how long each request may take. It accepts a duration such as30sor10m, and defaults to 5 minutes.
Fixes
- Cancelling an operation now stops its pending HTTP requests.