8.1.0 (2026-10-27)
Thanks to
@BillyLiou,
@Thomasdezeeuw,
@eyupcanakman,
@fubar-coder,
@ptwales,
@jgarte,
@brenordv,
@linkdd,
@jkellz-dev,
@josh-coderpad,
@qrn12580,
@1diot9,
@Hama1cco,
Enhancements:
- Add --no-header option to remove specific HTTP header #4884
- Add --fail-with-body option to output response body when there are errors #4776
- Add no jsonpath coercion option #5077
- Add --proxy-header option to send header exclusively to a proxy #3944
- Add --http2-prior-knowledge command line option to use HTTP/2 without HTTP/1.1 Upgrade #5126
- Re-export Input struct from hurl_core to hurl #5128
- Add Sublime Text syntax highlighting #5298
- Add --tls-max option #3713
- Skip suggestion fo very long keyword #5360
- Add --tls-min option to set the minimum allowed TLS version #5335
- Add Hurl config file #3629
Bugs Fixed:
- Fix misleading error message for not-equal predicate #2841
- Fix variable option values starting with a number or boolean #5028
- Fix recorded headers when connecting to proxy with CONNECT #5091
- Fix Hurl debug curl command when request binary body contains NUL char #5141
- Don't fail build on Windows if file icon is not reachable #5207
- Fix parsing exponent in JSONPath expr #5342
- Add explicit nesting limit to JSONPath expression parsing #5350
- Fix hurlfmt panic when importing curl commands without a URL #5354
- Fix crash when receiving non UTF-8 server cookie #5356
- Fix crash for bad
@cookie_storage_setcomment (experimental feature) #5348 - Parse finite float in JSONPath #5330
- Escape curl command from --curl option and --verbose log #5374
Security Issues Fixed:
- Fix CVE-2026-63481 stripping cookie from Cookies section when redirecting to a different host #5118
- Fix escaping headers values in HTML report #5228
- Fix symlinks escaping file root #5289
- Fix credentials leaking using --header and following redirection #5310
- Add explicit nesting limit to JSON Body parsing #5317
- Fix escaping capture name in HTML report #5346