[0.6.2] - 2026-09-17
Security
- Credentials (
Authorization,Cookie,Proxy-Authorization) and request bodies are no longer forwarded to a different origin when following redirects (GHSA-pgxm-hj3g-p7wv). Reported by @iam-niranjan. - Server-controlled values (URL,
Server,Location, certificate fields, error messages) are escaped before Rich rendering, so a server can no longer inject markup or crash the output (GHSA-pgxm-hj3g-p7wv). - Proxy credentials are redacted in terminal output and JSON export (#302).
Bug Fixes
- analyzer: Apply RFC 9110 rules when following redirects (f8bb8e1)
- utils: Redact proxy credentials in output and export (6c0df77)
Miscellaneous Tasks
- infra: Read ruff version from uv.lock in ruff-action (b2d1837)
New Contributors
- @Voyagerroc-Lab made their first contribution in #304