Changelog (v5.4.53...v5.4.54)
- bug #66938 Don't add the
queryoption again to redirect targets inNoPrivateNetworkHttpClient(@nicolas-grekas) - bug #66270 Don't reject highly compressed responses (@nicolas-grekas)
- bug #66080 Add missing non-routable ranges to NoPrivateNetworkHttpClient (@nicolas-grekas)
- bug #65751 Reject decompression bombs (@nicolas-grekas)
- bug #65740 Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
- bug #65731 Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
- bug #65742 Reject 3xx pushed responses (@nicolas-grekas)
- bug #65704 Drop credentials when a redirect changes the scheme (@nicolas-grekas)
[SECURITY] Security release