Changelog (v7.4.17...v7.4.18)
- bug #65751 Reject decompression bombs (@nicolas-grekas)
- bug #65740 Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
- bug #65731 Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
- bug #65742 Reject 3xx pushed responses (@nicolas-grekas)
- bug #65704 Drop credentials when a redirect changes the scheme (@nicolas-grekas)