v0.26.0

What's Changed

• docs: add portable fetch skill by @ryanfowler in #857
• chore(deps): bump memchr from 2.8.1 to 2.8.3 by @dependabot[bot] in #858
• chore(deps): bump tokio-tungstenite from 0.29.0 to 0.30.0 by @dependabot[bot] in #859
• feat: add agent skill installation by @ryanfowler in #860
• feat: add article Markdown output by @ryanfowler in #861
• docs: document article mode in agent skill by @ryanfowler in #862
• docs: streamline documentation structure by @ryanfowler in #863
• fix: share connect timeout with DNS resolution by @ryanfowler in #864
• fix: persist sessions after response errors by @ryanfowler in #865
• fix: reject premature EOF in file request bodies by @ryanfowler in #871
• chore(deps): bump http-body-util from 0.1.3 to 0.1.4 by @dependabot[bot] in #866
• chore(deps): bump rustls from 0.23.41 to 0.23.42 by @dependabot[bot] in #870
• chore(deps): bump htmd from 0.5.1 to 0.5.4 by @dependabot[bot] in #869
• chore(deps): bump socket2 from 0.6.4 to 0.6.5 by @dependabot[bot] in #868
• chore(deps): bump http-body from 1.0.1 to 1.1.0 by @dependabot[bot] in #867

Full Changelog: v0.25.2...v0.26.0

v0.25.2

What's Changed

• chore: update Rust to 1.96.1 by @ryanfowler in #832
• refactor: simplify MIME rule table by @ryanfowler in #833
• refactor: remove custom main thread stack by @ryanfowler in #834
• fix: reject non-regular request body files by @ryanfowler in #835
• fix: preserve fragments in curl GET query parsing by @ryanfowler in #836
• fix: harden remote filename sanitization by @ryanfowler in #837
• fix: create update temp files exclusively by @ryanfowler in #838
• feat: thread DoH TLS config through transport and dialing stack by @ryanfowler in #839
• fix: harden integration tests against macOS port reuse races by @ryanfowler in #840
• fix: guard streaming stdout against binary chunks by @ryanfowler in #841
• docs: remove stale ECH scoping document by @ryanfowler in #842
• chore(deps): bump psl from 2.1.216 to 2.1.217 by @dependabot[bot] in #843
• test: avoid retrying digest auth replay server by @ryanfowler in #845
• chore(deps): bump bytes from 1.12.0 to 1.12.1 by @dependabot[bot] in #844
• chore(deps): bump psl from 2.1.217 to 2.1.218 by @dependabot[bot] in #846
• chore: upgrade Rust to 1.97.0 by @ryanfowler in #847
• fix: share DNS dialing with TLS inspection by @ryanfowler in #848
• chore(deps): bump prost-reflect from 0.16.4 to 0.16.5 by @dependabot[bot] in #849
• fix: preserve methods across 301 and 302 redirects by @ryanfowler in #850
• fix: cap Retry-After delays by @ryanfowler in #851
• fix: parse NDJSON streams linearly by @ryanfowler in #852
• fix: validate DNS answer names by @ryanfowler in #853
• fix: prevent HTTP/3 cache symlink traversal by @ryanfowler in #854
• fix: move HTTP/3 cache I/O off runtime workers by @ryanfowler in #855
• fix: strip Host on cross-origin redirects by @ryanfowler in #856

Full Changelog: v0.25.1...v0.25.2

v0.25.1

What's Changed

• fix: avoid libresolv FFI for HTTPS records by @ryanfowler in #831

Full Changelog: v0.25.0...v0.25.1

v0.25.0

What's Changed

• Bump prost-types from 0.14.3 to 0.14.4 by @dependabot[bot] in #747
• Include library unit tests in CI by @ryanfowler in #748
• Bump psl from 2.1.212 to 2.1.213 by @dependabot[bot] in #749
• Handle split UTF-8 in SSE stream formatting by @ryanfowler in #750
• Propagate multipart Content-Length errors by @ryanfowler in #751
• Support URL credentials in WebSocket handshakes by @ryanfowler in #752
• Reuse multipart file metadata across previews, streaming, and length checks by @ryanfowler in #753
• Handle curl JSON defaults and cap update metadata by @ryanfowler in #755
• Refactor image decoding and rendering modules by @ryanfowler in #756
• Fix piped formatting examples in docs by @ryanfowler in #757
• Fix from-curl JSON example quoting by @ryanfowler in #758
• Clarify configuration merge order by @ryanfowler in #759
• Clarify fetch exit codes in troubleshooting docs by @ryanfowler in #760
• Return 130 on interrupted requests by @ryanfowler in #761
• Clarify --discard body handling docs and help text by @ryanfowler in #762
• Document decoded output-file downloads by @ryanfowler in #763
• Default schemeless IP URLs to HTTP by @ryanfowler in #764
• Use shlex to parse PAGER values by @ryanfowler in #765
• Bump h2 from 0.4.14 to 0.4.15 by @dependabot[bot] in #768
• Bump brotli from 8.0.3 to 8.0.4 by @dependabot[bot] in #767
• Bump time from 0.3.47 to 0.3.49 by @dependabot[bot] in #766
• [codex] fix image rendering edge cases by @ryanfowler in #769
• Fix from-curl proto schemeless URL handling by @ryanfowler in #770
• Add update documentation for manual and automatic updates by @ryanfowler in #771
• Clarify configuration precedence and list merging by @ryanfowler in #772
• Reject duplicate host config sections during parsing by @ryanfowler in #773
• Document pager environment variables in the CLI reference by @ryanfowler in #774
• Warn on ignored request flags during inspect modes by @ryanfowler in #775
• Add plaintext URL hints for schemeless HTTPS failures by @ryanfowler in #776
• Add HTTP version aliases and clearer protocol errors by @ryanfowler in #777
• Bump webpki-roots from 1.0.7 to 1.0.8 by @dependabot[bot] in #778
• Use rustls platform verifier for WebSocket TLS by @ryanfowler in #779
• Remove stale core type definitions by @ryanfowler in #780
• Centralize ignored inspection flag handling by @ryanfowler in #781
• Box async dispatch futures in request and inspection paths by @ryanfowler in #782
• Unify happy eyeballs connection racing by @ryanfowler in #783
• Add automatic HTTP/3 discovery and racing by @ryanfowler in #784
• Skip auto-H3 target DNS while normal lookup runs by @ryanfowler in #785
• Bump bytes from 1.11.1 to 1.12.0 by @dependabot[bot] in #786
• Preserve connect budget across happy-eyeballs races by @ryanfowler in #787
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #788
• Persist learned HTTP/3 alternatives in cache by @ryanfowler in #789
• Consolidate response streaming copy helpers by @ryanfowler in #790
• Refactor DNS and TLS inspection into focused modules by @ryanfowler in #791
• Refactor terminal size plumbing for image rendering by @ryanfowler in #792
• Handle MessagePack binary map key strings by @ryanfowler in #793
• Bump quinn from 0.11.9 to 0.11.11 by @dependabot[bot] in #794
• Bump time from 0.3.49 to 0.3.51 by @dependabot[bot] in #795
• Split HTTP transport into focused modules by @ryanfowler in #796
• Refactor staggered connect races into a shared helper by @ryanfowler in #797
• Refactor flag conflict validation for curl and WebSocket paths by @ryanfowler in #798
• Refactor home-path expansion into fileutil by @ryanfowler in #799
• Refactor proto support into focused submodules by @ryanfowler in #800
• Fix gRPC JSON-to-protobuf conversion to use direct serde deserialization by @ryanfowler in #801
• Refactor config option descriptors in config parsing by @ryanfowler in #802
• Refactor gRPC descriptor formatting to stream printers by @ryanfowler in #805
• Bump rustls from 0.23.40 to 0.23.41 by @dependabot[bot] in #803
• Bump psl from 2.1.213 to 2.1.214 by @dependabot[bot] in #804
• Fix image option help spacing by @ryanfowler in #806
• Document proxy environment precedence and lowercase variables by @ryanfowler in #807
• Bump psl from 2.1.214 to 2.1.215 by @dependabot[bot] in #808
• Bump anyhow from 1.0.102 to 1.0.103 by @dependabot[bot] in #809
• Sanitize self-update networking from request TLS overrides by @ryanfowler in #810
• Bump quick-xml from 0.40.1 to 0.41.0 by @dependabot[bot] in #812
• Add DNS over TCP, TLS, and QUIC support by @ryanfowler in #813
• Verify self-update artifact checksum before extraction by @ryanfowler in #814
• Add ECH (Encrypted Client Hello) support by @ryanfowler in #815
• centralize color_for_status in core.rs by @ryanfowler in #816
• Compact agent guidance by @ryanfowler in #818
• dedupe: remove three private copies of flush_stderr by @ryanfowler in #817
• dedupe: replace 5 duplicated flag-check functions with unified registry by @ryanfowler in #819
• refactor: replace config option macros by @ryanfowler in #820
• fix: include config file path in missing config error by @ryanfowler in #821
• fix: treat --timeout 0 and --connect-timeout 0 as no timeout (curl-compatible) by @ryanfowler in #822
• fix: make --connect-timeout/--retry-delay error messages consistent with clap style by @ryanfowler in #823
• fix: simplify binary response warning message by @ryanfowler in #824
• feat: add verbose help menu by @ryanfowler in #825
• fix: include --http in --inspect-tls ignored flag warning by @ryanfowler in #826
• fix: show proper conflict error between --output and --remote-name by @ryanfowler in #827
• test: speed up integration tests with channel notification and parallel execution by @ryanfowler in #828
• Bump rand from 0.10.1 to 0.10.2 by @dependabot[bot] in #830
• Bump psl from 2.1.215 to 2.1.216 by @dependabot[bot] in #829

Full Changelog: v0.24.12...v0.25.0

v0.24.12

What's Changed

• Harden install.sh checksum verification and completion handling by @ryanfowler in #730
• Add SECURITY.md for vulnerability reporting by @ryanfowler in #731
• Bump http from 1.4.1 to 1.4.2 by @dependabot[bot] in #733
• Bump prost from 0.14.3 to 0.14.4 by @dependabot[bot] in #732
• Infer POST for body flags when --method is omitted by @ryanfowler in #734
• Clarify forced HTTP version behavior in docs by @ryanfowler in #735
• Reject non-GET WebSocket methods by @ryanfowler in #736
• Document the output model and clarify binary warnings by @ryanfowler in #737
• Clarify HTTP 4xx/5xx exit behavior in docs and help text by @ryanfowler in #738
• Limit compressed SSE auto-retries to safe methods by @ryanfowler in #739
• Warn when -J falls back from Content-Disposition by @ryanfowler in #740
• Respect PAGER, LESS, and NO_PAGER for response paging by @ryanfowler in #741
• Clarify Windows config file search order by @ryanfowler in #742
• Correct silent mode docs to say only errors are shown by @ryanfowler in #743
• Streamline AGENTS.md test guidance by @ryanfowler in #744
• Fix WebSocket spacing and Ctrl-C shutdown behavior by @ryanfowler in #745
• Color descriptor-backed gRPC JSON output by @ryanfowler in #746

Full Changelog: v0.24.11...v0.24.12

v0.24.11

What's Changed

• Simplify URL parsing detection in metadata by @ryanfowler in #719
• Expand the README with key feature examples by @ryanfowler in #720
• Refresh fetch tagline and project description by @ryanfowler in #721
• Centralize config option handling in config parsing by @ryanfowler in #722
• Use typed Clap error context for parse diagnostics by @ryanfowler in #723
• Refactor shared file lock handling by @ryanfowler in #724
• Refactor HTTP response handling into focused modules by @ryanfowler in #725
• Deduplicate output install pipeline by @ryanfowler in #726
• Refactor update logic into modular files by @ryanfowler in #727
• Centralize stderr status rendering through core::Printer by @ryanfowler in #729
• Split integration test support into domain modules by @ryanfowler in #728

Full Changelog: v0.24.10...v0.24.11

v0.24.10

What's Changed

• Limit WebSocket and gRPC request bodies by @ryanfowler in #711
• Protect self-update redirects from HTTP downgrade by @ryanfowler in #712
• Preserve explicit config in background auto-update by @ryanfowler in #713
• Harden Windows archive path extraction by @ryanfowler in #714
• Fix WebSocket header handling and tighten update archive checks by @ryanfowler in #715
• Stop tar.gz update downloads after unpack failure by @ryanfowler in #716
• Bound dry-run request body previews by @ryanfowler in #717
• Reserve capacity for split gRPC frames by @ryanfowler in #718

Full Changelog: v0.24.9...v0.24.10

v0.24.9

What's Changed

• Ignore untracked files in buildinfo VCS status by @ryanfowler in #691
• Pin Cargo dependencies to exact latest versions by @ryanfowler in #692
• Bound self-update archive extraction by @ryanfowler in #693
• Protect concurrent session cookie saves by @ryanfowler in #694
• Handle broken pipes cleanly on stdout writes by @ryanfowler in #695
• Bound clipboard clipboard backend waits to avoid hangs by @ryanfowler in #696
• Add session cookie support to WebSocket handshakes by @ryanfowler in #697
• Cap gRPC reflection response buffering by @ryanfowler in #698
• Bound WebSocket text stdin lines and document binary fallback by @ryanfowler in #699
• Abort HTTP/3 upload tasks on drop by @ryanfowler in #700
• Bound session and update lock waits by @ryanfowler in #701
• Fix proxy-aware DNS pre-resolution for env proxies by @ryanfowler in #703
• Support port-qualified NO_PROXY entries by @ryanfowler in #704
• Reject TLS key-only config from merged sources by @ryanfowler in #705
• Harden self-update extraction temp handling by @ryanfowler in #706
• Bound SSE formatted stream buffer growth by @ryanfowler in #707
• Stream self-update artifact downloads during update by @ryanfowler in #708
• Stream single-file from-curl bodies by @ryanfowler in #709
• Add explicit WebSocket receive caps by @ryanfowler in #710

Full Changelog: v0.24.8...v0.24.9

v0.24.8

What's Changed

• Support RFC 8484 DoH first and keep JSON fallback by @ryanfowler in #681
• Fix response body timeout diagnostics by @ryanfowler in #682
• Allow cli key with config cert by @ryanfowler in #683
• Apply AWS SigV4 signing to gRPC reflection by @ryanfowler in #684
• Remove dead redirect compatibility code by @ryanfowler in #685
• Share DNS timeout budgets across DoH and UDP fallback by @ryanfowler in #686
• Preserve DNS resolver order in diagnostics and HTTP/3 by @ryanfowler in #687
• Defer WebSocket dry-run body materialization by @ryanfowler in #688
• Fix gRPC dry-run stdin reuse by @ryanfowler in #689
• Separate HTTPS proxy TLS from origin TLS by @ryanfowler in #690

Full Changelog: v0.24.7...v0.24.8

v0.24.7

What's Changed

• Use a custom HTTP client by @ryanfowler in #675
• Preserve duplicate request headers in HTTP metadata by @ryanfowler in #676
• Limit DoH response buffering to 1 MiB by @ryanfowler in #677
• Add WebSocket binary frame support by @ryanfowler in #678
• Remove dead transport helpers and route DoH through the main client by @ryanfowler in #679
• Classify WebSocket runtime failures correctly by @ryanfowler in #680

Full Changelog: v0.24.6...v0.24.7