fix(deps): update module github.com/imroc/req to v3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/imroc/req	v0.3.2 -> v3.43.4

GitHub Vulnerability Alerts

CVE-2024-45258

The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in applications relying on this library for handling HTTP requests.

Despite developers potentially utilizing the net/url library to parse malformed URLs and implement blocklists to prevent HTTP requests to listed URLs, inconsistencies exist between how the net/url and req libraries parse URLs. These discrepancies can lead to the failure of defensive strategies, resulting in potential security threats such as Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE).

---

Release Notes

imroc/req (github.com/imroc/req)

v3.43.4: Release

Compare Source

• prevent successful requests from invalid host

v3.43.3: Release

Compare Source

• Allow logger creation from an existing standard logger (#​345 )

v3.43.2: Release

Compare Source

• fix: Cancel retry if the request failed due to a canceled context (#​339)
• allow RetryCondition and RetryHook wrap the original error (#​340)
• fix: use correct context for dial (#​341)

v3.43.1: Release

Compare Source

• fix DisableForceMultipart (#​333)

v3.43.0: Release

Compare Source

• upgrade go modules
• merge upstream quic-go
• merge upstream net/http
• merge upstream x/net/http2

v3.42.3: Release

Compare Source

• update go modules, support quic-go v0.40.1

v3.42.2: Release

Compare Source

• Fix retry in SetFileBytes (#​300)

v3.42.1: Release

Compare Source

• fix SetTLSFingerprintXXX does not take effect in subsequent requests(#​290)

v3.42.0: Release

Compare Source

• feat: Add OnError to Client (Support the error hook, which will be executed if any error will be returned, e.g. dns lookup error, invalid URL and etc)

v3.41.12: Release

Compare Source

• Fix RootCAs setting when using utls (#​280)

v3.41.11: Release

Compare Source

• Update dependencies

v3.41.10: Release

Compare Source

• Fix FLOW_CONTROL_ERROR in ImpersonateXXX (#​275)

v3.41.9: Release

Compare Source

• Fix COMPRESSION_ERROR in ImpersonateXXX (#​275)

v3.41.8: Release

Compare Source

• Do not try charset conversion if Accept-Encoding specified
• Fix http3 in go1.21(#​274)

v3.41.7: Release

Compare Source

• Support http digest calculation that does not follow the RFC specification (#​269)

v3.41.6: Release

Compare Source

• Allow splitting digest parameters without spaces (#​269).
• Clear common cookies in ClearCookies.

v3.41.5: Release

Compare Source

• Default qop to "auth" in HTTPDigestAuth(#​269)

v3.41.4: Release

Compare Source

• Fix InsecureSkipVerify (#​268)
• Upgrade utls to v1.4.3

v3.41.3: Release

Compare Source

• Fix transport middleware cannot access common header and cookies

v3.41.2: Release

Compare Source

• Fix SetCommonContentType is not respected when SetBody is called (#​265)

v3.41.1: Release

Compare Source

• Update dependencies to fix #​263

v3.41.0: Release

Compare Source

• Update dependencies.
• Support go1.21.
• Add SetCookeJarFactory.
• Use memoryCookieJarFactory to create cookie jar by default when create Client.

v3.40.1: Release

Compare Source

• Support ImpersonateSafari.
• Improve code with generics.
• Improve Client.Clone.

v3.40.0: Release

Compare Source

• Supported HTTP Fingerprint Impersonation to Bypass Anti-Crawler Detection Effortlessly
• Some code refactor and optimization.
• Execute retry condition and retry hook in reverse order to reduce unnecessary execution.

v3.39.0: Release

Compare Source

HTTP fingerprinting: Support to control the order of header (see docs).

• Add SetHeaderOrder and SetPseudoHeaderOrder for Request and Transport.
• Add SetCommonHeaderOrder and SetCommonPseudoHeaderOrder for Client.

v3.38.0: Release

Compare Source

• Support quic-go v0.37.0 and drop go1.19

v3.37.2: Release

Compare Source

• Make sure beforeRequests executed before client middleware(fix #​248)

v3.37.1: Release

Compare Source

• Ensure err in client.roundTrip (#​246 )

v3.37.0: Release

Compare Source

• Support HTTP Digest Authentication: https://req.cool/docs/tutorial/authentication/#set-digest-auth
• Add global wrappers.
• Reset file reader when retry a multipart file upload.
• Add nil check to SetSuccessResult and SetErrorResult.
• Allow PATCH multipart request.
• Fix transport middleware not work after clone(#​233).
• Fix client middleware not work after clone.

v3.36.2: Release

Compare Source

• Support quic-go v0.35.1.
• Do not detect alt-svc if it's already http3.

v3.36.1: Release

Compare Source

• Let TLS fingerprinting works even a proxy is set.
• Add SetTLSFingerprintRandomized.
• Merge upstream from latest net/http and http2.

v3.36.0: Release

Compare Source

Integrate utls to support tls fingerprinting resistance: https://req.cool/docs/tutorial/tls-fingerprinting/

v3.35.2: Release

Compare Source

Fix: cookies to be added multiple times in retrying (#​242 @​RonaldinhoL )

v3.35.1: Release

Compare Source

• Support quic-go v0.35.0 (#​241 )

v3.35.0: Release

Compare Source

• Add GetCookies for Client.

v3.34.0: Release

Compare Source

• Support latest quic-go version, requires go1.19

v3.33.3

Compare Source

v3.33.2: Release

Compare Source

• Fix http3 upgrade: use host and port from alt-svc header

v3.33.1: Release

Compare Source

• Only auto-read response if code > 199

v3.33.0: Release

Compare Source

• Expose more http2 settings to client and transport

v3.32.3: Release

Compare Source

• Ensure response middleware executed when internal middleware returns error

v3.32.2: Release

Compare Source

Fix: avoid resp.Err been overridden

v3.32.1: Release

Compare Source

• Fix: do not retry when RetryCount eq 0
• Fix: negative resp.TotalTime() (#​214)

v3.32.0: Release

Compare Source

• Refactor http3 implementation, remove embedded quic-go.
• Add go1.20 to ci.
• Remove deprecated ioutil functions.

v3.31.2: Release

Compare Source

• Move github.com/marten-seemann/qpack to github.com/quic-go/qpack

v3.31.1: Release

Compare Source

• Avoid err been override when response middleware is set.
• Support infinity retry.
• Support slice and array in SetBody.

v3.31.0: Release

Compare Source

Refactor API style:

• For Client:

  • Deprecate SetCommonError, add SetCommonErrorResult
  • Add SetResultStateCheckFunc

• For Request:
  * Deprecate SetResult, add SetSuccessResult
  * Deprecate SetError, add SetErrorResult

• For Response:
  * Deprecate IsSuccess, add IsSuccessState
  * Deprecate IsError, add IsErrorState
  * Deprecate Result, add SuccessResult
  * Deprecate Error, add ErrorResult
  * Add ResultState

v3.30.0: Release

Compare Source

• embed quic-go and support go1.20

v3.29.0: Release

Compare Source

• Ensure response middleware executed when error occurs

v3.28.1

Compare Source

v3.28.0: Release

Compare Source

• Support SetResponseBodyTransformer.

v3.27.0: Release

Compare Source

• Update go modules.
• Merge upstream goalng/x/net/http2 commits.
• Unexpose unnecessary NetConnWrapper interface.
• Improve comments for Transport settings.

v3.26.7: Release

Compare Source

• Fix missing TraceInfo when download callback is set(#​200)

v3.26.6: Release

Compare Source

• Fix data race in http2 dump(#​181)
• Add comments to explain the Request.URL field (#​197)

v3.26.5: Release

Compare Source

• Execute user defined middleware at first(#​190)

v3.26.4: Release

Compare Source

• Support DisableAutoReadResponse at request level (@​hoslo #​188)
• Update go mod: require go1.16

v3.26.3: Release

Compare Source

• SetDialTLS should override dial func in EnableH2C.

v3.26.2: Release

Compare Source

• Fix Transport.SetDialTLS not work in http2

v3.26.1: Release

Compare Source

• Support EnableCloseConnection (#​183)

v3.26.0: Release

Compare Source

• Support customize Content-Type when uploading multipart.

v3.25.0: Release

Compare Source

• Support flexible dump.

v3.24.1: Release

Compare Source

• Still return body when Response.ToBytes() got an error.

v3.24.0: Release

Compare Source

• Support Parallel Download.

v3.23.0: Release

Compare Source

• Support AddQueryParams (#​164)
• Record original request in http3 (#​165)

v3.22.1: Release

Compare Source

• Optimize debug log level when cannot determine the unmarshal function

v3.22.0: Release

Compare Source

• Support change the client of request dynamically (examples: Automatically Change IP When Request Fails)

v3.21.1: Release

Compare Source

• Add EnableForceMultipart/DisableForceMultipart for Request.

v3.21.0: Release

Compare Source

• Not use chunked encoding by default when uploading (#​160)
• Support EnableForceChunkedEncoding and DisableForceChunkedEncoding on Request.

v3.20.1: Release

Compare Source

• Fix data race (#​159)

v3.20.0: Release

Compare Source

• Support h2c.

v3.19.2: Release

Compare Source

• Fix concurrent map in Client.Clone() when high concurrency (#​157).
• Fix no Host in URL when SetScheme invoked.

v3.19.1: Release

Compare Source

• Support http3 in go1.19

v3.19.0: Release

Compare Source

• Add ClearCookies for Client.
• Fix autodecode when html page is small.

v3.18.0: Release

Compare Source

• Add EnableDumpEachRequestXXX methods (syntax sugar) for Client.

v3.17.7: Release

Compare Source

• Enable allow GET with body by default, discard body if disabled(#​153)

v3.17.6: Release

Compare Source

• Restore Response.Body when AutoReadResponse is enabled(#​152).

v3.17.5: Release

Compare Source

• Update example.
• Unexpose Client's RoundTrip.

v3.17.4: Release

Compare Source

• Use http.ErrUseLastResponse to prevent return error in NoRedirectPolicy.

v3.17.3: Release

Compare Source

• Add HeaderToString() for req and resp.
• Make sure the resp.Err set in the ResponseMiddleware is propagated to the caller.
• Update examples.

v3.17.2: Release

Compare Source

• Request.Do() accepts 0 or 1 context.
• Support 0 or 1 url in Client's Get, Post and etc.
• Support Request.SetQueryParamsAnyType.

v3.17.1: Release

Compare Source

• Support SetFormDataAnyType(#​148)

v3.17.0: Release

Compare Source

• Support middleware in Client(#​138).
• Expose Body and GetBody in Request.

v3.16.0: Release

Compare Source

• Support pointer of pointer in resp.Unmarshal and resp.Into
• Support middleware in Transport(#​138)

v3.15.0: Release

Compare Source

• Support nil pointer and pointer of pointer in SetResult and SetError(#​139)
• Support Do API style(#​137)
• SetBody support basic types

v3.14.4: Release

Compare Source

• Support response middleware executed even error is not nil (#​140)

v3.14.3: Release

Compare Source

• Merge commit from upstream net/http and quic-go.
• Support go1.19.

v3.14.2: Release

Compare Source

• Ignore empty proxy url in SetProxyURL (#​145)

v3.14.1: Release

Compare Source

Ajust log level to debug when cannot determine the unmarshal function(#​133)

v3.14.0: Release

Compare Source

• Support HTTP3.
• Support chainable methods for Transport.
• Expose Client.GetTransport().
• Cancel set header in DevMode (#​134).
• Add Client.GetLogger() to expose internal logger (#​132).
• Refactor the code structure to make it easier to extend.

v3.13.2: Release

Compare Source

• Fix potential nil pointer issue when retrying with request (@​88250 #​131 )

v3.13.1: Release

Compare Source

• Run user-defined request middleware after internal middleware. Make it possible to read generated info in request middleware, e.g. record req.URL.Path in request middleware.
• Fix typos and update readme.

v3.13.0: Release

Compare Source

• Wrap more methods for Response.
• Fix typo.

v3.12.0: Release

Compare Source

• Optimize SetError and SetResult.
• Client support SetCommonError.

v3.11.5: Release

Compare Source

• Improve response unmarshal.

v3.11.4: Release

Compare Source

• Expose method of Request

v3.11.3: Release

Compare Source

• Improve debug log: show http version of requests.
• Let EnableForceHTTP1 also take effect when called when there is already an http2 connection.

v3.11.2: Release

Compare Source

• Avoid panic when invoke Response if error happened.

v3.11.1: Release

Compare Source

• Merge commits from upstream(net/http and x/net/http2)

v3.11.0: Release

Compare Source

• Support SetHeaderNonCanonical and SetHeadersNonCanonical (#​112).
• Support SetCommonHeaderNonCanonical and SetCommonHeadersNonCanonical.

v3.10.1: Release

Compare Source

• Default unmarshal to json if Content-Type is not sure(#​107)
• Avoid concurrent map iteration and map write(#​111)

v3.10.0: Release

Compare Source

• Support UploadCallback (#​104)
• Support DownloadCallback

v3.9.6: Release

Compare Source

• Support AlwaysCopyHeaderRedirectPolicy (#​103)

v3.9.5: Release

Compare Source

• support js && wasm

v3.9.4: Release

Compare Source

• update go.mod: require go1.15

v3.9.3: Release

Compare Source

• Refactor a lot of tests.
• Reuse dump.Output if missing in Client.SetCommonDumpOptions.
• SetFile support retry.

v3.9.2: Release

Compare Source

• Support update request in retry hook (#​98)
• Refactor tests.

v3.9.1: Release

Compare Source

• Fix miss executing ResponseMiddlewares (#​97)

v3.9.0: Release

Compare Source

• Support retry (see retry doc).
• Support unix socket (see unix socket doc).

v3.8.2: Release

Compare Source

• Fix typo (#​95).
• Set ContentLength and guess ContentType if body is in-memory []byte.
• Use variadic parameter in SetFileUpload.
• Improve doc: Quick API Reference.

v3.8.1: Release

Compare Source

• Try sniff and auto-decode when Content-Type is malformed.

v3.8.0: Release

Compare Source

• Expose http.Client, so req can work with gock or httpmock (#​93)

v3.7.7

Compare Source

v3.7.6

Compare Source

v3.7.5

Compare Source

v3.7.4

Compare Source

v3.7.3

Compare Source

v3.7.2

Compare Source

v3.7.1

Compare Source

v3.7.0

Compare Source

v3.6.4

Compare Source

v3.6.3

Compare Source

v3.6.2

Compare Source

v3.6.1

Compare Source

v3.6.0

Compare Source

v3.5.4

Compare Source

v3.5.3

Compare Source

v3.5.2

Compare Source

v3.5.1

Compare Source

v3.5.0

Compare Source

v3.4.1

Compare Source

v3.4.0

Compare Source

v3.3.1

Compare Source

v3.3.0

Compare Source

v3.2.3

Compare Source

v3.2.2

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

v3.1.0

Compare Source

v3.0.1

Compare Source

v3.0.0

Compare Source

v2.1.0

Compare Source

v2.0.6

Compare Source

v2.0.5

Compare Source

v2.0.4

Compare Source

v2.0.3

Compare Source

v2.0.2

Compare Source

v2.0.1

Compare Source

v2.0.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.