Conversation
Bumps [brotli](https://github.com/dropbox/rust-brotli) from 7.0.0 to 8.0.2. - [Release notes](https://github.com/dropbox/rust-brotli/releases) - [Commits](dropbox/rust-brotli@7.0.0...8.0.2) --- updated-dependencies: - dependency-name: brotli dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.52.2 to 1.52.3. - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.52.2...tokio-1.52.3) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.52.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.79 to 0.10.80. - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80) --- updated-dependencies: - dependency-name: openssl dependency-version: 0.10.80 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.10 to 0.15.13. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.10...0.15.13) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.15.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the github-actions group with 2 updates: [actions/create-github-app-token](https://github.com/actions/create-github-app-token) and [actions/cache](https://github.com/actions/cache). Updates `actions/create-github-app-token` from 1 to 3 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@v1...v3) Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…tions/dev/github-actions-9b60934982 chore(deps): bump the github-actions group with 2 updates
…uff-0.15.13 chore(deps-dev): bump ruff from 0.15.10 to 0.15.13
…/tokio-1.52.3 chore(deps): bump tokio from 1.52.2 to 1.52.3
…/openssl-0.10.80 chore(deps): bump openssl from 0.10.79 to 0.10.80
…/brotli-8.0.2 chore(deps): bump brotli from 7.0.0 to 8.0.2
build_request unconditionally added a Host header derived from the URI. For the low-level http1 dispatch paths (dispatch_raw, forward proxy) that's correct -- hyper's raw SendRequest does not auto-populate Host and HTTP/1.1 requires it. For the pooled high-level client, hyper already populates Host (HTTP/1.1) or :authority (HTTP/2) from the URI itself. Adding a Host on top means HTTP/2 requests go out with both :authority and host in the HPACK block, which some origin servers and WAFs reject as a protocol violation (RFC 9113 §8.3.1). Discovered via api.hackertarget.com, which returned 400 Bad Request to every blasthttp request while curl --http2 to the same host succeeded. HPACK decoding of blasthttp's HEADERS frame showed both :authority and host pointing at the same value. build_request now takes a manual_host_header flag. dispatch_request (pooled path) passes false; dispatch_raw and dispatch_forward_proxy (low-level http1 paths) pass true. Bump 0.6.1 -> 0.7.0.
…host-header drop duplicate Host header on pooled HTTP/2 path (bump 0.7.0)
ausmaster
approved these changes
May 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.7.0
Fix
Hostheader on pooled HTTP/2 path (drop duplicate Host header on pooled HTTP/2 path (bump 0.7.0) #32) —build_requestwas always adding aHostheader derived from the URI. For the pooled high-level client, hyper already populatesHost(HTTP/1.1) or:authority(HTTP/2) from the URI itself, so we were sending both:authorityandhostin the HPACK block. Some origin servers (e.g.api.hackertarget.com) reject this as a protocol violation per RFC 9113 §8.3.1. The manual Host insertion now only happens on the two low-level http1 paths (dispatch_direct, forward proxy) where it's actually required.Dependency updates
Version
0.6.1 → 0.7.0.