chore(deps): bump rawhttp to fix duplicate HTTP status line parsing

[lopster568]

Proposed changes

Bumps github.com/projectdiscovery/rawhttp from v0.1.90 to v0.1.91-0.20260616205543-c41b464d9bad to pull in the fix for parsing responses with duplicate HTTP status lines.

Fixes #7363

Targets that emit a malformed response with a repeated status line before the headers (e.g. a Grandstream HT801 responding with HTTP/1.0 200 OK twice) fail with a header parse error even under unsafe: true, so matchers never run and the response body is unreachable. As discussed in #7363, the root cause is in rawhttp: its header reader rejects any line without a colon, and a repeated status line has none. The fix was merged upstream in projectdiscovery/rawhttp#542 (commit c41b464), which skips leading duplicate status lines in ReadResponse before header parsing, bounded at 8 lines, with regression tests (TestReadResponseDuplicateStatusLines, TestReadResponseTripleStatusLines).

No new rawhttp tag has been cut past v0.1.90 yet, so this pins the pseudo-version at the fix merge commit, which is also the current rawhttp main HEAD (the only commits between v0.1.90 and main are the fix PR itself). Same shape as #7464, the govaluate bump pinned to an untagged upstream fix commit.

Proof

Standalone repro calling rawhttp's client.ReadResponse on the response bytes from the issue ("HTTP/1.0 200 OK\r\nHTTP/1.0 200 OK\r\nContent-Type: text/html\r\nContent-Length: 5\r\n\r\nhello"):

Before, pinned at v0.1.90:

ERROR: invalid header line: "HTTP/1.0 200 OK\r\n"

After, pinned at v0.1.91-0.20260616205543-c41b464d9bad:

OK status=200 headers=2 body="hello"

Also verified end to end with a local nuclei build at this commit against a mock server replaying the device's response under an unsafe: true raw template: the response now parses (-debug shows the 200, headers, and body) and a word matcher on the body fires.

Local checks on the changed module graph:

• go build ./cmd/nuclei passes
• go vet ./pkg/protocols/http/... ./pkg/protocols/common/protocolstate/... (the packages importing rawhttp) passes
• go test ./pkg/protocols/http/... passes with the bump
• go mod tidy produced no changes beyond the bump

Note: TestExecuteParallelHTTP_GoroutineLeaks is flaky under load on my machine on a clean dev checkout as well (fastdialer closeAfterTimeout goroutine caught by the leak detector), unrelated to this change.

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works (regression tests live upstream in rawhttp#542)
• I have added necessary documentation (if appropriate)

Summary by CodeRabbit

• Chores
  • Updated an internal networking dependency to a newer development version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cada0d5c-da15-4dd7-a9f0-b2842e1b4de7

📥 Commits

Reviewing files that changed from the base of the PR and between 1709267 and 6a8e337.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

Walkthrough

Updates the github.com/projectdiscovery/rawhttp Go dependency to a newer pseudo-version.

Changes

Raw HTTP dependency update

Layer / File(s)	Summary
Update rawhttp requirement go.mod	Updates github.com/projectdiscovery/rawhttp from v0.1.90 to v0.1.91-0.20260616205543-c41b464d9bad.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: mzack9999, dwisiswant0

Poem

A rabbit hops through module rows,
And finds a newer rawhttp rose.
One version changed, the burrow gleams,
Fresh code now flows through Go routines.
“Hop-hop!” says Bun, and checks it twice.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency bump and the parsing fix it introduces.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

go.mod

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dwisiswant0]

No need to bump PD deps manually, especially since it's still untagged.

We just tagged the new version (v0.1.91), so just let dependabot pick it up and open the PR when it's ready. No rush.

Closing this.