Commit 4f5bb42
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
chore(deps): bump req from 0.5.18 to 0.6.1 (#103)
Bumps [req](https://github.com/wojtekmach/req) from 0.5.18 to 0.6.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/wojtekmach/req/releases">req's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.1</h2>
<ul>
<li>
<p><a
href="https://hexdocs.pm/req/Req.Steps.html#compressed/1"><code>compressed</code></a>,
<a
href="https://hexdocs.pm/req/Req.Steps.html#decompress_body/1"><code>decompress_body</code></a>:
Disable automatic decompression</p>
<p>Decompression is now opt-in by setting <code>compressed:
true</code>.</p>
</li>
</ul>
<h2>v0.6.0</h2>
<ul>
<li>
<p><a
href="https://hexdocs.pm/req/Req.Steps.html#encode_body/1"><code>encode_body</code></a>:
Security fix for <code>:form_multipart</code> header injection
(<a
href="https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m">GHSA-px9f-whj3-246m</a>).</p>
<p>The multipart encoder interpolated the per-part <code>name</code>,
<code>filename</code>, and
<code>content_type</code> into the part headers without escaping, so an
attacker-controlled value could inject extra headers or smuggle
additional
parts into the request. These values are now escaped per RFC 7578 /
WHATWG
form-data (<code>"</code>, CR, and LF are percent-encoded).</p>
<p>Thanks to <a
href="https://github.com/PJUllrich"><code>@PJUllrich</code></a> for
reporting it.</p>
</li>
<li>
<p><a
href="https://hexdocs.pm/req/Req.Steps.html#decode_body/1"><code>decode_body</code></a>:
Drop automatic zip/tar/tgz/gz/zst/csv decoding,
(<a
href="https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv">GHSA-655f-mp8p-96gv</a>).</p>
<p>Req previously auto-decoded archive and compressed response bodies
(<code>zip</code>,
<code>tar</code>, <code>tgz</code>, <code>gz</code>, <code>zst</code>,
and <code>csv</code>) based on the server-supplied
<code>content-type</code>, materialising the full decompressed contents
in memory with
no size cap. An attacker-controlled (or redirect-reachable) endpoint
could
return a tiny "decompression bomb" that expanded to gigabytes
and exhausted
the node's memory.</p>
<p>Now only JSON is decoded by default. Other formats are opt-in via the
new
<code>:decoders</code> option, which defaults to <code>[:json,
:json_api]</code>. Setting it
replaces the default (include <code>:json</code> to keep JSON decoding),
and <code>false</code>
disables all decoding:</p>
<pre><code># opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])
</code></pre>
<p><strong>Note</strong>: The decoded zip/tar is still list of
<code>{filename :: charlist(), contents :: binary}</code> tuples.
In the future release, this will be list of
<code>{filename :: binary(), contents :: binary()}</code> tuples.</p>
<p>While automatic CSV decoding wasn't a security issue, the behaviour
based
on presence/absence of <code>nimble_csv</code> dependency was suprising.
CSV support
is still built-in but need to be enabled with <code>decoders:
[:csv]</code>.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/wojtekmach/req/blob/main/CHANGELOG.md">req's
changelog</a>.</em></p>
<blockquote>
<h2>v0.6.1 (2026-06-08)</h2>
<ul>
<li>
<p>[<code>compressed</code>], [<code>decompress_body</code>]: Disable
automatic decompression</p>
<p>Decompression is now opt-in by setting <code>compressed:
true</code>.</p>
</li>
</ul>
<h2>v0.6.0 (2026-06-08)</h2>
<ul>
<li>
<p>[<code>encode_body</code>]: Security fix for
<code>:form_multipart</code> header injection
(<a
href="https://github.com/wojtekmach/req/security/advisories/GHSA-px9f-whj3-246m">GHSA-px9f-whj3-246m</a>).</p>
<p>The multipart encoder interpolated the per-part <code>name</code>,
<code>filename</code>, and
<code>content_type</code> into the part headers without escaping, so an
attacker-controlled value could inject extra headers or smuggle
additional
parts into the request. These values are now escaped per RFC 7578 /
WHATWG
form-data (<code>"</code>, CR, and LF are percent-encoded).</p>
<p>Thanks to <a
href="https://github.com/PJUllrich"><code>@PJUllrich</code></a> for
reporting it.</p>
</li>
<li>
<p>[<code>decode_body</code>]: Drop automatic zip/tar/tgz/gz/zst/csv
decoding,
(<a
href="https://github.com/wojtekmach/req/security/advisories/GHSA-655f-mp8p-96gv">GHSA-655f-mp8p-96gv</a>).</p>
<p>Req previously auto-decoded archive and compressed response bodies
(<code>zip</code>,
<code>tar</code>, <code>tgz</code>, <code>gz</code>, <code>zst</code>,
and <code>csv</code>) based on the server-supplied
<code>content-type</code>, materialising the full decompressed contents
in memory with
no size cap. An attacker-controlled (or redirect-reachable) endpoint
could
return a tiny "decompression bomb" that expanded to gigabytes
and exhausted
the node's memory.</p>
<p>Now only JSON is decoded by default. Other formats are opt-in via the
new
<code>:decoders</code> option, which defaults to <code>[:json,
:json_api]</code>. Setting it
replaces the default (include <code>:json</code> to keep JSON decoding),
and <code>false</code>
disables all decoding:</p>
<pre><code># opt into archives (only for endpoints you trust):
Req.get!(url, decoders: [:json, :zip])
</code></pre>
<p><strong>Note</strong>: The decoded zip/tar is still list of
<code>{filename :: charlist(), contents :: binary}</code> tuples.
In the future release, this will be list of
<code>{filename :: binary(), contents :: binary()}</code> tuples.</p>
<p>While automatic CSV decoding wasn't a security issue, the behaviour
based
on presence/absence of <code>nimble_csv</code> dependency was suprising.
CSV support
is still built-in but need to be enabled with <code>decoders:
[:csv]</code>.</p>
<p>Custom decoders are supported via <code>{format, codec}</code>
tuples, where <code>codec</code> is
a module exporting <code>decode/1</code> or a 1-arity function returning
an <code>:ok</code>/<code>:error</code>
tuple, for example:</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/wojtekmach/req/commit/36a82523e864739787340604f65ecce26699a0a9"><code>36a8252</code></a>
Release v0.6.1</li>
<li><a
href="https://github.com/wojtekmach/req/commit/ea5506fce1d6a44e5f47d0efed314643b3bc4904"><code>ea5506f</code></a>
<code>compressed</code>, <code>decompress_body</code>: Disable automatic
decompression</li>
<li><a
href="https://github.com/wojtekmach/req/commit/8e7425f790d669d6996347ad0a72ba57f51138a8"><code>8e7425f</code></a>
Release v0.6.0</li>
<li><a
href="https://github.com/wojtekmach/req/commit/584a490d37c80e1f0f13b6efcfa9db7817218043"><code>584a490</code></a>
<code>decode_body</code>: Drop automatic zip/tar/tgz/gz/zst/csv
decoding</li>
<li><a
href="https://github.com/wojtekmach/req/commit/2d77dbeb6b2a6932fe181432b1c36e9ea1d9fa23"><code>2d77dbe</code></a>
<code>encode_body</code>: Security fix for <code>:form_multipart</code>
header injection</li>
<li>See full diff in <a
href="https://github.com/wojtekmach/req/compare/v0.5.18...v0.6.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>1 parent 4d09a7a commit 4f5bb42
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
52 | 52 | | |
53 | 53 | | |
54 | 54 | | |
55 | | - | |
| 55 | + | |
56 | 56 | | |
57 | 57 | | |
58 | 58 | | |
| |||
0 commit comments