Bump aiohttp from 3.13.5 to 3.14.1#5
Open
dependabot[bot] wants to merge 62 commits into
Open
Conversation
Updated README to include links and improved description.
Updated project name and license information in README.
A target repo's .env containing keys openhack doesn't define (e.g. gemini_sandbox_proxy_command) crashed the CLI at startup, because pydantic-settings defaults to extra=forbid and validates every key in a CWD .env file. Set extra=ignore so unrelated keys are skipped, matching how unknown os.environ vars were already handled.
Full visual redesign of the terminal UI — Signal Green accent, Deep Ink palette, half-block ground/earth mark logo, clean "OpenHack" wordmark lockup, right sidebar (session/context/findings/activity), knight-rider spinner, truecolor rendering. Removes all third-party UI references. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Pivot foundation from one-shot SAST scanner toward the interactive "Swiss-army knife for hackers". Adds the engine the TUI will drive: - tools/shell.py: run_command/which — foundational pentest primitive (drive nmap/curl/nuclei/osv-scanner/etc.) with timeout + output caps - tools/security_tools.py: sca_scan (osv-scanner / OSV database) and secret_scan (high-signal credential candidates, redacted); graceful degradation when engines are absent - tools/mailbox.py: mailbox_new/wait/list wrapping the `inbox` CLI for email-gated flows (signup/OTP/reset) during pentests - tools/registry.py: opt-in include_agent_tools flag (scan pipeline untouched by default) - agents/interactive.py: InteractiveAgent — plan-first, static-tools- first, asks-questions, no-moralizing operator over the full toolkit - interactive_runner.py + `openhack hack`/`openhack agent`: SSH-friendly non-TUI mode; streams thinking/tool activity, prints cost - tests/test_agent_tools.py: 29 tests (shell, SCA/secret, mailbox degradation, registry wiring, agent prompt/toolkit) Verified live: `openhack hack` triaged a planted target — secret_scan then sca_scan (found lodash 4.17.11 CVEs via OSV), confirmed via read_file, reported with file:line + impact. 110/110 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Plan mode scopes a target with passive intel only (read code, sca_scan, secret_scan, which) and proposes a prioritized attack plan — executing nothing until the operator approves. PlanAgent subclasses InteractiveAgent but restricts get_tools() to a read-only allowlist (no run_command, no mailbox). Adds build_plan_agent, run_plan, and the `openhack plan` CLI. Tests assert the toolset is read-only and the prompt is planning-shaped. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Live validation of `openhack plan` exposed two issues: the agent repeated the same passive-recon batch several times and then ended on a tool-only turn, leaving an empty final plan. Fixes: - interactive_runner: stash the last substantive 'thinking' text and fall back to it when the agent's final response is empty, so the operator never gets a blank screen; show an explicit note if truly nothing. - plan prompt: instruct a single focused intel sweep (run each scanner once, don't repeat tools already run), then stop calling tools and write the plan as the final message. Read-only restriction confirmed live (only passive tools were used). Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
The agent's final answer streams live as it's generated and was then printed a second time by the result renderer. Suppress the reprint when the final response matches what was already streamed; still recover the last message when the final response is empty. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
tools/recon.py: subdomains (subfinder), http_probe (httpx/curl fallback), port_scan (nmap), dns_lookup (dig), nuclei_scan (templated) — structured wrappers with graceful "tool not installed" handling. tools/oob.py: oob_register/oob_poll wrapping openhack-oob for blind-vuln verification (SSRF/RCE/XXE callbacks) via a unique marker. Registered as agent tools; passive recon (subdomains/dns_lookup) added to plan mode's read-only allowlist, active scans kept out. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
tools/browser.py: browser_fetch drives headless Chromium (Playwright) to dynamically verify web vulns — rendered DOM, final URL, JS dialogs (e.g. alert() from an XSS payload), console, optional in-page JS eval and screenshot evidence. Degrades gracefully when Playwright is absent. Registry now supports genuinely async tool sources (is_async flag → _async_handlers): is_async_tool/execute_tool_async route browser calls on the agent's event loop; sync callers get a clear error. The scan pipeline's BaseAgent already branches on is_async_tool, so this composes cleanly. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
OpenHack stays the default hosted provider (free credits, no setup), but any OpenAI-compatible endpoint now drops in via providers.py: OpenAI, Anthropic (compat), OpenRouter, Groq, DeepSeek, Together, local Ollama. Selected with llm_provider; base URL/key/model resolved from the registry + env (KEY, <PROVIDER>_BASE_URL, <PROVIDER>_MODEL overrides). LLMClient is now provider-aware: resolves the client from the registry, raises a clear "export <KEY>" error when the key is missing, prices BYOK usage from known tables (0 when unknown — the user is billed by their provider), and only sends prompt_cache_key to providers that accept it. `openhack providers` lists them with key status. 138 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
The beautiful landing now drives the interactive hacking agent: type a task (or /agent <task>, /plan <objective>) and it runs InteractiveAgent/ PlanAgent, streaming thinking + tool activity into the Trace pane and Context/Activity/cost into the sidebar — reusing the scan view's rendering. Follow-up input while it runs is injected mid-loop via the existing add_user_instruction path, so it's a real conversation. Final answer is de-duplicated against BaseAgent's own trace. Also: BaseAgent now runs sync tools via asyncio.to_thread so a long tool (nmap/nuclei/shell) can't freeze the event loop / TUI spinner. Verified live in a PTY: `secret_scan` streamed into the transcript, the agent asked a clarifying question, footer showed tokens + cost. 138 tests pass; landing + agent flows snapshot-checked. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Bug: after the agent's first turn finished, mode stayed "scanning", so a
follow-up hit the "queue instruction for a running scan" path — but the
agent loop had already returned, so the message went nowhere ("instruction
queued for scan agents" with no effect).
Fix:
- Route non-slash input by actual run state, not mode: if a run is in
flight -> queue as a mid-loop instruction; if an agent conversation is
open but idle -> continue it; if a finished scan is on screen -> chat
about findings; else (landing) -> start a fresh agent.
- BaseAgent gains continue_run(): appends a user turn and re-enters the
loop keeping prior history + system prompt (run() refactored to share
_agent_loop()). So the agent remembers what it just did.
- TUI tracks the live agent + is_agent_session; _continue_agent re-arms
the spinner and streams into the same transcript. Reset on /clear and
when a real scan starts.
Verified live in a PTY: turn 1 ran secret_scan, the follow-up continued
the same conversation and ran sca_scan. 138 tests pass.
Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Only the agent's side of the conversation was visible. Now each user turn (initial task and follow-ups) is echoed into the trace as a "user" event, rendered with a green ▌ bar, so both sides of the exchange show in order. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Interactive agent messages now render like a normal chat line — a colored speaker bar + the message, no "openhack" name label and no extra indent. User = grey bar + grey text; agent = green bar + normal text. The scan pipeline keeps its named-agent layout (many agents there). Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
In an interactive agent conversation the left "agents" list is just the operator + agent (it's a scan-pipeline filter for many named agents), so hide that whole column during agent sessions. Add a blank line between messages so the transcript reads like a chat with room to breathe. Scans keep the agents filter unchanged. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
The tab row was crowded with a long hint string. Shortcuts now live on a dim keybar at the bottom, and are context-aware: a conversation shows send/scroll/clear/help; a scan shows tab/finding/resize/sidebar/sessions. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
- The Session/Context/Findings/Activity sidebar is scan-pipeline furniture; in an interactive conversation it just shows "Scan complete / none yet". Hide it during agent sessions (findings + cost are in the bottom bar) so the chat uses the full width. - Add a blank line between the input line and the model/provider line in the prompt box (landing + main app) — they were stuck together. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
- Tool calls in a conversation render as a quiet indented tool tag (no "openhack" name, no arrow) instead of scan-style attribution. - Hide the Trace/Findings tab bar in agent sessions — the transcript is the only view (findings will open on demand). - Up/Down now scroll the transcript; removed the per-agent "picker" cycling (there's no agent list in a conversation). Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Commands:
- /provider now uses the real providers.py registry (openhack/openai/
anthropic/openrouter/groq/deepseek/together/ollama), not the dead
{openhack: kimi} table. Lists providers and reports missing keys.
- Removed /agent (plain text starts the agent), /test (dev-only sim),
/sidebar (dead in chat) from the menu + dispatch. Fixed the dangling
/full-scan reference in the chat prompt. Refreshed all descriptions.
Findings:
- New tools/findings.py: report_finding + list_findings, wired when the
registry gets a session. The agent records confirmed vulns (they show
via /findings and in the transcript) and can recall/summarise them.
- /findings now actually shows the findings view (esc/typing returns to
chat); agent-reported findings bubble into ScanState.
- list_findings allowed in read-only plan mode; report_finding is not.
143 tests pass; live-checked the record→/findings flow.
Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
/model with no arg now lists the models the OpenHack provider serves (kimi-k2.5, gemma-4-31b, mistral-large-2512), marks the active one, and tells you how to switch. Switching to an unknown model warns that requests may fail. On a BYOK provider it accepts any model id. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Flip the default model from kimi-k2.5 to glm-5.2: config default, PROVIDER_DEFAULTS, OPENHACK_MODELS, input-box placeholder, /provider fallback, setup wizard, context-limit map, and a placeholder pricing entry (set real rates once known). kimi-k2.5 remains selectable via /model. Requires the inference backend to serve glm-5.2. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Agent conversations now write to ~/.openhack/scans/<id>.json like scans do,
reusing _write_report: model/provider, status, duration, full cost
breakdown (tokens + $), findings, and the complete trace (thinking, tool
calls, inputs, outputs). Tagged kind="agent" with the first user message
as title so /sessions can list them. Written at turn start ("running") so
a crashed turn still leaves a record, and at end (completed/cancelled/
failed); continuation turns update the same file.
Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
docs/PENTEST_TASKS.md — a copy-pasteable catalog across recon, SAST, secrets, SCA, web/DAST, API, authn/z, cloud/IaC, exploitation, OOB, email-gated flows, and reporting. Includes an authorization note and @path usage. Meant as the "first thing to try" list for operators. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
docs/EVAL_RESULTS.md — ran OpenHack (glm-5.2) against a 13-class vuln-lab via `openhack hack` on 4 tasks (full triage, injection hunt, secret triage, SCA). Covered 12.5/13 classes with correct file:line + working PoCs for ~$0.23 total. Documents strengths (coverage, real PoCs, reachability reasoning, precision) and gaps (LLM-estimated CVE counts, framing-dependent triage, missed EOL base image, per-turn tool-schema overhead). DAST/recon left for a live-target eval. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Agent behaviour: added a top-priority "do exactly what's asked — nothing more, nothing less" rule and gated the broad recon sweep on a broad request. Narrow asks now skip full recon and answer only the question; the final message no longer appends bonus findings / inventory dumps. Verified live: "which line has the SQLi?" → one read_file + a one-line answer ($0.011) instead of a 27-finding full triage. docs/PENTEST_TASKS_ADVANCED.md: 100 staff-level bug-bounty tasks (auth/ session, BOLA/BFLA chains, SSRF→cloud→IAM, 2nd-order/blind/template-RCE injection, deser gadget chains, request smuggling/cache, OAuth/SAML/JWT, advanced client-side, business-logic/races, GraphQL depth, supply chain/ CI-CD, cloud/container/IaC, full chains). 166 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Ran OpenHack end-to-end against XBOW validation-benchmarks (dockerized CTF web apps). Level-1 sample: 4/5 solved (IDOR, SQLi, SSTI, LFI captured their flags; command injection hit the iteration cap). Real exploitation, no human help. Headline finding: capability is there but blind exploitation by hand is 10-20x too expensive ($0.5-0.7, 450-550k tokens each) because sqlmap/tplmap aren't installed — the agent reinvents them over curl. Actionable: ship a curated tool set + teach the agent to use it, and relax the exploitation iteration cap. Only pass/fail + public vuln class + cost recorded (no benchmark internals). Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Adds recon.sqlmap_test (automated sqlmap: --batch, detects injection point/DBMS/technique, can --dump) so the agent stops brute-forcing SQLi over curl. System prompt principle 3 rewritten: reach for the specialist (sqlmap_test for SQLi, nuclei_scan for templated scans, ffuf for content discovery) before hand-rolling requests. Installed sqlmap + nuclei. 169 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
The soft 'prefer sqlmap' guidance was ignored — a SQLi benchmark re-run still made 23 curl calls and 0 sqlmap calls. Rewrote principle 3 as a hard rule: SQLi MUST go through sqlmap_test; manual SQLi payloads over curl are forbidden. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Lower ShellTools output cap 60k→20k chars: verbose tool output (sqlmap/ nmap/curl) re-sends every agent turn, so oversized results inflate cost super-linearly. EVAL_RESULTS: the "install sqlmap" fix didn't cut cost — soft prompt guidance was ignored (0 sqlmap calls), a hard mandate got sqlmap used but via raw shell not the tool, and cost stayed ~$0.5-0.7. Real lessons: prompt-based tool-routing is weak with glm-5.2, and the dominant cost is context accumulation across the ~20 iterations exploitation needs — needs truncation/compaction/caching, not more tools. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
interactive_runner now writes ~/.openhack/scans/<id>.json after each `openhack hack` run: task, status, cost/tokens, findings, and the complete trace (every tool input/output, capped). Makes headless runs (e.g. the XBOW benchmark harness) fully reviewable after the fact, matching the TUI's persistence. Wrapped so it never fails the run. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Ran OpenHack (glm-5.2, autonomous) end-to-end against all 104 XBOW validation-benchmarks. Solved 54/104 raw (61% of the 88 that built+ran); by level: L1 27/39, L2 23/41, L3 4/8 of runnable. $31.10 total. 14 build_fail are EOL-Debian benchmark bit-rot, not OpenHack. Solves span priv-esc, SSTI/RCE, deserialization, XXE, GraphQL, race, JWT — not just easy classes. docs/XBOW_RESULTS.md + xbow_scoreboard.csv (ids/results/ cost/tags only; no benchmark internals). Traces saved locally. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Ran the full 104 XBOW suite on deepseek/deepseek-v4-pro via OpenRouter (white-box + persistence + baseline prompts tried). Scored 1/104 vs glm-5.2's 54/104. Traces show V4 Pro is a strong ANALYST (nails the white-box vuln id) but not an EXPLOITER — it describes/templates the exploit and stops instead of running it and extracting the live flag, and struggles with stateful multi-step exploits. No prompt variant fixed it. Conclusion: glm-5.2 far better for autonomous flag-capture; V4 Pro suits an analysis stage, not a single-agent grab. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Fixes the #1 XBOW failure mode (26/34 glm-5.2 fails thrashed into a context death-spiral, 400k-1.8M tokens, hit the 50-turn cap without converging). Root cause: compaction truncates old reasoning to 200 chars and summarizes old tool results, so past turn ~3 the agent has amnesia and re-tries dead ends. Three changes in BaseAgent._agent_loop: 1. Durable action ledger (never compacted): every genuine tool call + one-line result is recorded and re-injected into the system prompt each turn, so the agent always sees what it already tried. 2. Anti-repetition: an exact duplicate tool call is short-circuited with the cached result + a nudge, instead of re-executing and re-bloating context. 3. Progress-aware stop replaces the fixed 50-cap: bail after N consecutive turns with no new action (thrash), extend otherwise. Cap raised to 120, both configurable (agent_max_iterations, agent_stale_turn_limit). 169 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
The 120-turn cap + exact-call-repeat stop was a net loss on the 26 XBOW thrash benchmarks: near-dup thrash (same endpoint, tweaked payload, same response) never trips exact dedup, so runs ballooned to 2-5M tokens (vs ~850k-990k before) instead of the intended savings. Progress stop now keys on result *novelty* (a turn only counts as progress if a genuinely new call yields a not-seen-before result), and the iteration cap is back to a modest 60 (all XBOW solves landed under 50 turns). 169 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
…S x86 Full black-box re-run on an AWS x86 box with six Docker-29 compatibility fixes (buildx, mysql:5.7.15->5.7.44, expose N:M, EOL-Debian apt archive, build guards). Single-run 72/104 (69%); best-of-3 86/104 (83% raw, 87% of runnable) on glm-5.2. Adds black-box leaderboard comparison (Shannon corrected: white-box only, no black-box score), reproducible harness scripts, scoreboards, and transcripts. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Source-aware run (app source given, flag artifacts stripped, proof-by-exploitation against live app, same sha256 grader). +12 over black-box single-run (72->84); median tokens/solve halved (107k->46k); run cost $12.46. Apples-to-apples with Shannon's white-box 96% (Claude): ~12-15pt gap = model + specialist pipelines + our infra ceiling. Adds white-box scoreboard, harness, and leaderboard section. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Grok 4.5 (OpenHack backend) solved 10 of the 13 benchmarks glm-5.2 missed even at best-of-3 (glm: 0/13) — SSTI 4/4, blind SQLi, CVE, cmd-inj, 2x LFI, path-traversal. Projects to ~96/104 black-box (glm best-of-3 86 + 10 converted), level with Shannon's 96 WHITE-BOX. Conclusion: the Shannon gap is dominantly a MODEL gap, not architecture. Adds Grok scoreboard, harness, full cost accounting (~$87), and ranked next steps. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
grok-4.5 was missing from PRICING, so cost display fell back to kimi rates ($0.50/$2.80) and undercounted Grok spend ~5x. Adds real $2/$6 pricing and a full-104 black-box Grok harness for the confirmation run. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Grok 4.5 is now first in the picker, the default in PROVIDER_DEFAULTS and the setup wizard, and its 500K context window is registered in the context manager (vs 128K for the others) so it uses the full window before compacting. glm-5.2 stays available and labeled cost-efficient. 169 tests pass. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
…t as glm Full black-box single-run on Grok 4.5 = 88/104, beating glm-5.2's best-of-3 (86) in one pass, at $34.73 (~= glm's $32.86 — efficiency offsets higher token price). Confirms the Shannon gap was dominantly a model gap. Grok now the default model. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
… browser) Additive, nothing wired into default paths. New: agents/specialists/ (SpecialistAgent subclassing InteractiveAgent + XSS/Injection/SSRF/SSTI/Auth/Blind classes, build_specialist factory, classify_vuln_class), prompts/specialists/ playbooks, tools/stateful_browser.py (persistent-session browser reusing BrowserRunner + existing specs). registry.py gains an opt-in include_stateful_browser flag (default off → generalist toolset unchanged). 21 new tests, 190 total green. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
Adds tools/specialist_dispatch.py (dispatch_specialist tool: generalist hands a localized vuln to the matching specialist, shared session, returns flag/summary). Wired into the interactive agent ONLY via _build_agent (PlanAgent + specialists excluded → no recursion, plan stays read-only). registry gains attach_source(). One optional prompt rule added. All 6 specialist classes are dispatchable. 193 tests. Claude-Session: https://claude.ai/code/session_016PMahuFwyaHhR5aUeeC1TM
…cture Live tests show the stateful browser goes unused (Grok solves these XSS challenges with plain HTTP); the specialist layer is kept as product capability, not a benchmark play. Notes the incidental sqlmap-was-missing finding (now installed 1.8.4).
95 full-run + 13 hardfails transcripts archived off the box so the Grok evidence (payload->flag per benchmark) survives box termination.
…n accents OH_BG #0A1311 (green-tinted near-black) -> #000000 solid black; panel/element/ border surfaces neutralized to grey (no green tint). Green text accents (OH_PRIMARY/ACCENT/GREEN #00B97E/#1CC584) unchanged. 192 tests green.
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.13.5 to 3.14.1. - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.13.5...v3.14.1) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps aiohttp from 3.13.5 to 3.14.1.
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
9c35d03Release v3.14.1 (#12864)38b956c[PR #12861/59684b5c backport][3.14] Revert "Drop list compression (#12857)" (...8f31009[PR #12857/69dff14d backport][3.14] Drop list compression (#12858)dfdfa9d[PR #12830/93a2b1c3 backport][3.14] Bound pipelined request queue per connect...0e9cedd[PR #12827/ccf218ab backport][3.14] Numeric ipv4 resolver bypass (#12849)a762eda[PR #12831/1ac92dae backport][3.14] Payload close on disconnect (#12843)a329a7a[PR #12824/60b85e98 backport][3.14] Preserve host-only cookie scope across Co...4f7480e[PR #12828/13b635d7 backport][3.14] Bounded unread compressed drain (#12845)5ab61bb[PR #12826/36df6c13 backport][3.14] Enforce max_line_size on fragmented reque...3912667[3.14] Add test that env proxy auth is scoped to the redirect-selected proxy ...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.