[tribble-trouble]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/cplieger/atomicfile/v4	v4.1.0 → v4.2.0			require	minor
github.com/cplieger/httpx/v5	v5.0.5 → v5.2.0			require	minor
github.com/cplieger/jsoncap/v2	v2.0.3 → v2.1.0			require	minor
github.com/cplieger/runesafe/v3	v3.0.0 → v3.2.0			require	minor
github.com/cplieger/urlform	v1.4.0 → v1.5.0			require	minor
go (source)	1.27.2 → 1.27.3				patch

---

Release Notes

cplieger/atomicfile (github.com/cplieger/atomicfile/v4)

v4.2.0

Compare Source

Promoted from v4.2.0-dev.1

Full changelog: cplieger/atomicfile@v4.1.0...v4.2.0

Dependencies: 1 change (go)

• go 1.27.2 to 1.27.3 (Go)

cplieger/httpx (github.com/cplieger/httpx/v5)

v5.2.0

Compare Source

Promoted from v5.2.0-dev.1

Full changelog: cplieger/httpx@v5.1.0...v5.2.0

Dependencies: 1 change (go)

• go 1.27.2 to 1.27.3 (Go)

v5.1.0

Compare Source

Promoted from v5.1.0-dev.2

This release fixes a redirect allowlist bypass that let a redirect reach a loopback or other local IPv6 address. Every v5.0.x release has it, so upgrade if you use WithAllowedSuffixes or DockerGitHubRedirectPolicy. It also adds WithSameOrigin and a typed error for refused redirects.

Security

• WithAllowedSuffixes and DockerGitHubRedirectPolicy matched an allowed suffix against the whole host string, IPv6 zone included. A redirect to https://[::1%25.docker.com]/ passed the .docker.com check and reached the loopback address. net/http forwards custom headers on a redirect, so a credential sent in one could reach that address. An allowed suffix now matches host names only, never an IP address. (#​603)

Added

• WithSameOrigin(true) follows a redirect to the original host only when the scheme, host and port all match, so a credential header never reaches another port on the same host. Other hosts keep the allowlist and downgrade rules. (#​590)
• Every hard redirect refusal from RedirectPolicyFunc, DefaultRedirectPolicy and DockerGitHubRedirectPolicy is now a *RedirectRefusedError, with its Origin and a Reason of RedirectNotAllowed, RedirectOtherOrigin, RedirectDowngrade or RedirectTooMany. Read it with errors.As. RefuseAllRedirects and WithPreserveMethod still return http.ErrUseLastResponse. (#​590)

Changed

• Refusal messages name the target's origin instead of the bare host, for example refusing redirect to https://evil.example:8443. If your code matches on the message text, switch to errors.As. (#​590)
• WithMaxHops(n) and the default cap of 5 now follow exactly n redirects and refuse the next one. Before, they followed one fewer. (#​590)

Fixed

• Redirect checks compare an IPv6 zone exactly, so a redirect to fe80::1%ETH0 after a request to fe80::1%eth0 is refused as another origin. DNS host names still compare without regard to ASCII case. (#​603)
• Redirect policies compare an IP address by its value, so 2001:db8::a and 2001:db8:0::a are one host, and an empty allowlist entry matches nothing. (#​603)

Full changelog: cplieger/httpx@v5.0.5...v5.1.0

cplieger/jsoncap (github.com/cplieger/jsoncap/v2)

v2.1.0

Compare Source

Promoted from v2.1.0-dev.1

Full changelog: cplieger/jsoncap@v2.0.3...v2.1.0

Dependencies: 1 change (go)

• go 1.27.2 to 1.27.3 (Go)

cplieger/runesafe (github.com/cplieger/runesafe/v3)

v3.2.0

Compare Source

Promoted from v3.2.0-dev.1

Full changelog: cplieger/runesafe@v3.1.0...v3.2.0

Dependencies: 1 change (go)

• go 1.27.2 to 1.27.3 (Go)

v3.1.0

Compare Source

Promoted from v3.1.0-dev.1

Added

• Add RedactSingleLineCapped to redact secrets under a byte cap (#​325)

Full changelog: cplieger/runesafe@v3.0.0...v3.1.0

cplieger/urlform (github.com/cplieger/urlform)

v1.5.0

Compare Source

Promoted from v1.5.0-dev.1

Full changelog: cplieger/urlform@v1.4.0...v1.5.0

Dependencies: 1 change (go)

• go 1.27.2 to 1.27.3 (Go)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 AM and 05:59 AM, only on Saturday (* 0-5 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box