/ 
Fetch-0.09

Changes for version 0.09 - 2026-08-04

  • Security: credential headers (Authorization, Cookie, Proxy- Authorization) are no longer sent across a redirect that changes origin (scheme, host or port). A token or explicit cookie set for the original host is dropped when a 3xx points at a different one; jar cookies were already re-scoped per host. t/17-redirect-auth.t.
  • Security: reject a Set-Cookie whose Domain is a bare public suffix / single label (e.g. "com", ".com", "localhost") - it must carry an interior dot, so a server cannot scope a cookie to a whole TLD.
  • Security: a response carrying both Content-Length and Transfer- Encoding: chunked is now framed strictly by the chunked encoding (RFC 7230 3.3.3, TE overrides CL) with the ambiguous Content-Length dropped - it cannot truncate the body or desync a keep-alive connection. t/18-cl-te.t.
  • Loop watcher callbacks (the per-readiness-event hot path) are now dispatched directly: the standalone loop recognises its own C closures and calls the XSUB body straight, skipping pp_entersub.

Modules

Fetch
HTTP/2 Future-based user agent
Fetch::CookieJar
store cookies and apply them to requests
Fetch::Future
a fast, native, Future-compatible async result
Fetch::Headers
ordered, case-insensitive, multi-valued HTTP headers
Fetch::Loop
the event-loop adapter interface Fetch drives
Fetch::Loop::AnyEvent
run Fetch under AnyEvent
Fetch::Loop::Hyperman
run Fetch on a Hyperman::Loop
Fetch::Loop::IOAsync
run Fetch on an IO::Async::Loop
Fetch::Loop::Standalone
Fetch's own vendored C event loop
Fetch::Response
an HTTP response from Fetch
Fetch::WebSocket
a live WebSocket connection from Fetch

Other files