[dependabot]

Bumps curb from 1.4.1 to 1.5.0.

Changelog

Sourced from curb's changelog.

1.5.0

• Behavior changes (may affect code that does not use the safety features): redirects are now capped at 30 when max_redirects is unset, where curb previously passed unlimited (set max_redirects = -1 to restore unlimited); CR, LF, and NUL in headers, proxy headers, useragent, cookies, custom request methods, and CURLOPT_REQUEST_TARGET now raise ArgumentError instead of being sent; easy.cookies= is no longer sent to other hosts after a cross-host redirect on libcurl 7.83+; and replacing post_body/put_data or calling http_post/http_put/http_patch/http_delete/http(verb) while a transfer is active now raises RuntimeError. Under network_policy = :public (including Curl.safe!), file:// URLs without a protocol allowlist, non-IP-literal DoH URLs, and Unix sockets without allow_unix_socket are refused, and safe mode now defaults to a 60s timeout and 20 redirects. Details for each are below.
• Read Curl::Multi.default_timeout once per Curl::Multi#perform instead of on every wait-loop pass. The setting lives in Ractor-local storage, so each read cost two Ruby method calls, and the polling loop read it up to twice per pass (50 MB download: 132–166 Ractor.current calls per perform → 14, independent of transfer length). Applies to both the polling and Fiber-scheduler socket-action loops. Changing default_timeout from a callback or perform block now takes effect on the next perform.
• Fix a use-after-free when request state is replaced while a transfer is active: post_body=, put_data=, autoreferer=, http_post, http_put, http_patch, http_delete, and http(verb) called from a callback on the same handle, or on a sibling handle in the same performing Curl::Multi, freed the body buffer libcurl was still sending and could crash or send freed memory. These now raise RuntimeError like setopt does, and re-running native setup on an active handle is rejected the same way. Reconfiguring a handle from completion callbacks or once its transfer finishes is unchanged. Add regression coverage for own-handle and sibling-handle mutation.
• Test suite: fix intermittent "Could not connect" failures in the per-test WEBrick fixture (seen in the macOS Fiber scheduler tests). It reserved a free port, released it, and re-bound it without a bind address; if the IPv4 bind then lost a race for that ephemeral port, WEBrick silently kept only its IPv6 listener and 127.0.0.1 refused connections. The fixture now binds 127.0.0.1 explicitly and lets the kernel choose the port at bind time.
• Make CURLOPT_STDERR safer against programmer mistakes such as closing the IO too early: previously libcurl wrote verbose output through the IO's own FILE*, so closing the IO (including the block form of File.open, or closing it after Curl::Multi#add) and performing again wrote through freed memory and could corrupt the heap. curb now hands libcurl a stream it owns on a duplicate descriptor, so verbose output keeps reaching the file after the caller closes their IO. The descriptor is released on replacement, reset, close, and GC; clones get their own. Non-writable IOs now raise IOError instead of silently dropping output. Add regression coverage for early close, multi transfers, clones, and descriptor release.
• Fix a network_policy = :public bypass through non-IP sockets: a Unix socket path set with setopt(CURLOPT_UNIX_SOCKET_PATH, ...) after Curl::Multi#add was used without any destination check. The socket-open policy check now refuses every non-IP socket unless Unix sockets were explicitly allowed (allow_unix_socket), regardless of when the option was set. Add regression coverage for late Unix socket configuration.
• Require public IP-literal DoH endpoints under network_policy = :public: libcurl's DoH lookups do not go through the socket policy, so a DoH URL such as https://localhost/dns-query (or 127.1, [::1], a private address) reached local services even with allow_doh enabled, and the per-handle policy did not check DoH URLs at all. DoH hostnames are now rejected because they resolve outside the policy; use an address such as https://1.1.1.1/dns-query. The host is taken from libcurl's own URL parser, so numeric shorthand forms are normalized before the check. Add regression coverage for loopback, private, shorthand, IPv6, and hostname endpoints.
• Reject file:// URLs under network_policy = :public when no protocol allowlist is configured, since reading a local file opens no socket for the policy to check. An explicit allowlist that includes :file is still honored, and Curl.safe!/safe_* keep raising UnsupportedProtocolError through their HTTP/HTTPS allowlist. Add regression coverage.
• Stop sending easy.cookies= to other hosts on redirect: cookies were passed as CURLOPT_COOKIE, which libcurl sends to every host a redirect reaches. They are now sent as a Cookie header, which libcurl 7.83+ drops on cross-host redirects. An explicit Cookie header still takes precedence, and clearing cookies now stops sending them on a reused handle. With the cookie engine enabled (enable_cookies or cookielist), cookies= is still passed as CURLOPT_COOKIE so libcurl merges both into one Cookie line, and is still forwarded on redirect; use the cookie engine's domain-scoped cookies there. Add regression coverage for cross-host and same-host redirects.
• Cap redirects by default: curb passed -1 (unlimited) as CURLOPT_MAXREDIRS whenever max_redirects was unset, overriding libcurl's own limit. Unset now means at most 30 redirects (libcurl 8.3+'s default, applied on every libcurl version); max_redirects = -1 still allows unlimited redirects. Curl.safe!, safe_* helpers, and Easy#safe_http! additionally default to a 60-second timeout and at most 20 redirects, configurable through SafetyConfig#timeout/#max_redirects and the :timeout/:max_redirects helper options, and applied only when a handle has not set its own (unlimited redirects are capped). Add regression coverage for redirect loops and safe-mode limits.
• Reject CR, LF, and NUL characters in request headers, proxy headers, useragent, cookies, custom request methods (including http(verb)), and CURLOPT_REQUEST_TARGET, raising ArgumentError. libcurl sends these values verbatim, so a value built from user input could inject extra headers or split the request. Add regression coverage.
• Stop reserving 32 KB/16 KB body and header buffers on every perform: that capacity stayed attached to each returned body_str/header_str, so a 2 KB response held 32 KB. The buffers now start small, grow as data arrives, and are trimmed to fit once the transfer completes (5,000 retained 2 KB bodies: 164 MB → 10.4 MB; 20,000 reused-handle GETs: 29 minor GCs → 2). Request time and large downloads are unchanged. Add regression coverage for retained capacity and large bodies.
• Cut fiber-scheduler overhead for Curl::Easy#perform: the scheduler driver yielded on every Curl::Multi#perform pass, about five yields per request, although the socket-action loop already waits through the scheduler on each pass. It now yields only on the fallback wait loop (Windows and builds without socket-action support), which blocks the thread. Under Async, a sequential request drops from ~42 µs/53 allocations to ~33 µs/41, and 100 concurrent fibers from ~30 µs to ~19 µs per request. Add regression coverage that sibling fibers keep running while a large body streams.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)