build(deps): bump http from 0.2.12 to 1.4.2 by dependabot[bot] · Pull Request #595 · actix/actix-web-lab

dependabot · 2026-11-10T20:43:08Z

Bumps http from 0.2.12 to 1.4.2.

Release notes

v1.4.2

What's Changed

feat(method): impl PartialOrd + Ord by @mmirate in hyperium/http#840

fix(uri): allow STAR paths with scheme/auth by @seanmonstar in hyperium/http#843

fix: reject DEL character by @Isvane in hyperium/http#842

New Contributors

@mmirate made their first contribution in hyperium/http#840

@Isvane made their first contribution in hyperium/http#842

Full Changelog: hyperium/http@v1.4.1...v1.4.2

v1.4.1

tl;dr

Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.

Fix Extend for HeaderMap to clamp max size hint and not overflow.

Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.

Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

What's Changed

chore(header): fix clippy::assign_op_pattern by @rxc-amzn in hyperium/http#806

ci: pin itoa in msrv job by @seanmonstar in hyperium/http#813

Remove unnecessary explicit lifetimes by @jplatte in hyperium/http#815

chore(ci): update to actions/checkout@v6 by @tottoto in hyperium/http#819

tests: update to rand 0.10 by @tottoto in hyperium/http#818

refactor: Remove usage of float instruction by @AurelienFT in hyperium/http#823

refactor(uri): consolidate PathAndQuery::from_shared and from_static by @seanmonstar in hyperium/http#825

fix(uri): reject Path::from_shared/from_static if doesn't start with slash by @seanmonstar in hyperium/http#826

Rephrase comment by @daalfox in hyperium/http#827

Fix typo in request builder docs by @vleksis in hyperium/http#831

fix: clamp Extend size hint so HeaderMap reserve cannot overflow by @SAY-5 in hyperium/http#833

fix(headers): fix stacked borrows for IterMut/ValuesIterMut by @seanmonstar in hyperium/http#837

fix(header): use a set_len guard in IntoIter drop by @seanmonstar in hyperium/http#838

New Contributors

@rxc-amzn made their first contribution in hyperium/http#806

@AurelienFT made their first contribution in hyperium/http#823

@daalfox made their first contribution in hyperium/http#827

@vleksis made their first contribution in hyperium/http#831

@SAY-5 made their first contribution in hyperium/http#833

Full Changelog: hyperium/http@v1.4.0...v1.4.1

v1.4.0

Highlights

Add StatusCode::EARLY_HINTS constant for 103 Early Hints.

Make StatusCode::from_u16 now a const fn.

Make Authority::from_static now a const fn.

... (truncated)

Changelog

Sourced from http's changelog.

1.4.2 (June 8, 2026)

Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.

Fix Uri to properly reject DEL characters.

1.4.1 (May 25, 2026)

Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.

Fix Extend for HeaderMap to clamp max size hint and not overflow.

Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.

Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

1.4.0 (November 24, 2025)

Add StatusCode::EARLY_HINTS constant for 103 Early Hints.

Make StatusCode::from_u16 now a const fn.

Make Authority::from_static now a const fn.

Make PathAndQuery::from_static now a const fn.

MSRV increased to 1.57 (allows legible const fn panic messages).

1.3.1 (March 11, 2025)

Fix validation that all characters are UTF-8 in URI path and query.

1.3.0 (March 11, 2025)

Allow most UTF-8 characters in URI path and query.

Fix HeaderMap::reserve() to allocate sufficient capacity.

1.2.0 (December 3, 2024)

Add StatusCode::TOO_EARLY constant for 425 status.

Loosen TryFrom<HashMap> for HeaderMap to work with any state generic.

Change Builder methods to use TryInto instead of TryFrom arguments.

Make StatusCode::as_u16 a const function.

Fix Method parsing to allow #$%&' characters.

Fix HeaderName parsing to reject " characters.

Fix off by 1 error in Method::from_bytes that could cause extra allocations.

1.1.0 (March 4, 2024)

Add methods to allow trying to allocate in the HeaderMap, returning an error if oversize instead of panicking.

Add Extensions::get_or_insert() method.

Implement From<Uri> for uri::Builder.

Fix HeaderName::from_lowercase that could allow NUL bytes in some cases.

1.0.0 (November 15, 2023)

Implement Clone for Request, Response, and Extensions. This breaking change requires that all extensions now implement Clone.

... (truncated)

Commits

82db5b8 v1.4.2
a9cdbf8 fix(uri): reject DEL character (#842)
df75ca3 fix(uri): allow STAR paths with scheme/auth (#843)
ec3f8ce feat(method): impl PartialOrd + Ord (#840)
a24c968 v1.4.1
bc3b044 fix(header): use a set_len guard in IntoIter drop (#838)
1b968dc fix(header): fix stacked borrows for IterMut/ValuesIterMut (#837)
6e2dd42 fix: clamp Extend size hint so HeaderMap reserve cannot overflow (#833)
68e0abb docs: fix typo in request builder docs (#831)
29dd307 docs(extensions): rephrase internal comment (#827)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [http](https://github.com/hyperium/http) from 0.2.12 to 1.4.2. - [Release notes](https://github.com/hyperium/http/releases) - [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md) - [Commits](hyperium/http@v0.2.12...v1.4.2) --- updated-dependencies: - dependency-name: http dependency-version: 1.4.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

codspeed · 2026-11-10T20:55:39Z

Merging this PR will degrade performance by 22.99%

1 warning

⚠️ 4 benchmarks with a significant change ran in a different software environment

Their base and head results were measured with a different OS or toolchain, such as compiler, runtime or library versions, so the changes might come from this difference rather than from the code. Open an affected benchmark to see what changed.

See affected benchmarks

❌ 4 regressed benchmarks
✅ 132 untouched benchmarks
⏩ 68 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	Walltime	`encode_receiver_body[(1000, 1)]`	2 µs	2.7 µs	-27.68%
❌	Walltime	`encode_receiver_body[(32, 1)]`	1.8 µs	2.4 µs	-24.77%
❌	Walltime	`encode_receiver_body[(1024, 1)]`	2.1 µs	2.8 µs	-24.59%
❌	Walltime	`decode_fragmented_message[(32, 7)]`	1.4 µs	1.6 µs	-14.29%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing dependabot/cargo/http-1.4.2 (1e5f509) with main (d14247a)}

68 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Nov 10, 2026

robjtede approved these changes Nov 10, 2026

View reviewed changes

robjtede added this pull request to the merge queue Nov 10, 2026

Merged via the queue into main with commit 45a0383 Nov 10, 2026
12 of 14 checks passed

robjtede deleted the dependabot/cargo/http-1.4.2 branch November 10, 2026 21:22

Navigation Menu

Repository navigation

build(deps): bump http from 0.2.12 to 1.4.2 - #595

build(deps): bump http from 0.2.12 to 1.4.2#595
robjtede merged 1 commit into
mainfrom
dependabot/cargo/http-1.4.2

dependabot Bot commented on behalf of github Nov 10, 2026

Uh oh!

codspeed Bot commented Nov 10, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 10, 2026

v1.4.2

What's Changed

New Contributors

v1.4.1

tl;dr

What's Changed

New Contributors

v1.4.0

Highlights

1.4.2 (June 8, 2026)

1.4.1 (May 25, 2026)

1.4.0 (November 24, 2025)

1.3.1 (March 11, 2025)

1.3.0 (March 11, 2025)

1.2.0 (December 3, 2024)

1.1.0 (March 4, 2024)

1.0.0 (November 15, 2023)

Uh oh!

codspeed Bot commented Nov 10, 2026

Merging this PR will degrade performance by 22.99%

Performance Changes

Footnotes

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant