Sourced from req's releases.

v0.6.1

• compressed, decompress_body: Disable automatic decompression

  Decompression is now opt-in by setting compressed: true.

v0.6.0

• encode_body: Security fix for :form_multipart header injection (GHSA-px9f-whj3-246m).

  The multipart encoder interpolated the per-part name, filename, and content_type into the part headers without escaping, so an attacker-controlled value could inject extra headers or smuggle additional parts into the request. These values are now escaped per RFC 7578 / WHATWG form-data (", CR, and LF are percent-encoded).

  Thanks to @​PJUllrich for reporting it.

• decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding, (GHSA-655f-mp8p-96gv).

  Req previously auto-decoded archive and compressed response bodies (zip, tar, tgz, gz, zst, and csv) based on the server-supplied content-type, materialising the full decompressed contents in memory with no size cap. An attacker-controlled (or redirect-reachable) endpoint could return a tiny "decompression bomb" that expanded to gigabytes and exhausted the node's memory.

  Now only JSON is decoded by default. Other formats are opt-in via the new :decoders option, which defaults to [:json, :json_api]. Setting it replaces the default (include :json to keep JSON decoding), and false disables all decoding:

  # opt into archives (only for endpoints you trust):
  Req.get!(url, decoders: [:json, :zip])
  

  Note: The decoded zip/tar is still list of {filename :: charlist(), contents :: binary} tuples. In the future release, this will be list of {filename :: binary(), contents :: binary()} tuples.

  While automatic CSV decoding wasn't a security issue, the behaviour based on presence/absence of nimble_csv dependency was suprising. CSV support is still built-in but need to be enabled with decoders: [:csv].

... (truncated)

Sourced from req's changelog.

v0.7.1 (2026-07-28)

• Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0 (2026-07-28)

• [Req]: Add Req.new(req, options).

• [Req]: Treat URL userinfo as Basic Authentication.

• [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

• [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

• [Req.Request]: Fix redacting remaining auth values.

• (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

• (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

• [Req.Finch]: Support finch: options.

• [Req.Finch]: Support :request_timeout.

• [Req.Finch]: Fix handling duplicate response headers.

• [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

• [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

• [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

• [Req.Finch]: Deprecate :finch_request.

• [Req.Plug]: Handle individual response body chunks.

• [Req.Plug]: Support non-UTF8 request params.

• [Req.Plug]: Put original request private data in conn.private.

• [Req.Test]: Allow descendant processes.

• [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

• [compress_body]: Do nothing when request content-encoding is already set.

• [compress_body]: Update multipart boundary when re-running the step.

• [compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+ built-in :zstd.

... (truncated)

• 168a11e Release v0.7.1
• a9c24a1 Deprecate cache: true/cache step
• 6a4f305 Release v0.7.0
• d770830 Hide body: fun for now
• e450b25 Update CI
• 8123419 Fix flaky httpc into: fun test
• fb7bb10 Revert "New step: expect (#493)"
• ed894af Revert "Add assigns (#492)"
• c47a208 Update docs
• be40081 Req.Finch: Deprecate :finch_request
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)