http 3.1.0 → 5.3.1

data/{CHANGES.md → CHANGES_OLD.md}

@@ -1,3 +1,334 @@
+## 5.1.1 (2022-12-17)
+
+* [#731](https://github.com/httprb/http/pull/731)
+  Strip brackets from IPv6 addresses in `HTTP::URI`.
+  ([@jeraki])
+
+* [#722](https://github.com/httprb/http/pull/722)
+  Add `on_redirect` callback.
+  ([@benubois])
+
+## 5.1.0 (2022-06-17)
+
+* Drop ruby-2.5 support.
+
+* [#715](https://github.com/httprb/http/pull/715)
+  Set default encoding to UTF-8 for `application/json`.
+  ([@drwl])
+
+* [#712](https://github.com/httprb/http/pull/712)
+  Recognize cookies set by redirect.
+  ([@tkellogg])
+
+* [#707](https://github.com/httprb/http/pull/707)
+  Distinguish connection timeouts.
+  ([@YuLeven])
+
+## 5.0.4 (2021-10-07)
+
+* [#698](https://github.com/httprb/http/pull/698)
+  Fix `HTTP::Timeout::Global#connect_ssl`.
+  ([@tarcieri])
+
+## 5.0.3 (2021-10-06)
+
+* [#695](https://github.com/httprb/http/pull/695)
+  Revert DNS resolving feature.
+  ([@PhilCoggins])
+
+* [#694](https://github.com/httprb/http/pull/694)
+  Fix cookies extraction.
+  ([@flosacca])
+
+## 5.0.2 (2021-09-10)
+
+* [#686](https://github.com/httprb/http/pull/686)
+  Correctly reset the parser.
+  ([@bryanp])
+
+* [#684](https://github.com/httprb/http/pull/684)
+  Don't set Content-Length for GET, HEAD, DELETE, or CONNECT requests without a BODY.
+  ([@jyn514])
+
+* [#679](https://github.com/httprb/http/pull/679)
+  Use features on redirected requests.
+  ([@nomis])
+
+* [#678](https://github.com/httprb/http/pull/678)
+  Restore `HTTP::Response` `:uri` option for backwards compatibility.
+  ([@schwern])
+
+* [#676](https://github.com/httprb/http/pull/676)
+  Update addressable because of CVE-2021-32740.
+  ([@matheussilvasantos])
+
+* [#653](https://github.com/httprb/http/pull/653)
+  Avoid force encodings on frozen strings.
+  ([@bvicenzo])
+
+* [#638](https://github.com/httprb/http/pull/638)
+  DNS failover handling.
+  ([@midnight-wonderer])
+
+
+## 5.0.1 (2021-06-26)
+
+* [#670](https://github.com/httprb/http/pull/670)
+  Revert `Response#parse` behavior introduced in [#540].
+  ([@DannyBen])
+
+* [#669](https://github.com/httprb/http/pull/669)
+  Prevent bodies from being resubmitted when following unsafe redirects.
+  ([@odinhb])
+
+* [#664](https://github.com/httprb/http/pull/664)
+  Bump llhttp-ffi to 0.3.0.
+  ([@bryanp])
+
+
+## 5.0.0 (2021-05-12)
+
+* [#656](https://github.com/httprb/http/pull/656)
+  Handle connection timeouts in `Features`
+  ([@semenyukdmitry])
+
+* [#651](https://github.com/httprb/http/pull/651)
+  Replace `http-parser` with `llhttp`
+  ([@bryanp])
+
+* [#647](https://github.com/httprb/http/pull/647)
+  Add support for `MKCALENDAR` HTTP verb
+  ([@meanphil])
+
+* [#632](https://github.com/httprb/http/pull/632)
+  Respect the SSL context's `verify_hostname` value
+  ([@colemannugent])
+
+* [#625](https://github.com/httprb/http/pull/625)
+  Fix inflator with empty responses
+  ([@LukaszMaslej])
+
+* [#599](https://github.com/httprb/http/pull/599)
+  Allow passing `HTTP::FormData::{Multipart,UrlEncoded}` object directly.
+  ([@ixti])
+
+* [#593](https://github.com/httprb/http/pull/593)
+  [#592](https://github.com/httprb/http/issues/592)
+  Support informational (1XX) responses.
+  ([@ixti])
+
+* [#590](https://github.com/httprb/http/pull/590)
+  [#589](https://github.com/httprb/http/issues/589)
+  Fix response headers paring.
+  ([@Bonias])
+
+* [#587](https://github.com/httprb/http/pull/587)
+  [#585](https://github.com/httprb/http/issues/585)
+  Fix redirections when server responds with multiple Location headers.
+  ([@ixti])
+
+* [#581](https://github.com/httprb/http/pull/581)
+  [#582](https://github.com/httprb/http/issues/582)
+  Add Ruby 2.7.x support.
+  ([@janko])
+
+* [#577](https://github.com/httprb/http/pull/577)
+  Fix `Chainable#timeout` with frozen Hash.
+  ([@antonvolkoff])
+
+* [#576](https://github.com/httprb/http/pull/576)
+  [#524](https://github.com/httprb/http/issues/524)
+  **BREAKING CHANGE**
+  Preserve header names casing.
+  ([@joshuaflanagan])
+
+* [#540](https://github.com/httprb/http/pull/540)
+  [#538](https://github.com/httprb/http/issues/538)
+  **BREAKING CHANGE**
+  Require explicit MIME type for Response#parse
+  ([@ixti])
+
+* [#532](https://github.com/httprb/http/pull/532)
+  Fix pipes support in request bodies.
+  ([@ixti])
+
+* [#530](https://github.com/httprb/http/pull/530)
+  Improve header fields name/value validation.
+  ([@Bonias])
+
+* [#506](https://github.com/httprb/http/pull/506)
+  [#521](https://github.com/httprb/http/issues/521)
+  Skip auto-deflate when there is no body.
+  ([@Bonias])
+
+* [#489](https://github.com/httprb/http/pull/489)
+  Fix HTTP parser.
+  ([@ixti], [@fxposter])
+
+* [#546](https://github.com/httprb/http/pull/546)
+  **BREAKING CHANGE**
+  Provide initiating `HTTP::Request` object on `HTTP::Response`.
+  ([@joshuaflanagan])
+
+* [#571](https://github.com/httprb/http/pull/571)
+  Drop Ruby 2.3.x support.
+  ([@ixti])
+
+* [3ed0c31](https://github.com/httprb/http/commit/3ed0c318eab6a8c390654cda17bf6df9e963c7d6)
+  Drop Ruby 2.4.x support.
+
+
+## 4.4.0 (2020-03-25)
+
+* Backport [#587](https://github.com/httprb/http/pull/587)
+  Fix redirections when server responds with multiple Location headers.
+  ([@ixti])
+
+* Backport [#599](https://github.com/httprb/http/pull/599)
+  Allow passing HTTP::FormData::{Multipart,UrlEncoded} object directly.
+  ([@ixti])
+
+
+## 4.3.0 (2020-01-09)
+
+* Backport [#581](https://github.com/httprb/http/pull/581)
+  Add Ruby-2.7 compatibility.
+  ([@ixti], [@janko])
+
+
+## 4.2.0 (2019-10-22)
+
+* Backport [#489](https://github.com/httprb/http/pull/489)
+  Fix HTTP parser.
+  ([@ixti], [@fxposter])
+
+
+## 4.1.1 (2019-03-12)
+
+* Add `HTTP::Headers::ACCEPT_ENCODING` constant.
+  ([@ixti])
+
+
+## 4.1.0 (2019-03-11)
+
+* [#533](https://github.com/httprb/http/pull/533)
+  Add URI normalizer feature that allows to swap default URI normalizer.
+  ([@mamoonraja])
+
+
+## 4.0.5 (2019-02-15)
+
+* Backport [#532](https://github.com/httprb/http/pull/532) from master.
+  Fix pipes support in request bodies.
+  ([@ixti])
+
+
+## 4.0.4 (2019-02-12)
+
+* Backport [#506](https://github.com/httprb/http/pull/506) from master.
+  Skip auto-deflate when there is no body.
+  ([@Bonias])
+
+
+## 4.0.3 (2019-01-18)
+
+* Fix missing URL in response wrapped by auto inflate.
+  ([@ixti])
+
+* Provide `HTTP::Request#inspect` method for debugging purposes.
+  ([@ixti])
+
+
+## 4.0.2 (2019-01-15)
+
+* [#506](https://github.com/httprb/http/pull/506)
+  Fix instrumentation feature.
+  ([@paul])
+
+
+## 4.0.1 (2019-01-14)
+
+* [#515](https://github.com/httprb/http/pull/515)
+  Fix `#build_request` and `#request` to respect default options.
+  ([@RickCSong])
+
+
+## 4.0.0 (2018-10-15)
+
+* [#482](https://github.com/httprb/http/pull/482)
+  [#499](https://github.com/httprb/http/pull/499)
+  Introduce new features injection API with 2 new feaures: instrumentation
+  (compatible with ActiveSupport::Notification) and logging.
+  ([@paul])
+
+* [#473](https://github.com/httprb/http/pull/473)
+  Handle early responses.
+  ([@janko-m])
+
+* [#468](https://github.com/httprb/http/pull/468)
+  Rewind `HTTP::Request::Body#source` once `#each` is complete.
+  ([@ixti])
+
+* [#467](https://github.com/httprb/http/pull/467)
+  Drop Ruby 2.2 support.
+  ([@ixti])
+
+* [#436](https://github.com/httprb/http/pull/436)
+  Raise ConnectionError when writing to socket fails.
+  ([@janko-m])
+
+* [#438](https://github.com/httprb/http/pull/438)
+  Expose `HTTP::Request::Body#source`.
+  ([@janko-m])
+
+* [#446](https://github.com/httprb/http/pull/446)
+  Simplify setting a timeout.
+  ([@mikegee])
+
+* [#451](https://github.com/httprb/http/pull/451)
+  Reduce memory usage when reading response body.
+  ([@janko-m])
+
+* [#458](https://github.com/httprb/http/pull/458)
+  Extract HTTP::Client#build_request method.
+  ([@tycoon])
+
+* [#462](https://github.com/httprb/http/pull/462)
+  Fix HTTP::Request#headline to allow two leading slashes in path.
+  ([@scarfacedeb])
+
+* [#454](https://github.com/httprb/http/pull/454)
+  [#464](https://github.com/httprb/http/pull/464)
+  [#384](https://github.com/httprb/http/issues/384)
+  Fix #readpartial not respecting max length argument.
+  ([@janko-m], [@marshall-lee])
+
+
+## 3.3.0 (2018-04-25)
+
+This version backports some of the fixes and improvements made to development
+version of the HTTP gem:
+
+* [#458](https://github.com/httprb/http/pull/458)
+  Extract HTTP::Client#build_request method.
+  ([@tycoon])
+
+
+## 3.2.1 (2018-04-24)
+
+* [#468](https://github.com/httprb/http/pull/468)
+  Rewind `HTTP::Request::Body#source` once `#each` is complete.
+  ([@ixti])
+
+
+## 3.2.0 (2018-04-22)
+
+This version backports one change we missed to backport in previous release:
+
+* Reduce memory usage when reading response body
+  ([@janko-m])
+
+
 ## 3.1.0 (2018-04-22)
 
 This version backports some of the fixes and improvements made to development
@@ -642,3 +973,30 @@ end
 [@marshall-lee]: https://github.com/marshall-lee
 [@scarfacedeb]: https://github.com/scarfacedeb
 [@mikegee]: https://github.com/mikegee
+[@tycoon]: https://github.com/tycooon
+[@paul]: https://github.com/paul
+[@RickCSong]: https://github.com/RickCSong
+[@fxposter]: https://github.com/fxposter
+[@mamoonraja]: https://github.com/mamoonraja
+[@joshuaflanagan]: https://github.com/joshuaflanagan
+[@antonvolkoff]: https://github.com/antonvolkoff
+[@LukaszMaslej]: https://github.com/LukaszMaslej
+[@colemannugent]: https://github.com/colemannugent
+[@semenyukdmitry]: https://github.com/semenyukdmitry
+[@bryanp]: https://github.com/bryanp
+[@meanphil]: https://github.com/meanphil
+[@odinhb]: https://github.com/odinhb
+[@DannyBen]: https://github.com/DannyBen
+[@jyn514]: https://github.com/jyn514
+[@bvicenzo]: https://github.com/bvicenzo
+[@nomis]: https://github.com/nomis
+[@midnight-wonderer]: https://github.com/midnight-wonderer
+[@schwern]: https://github.com/schwern
+[@matheussilvasantos]: https://github.com/matheussilvasantos
+[@PhilCoggins]: https://github.com/PhilCoggins
+[@flosacca]: https://github.com/flosacca
+[@YuLeven]: https://github.com/YuLeven
+[@drwl]: https://github.com/drwl
+[@tkellogg]: https://github.com/tkellogg
+[@jeraki]: https://github.com/jeraki
+[@benubois]: https://github.com/benubois

data/Gemfile

@@ -5,30 +5,39 @@ ruby RUBY_VERSION
 
 gem "rake"
 
+# Ruby 3.0 does not ship it anymore.
+# TODO: We should probably refactor specs to avoid need for it.
+gem "webrick"
+
 group :development do
   gem "guard-rspec", :require => false
   gem "nokogiri",    :require => false
   gem "pry",         :require => false
 
-  platform :ruby_20 do
-    gem "pry-debugger",       :require => false
-    gem "pry-stack_explorer", :require => false
+  # RSpec formatter
+  gem "fuubar", :require => false
+
+  platform :mri do
+    gem "pry-byebug"
   end
 end
 
 group :test do
-  gem "activemodel", :require => false # Used by certificate_authority
-  gem "certificate_authority", :require => false
+  gem "certificate_authority", "~> 1.0", :require => false
 
   gem "backports"
 
-  gem "coveralls", :require => false
-  gem "simplecov", ">= 0.9"
+  gem "rubocop", "~> 1.30.0"
+  gem "rubocop-performance"
+  gem "rubocop-rake"
+  gem "rubocop-rspec"
 
-  gem "rspec", "~> 3.0"
-  gem "rspec-its"
+  gem "simplecov",      :require => false
+  gem "simplecov-lcov", :require => false
 
-  gem "rubocop", "= 0.49.1"
+  gem "rspec", "~> 3.10"
+  gem "rspec-its"
+  gem "rspec-memory"
 
   gem "yardstick"
 end

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2011-2016 Tony Arcieri, Erik Michaels-Ober, Alexey V. Zapparov, Zachary Anker
+Copyright (c) 2011-2022 Tony Arcieri, Erik Michaels-Ober, Alexey V. Zapparov, Zachary Anker
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -1,15 +1,11 @@
-# ![http.rb](https://raw.github.com/httprb/http.rb/master/logo.png)
+# ![http.rb](https://raw.github.com/httprb/http.rb/main/logo.png)
 
-[![Gem Version](https://badge.fury.io/rb/http.svg)](https://rubygems.org/gems/http)
-[![Build Status](https://secure.travis-ci.org/httprb/http.svg?branch=master)](https://travis-ci.org/httprb/http)
-[![Code Climate](https://codeclimate.com/github/httprb/http.svg?branch=master)](https://codeclimate.com/github/httprb/http)
-[![Coverage Status](https://coveralls.io/repos/httprb/http/badge.svg?branch=master)](https://coveralls.io/r/httprb/http)
-[![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/httprb/http/blob/master/LICENSE.txt)
-
-_NOTE: This is the 3.x **stable** branch.  For the 4.x **development** branch, please see:_
-
-https://github.com/httprb/http/
+[![Gem Version][gem-image]][gem-link]
+[![MIT licensed][license-image]][license-link]
+[![Build Status][build-image]][build-link]
+[![Code Climate][codeclimate-image]][codeclimate-link]
 
+[Documentation]
 
 ## About
 
@@ -17,68 +13,20 @@ HTTP (The Gem! a.k.a. http.rb) is an easy-to-use client library for making reque
 from Ruby. It uses a simple method chaining system for building requests, similar to
 Python's [Requests].
 
-Under the hood, http.rb uses [http_parser.rb], a fast HTTP parsing native
-extension based on the Node.js parser and a Java port thereof. This library
-isn't just yet another wrapper around Net::HTTP. It implements the HTTP protocol
-natively and outsources the parsing to native extensions.
-
-[requests]: http://docs.python-requests.org/en/latest/
-[http_parser.rb]: https://github.com/tmm1/http_parser.rb
-
-
-## Another Ruby HTTP library? Why should I care?
-
-There are a lot of HTTP libraries to choose from in the Ruby ecosystem.
-So why would you choose this one?
+Under the hood, http.rb uses the [llhttp] parser, a fast HTTP parsing native extension.
+This library isn't just yet another wrapper around `Net::HTTP`. It implements the HTTP
+protocol natively and outsources the parsing to native extensions.
 
-Top three reasons:
+### Why http.rb?
 
-1. **Clean API**: http.rb offers an easy-to-use API that should be a
+- **Clean API**: http.rb offers an easy-to-use API that should be a
    breath of fresh air after using something like Net::HTTP.
 
-2. **Maturity**: http.rb is one of the most mature Ruby HTTP clients, supporting
+- **Maturity**: http.rb is one of the most mature Ruby HTTP clients, supporting
    features like persistent connections and fine-grained timeouts.
 
-3. **Performance**: using native parsers and a clean, lightweight implementation,
-   http.rb achieves the best performance of any Ruby HTTP library which
-   implements the HTTP protocol in Ruby instead of C:
-
-  | HTTP client              | Time   | Implementation        |
-  |--------------------------|--------|-----------------------|
-  | curb (persistent)        | 2.519  | libcurl wrapper       |
-  | em-http-request          | 2.731  | EM + http_parser.rb   |
-  | Typhoeus                 | 2.851  | libcurl wrapper       |
-  | StreamlyFFI (persistent) | 2.853  | libcurl wrapper       |
-  | http.rb (persistent)     | 2.970  | Ruby + http_parser.rb |
-  | http.rb                  | 3.588  | Ruby + http_parser.rb |
-  | HTTParty                 | 3.931  | Net::HTTP wrapper     |
-  | Net::HTTP                | 3.959  | Pure Ruby             |
-  | Net::HTTP (persistent)   | 4.043  | Pure Ruby             |
-  | open-uri                 | 4.479  | Net::HTTP wrapper     |
-  | Excon (persistent)       | 4.618  | Pure Ruby             |
-  | Excon                    | 4.701  | Pure Ruby             |
-  | RestClient               | 26.838 | Net::HTTP wrapper     |
-
-Benchmarks performed using excon's benchmarking tool
-
-DISCLAIMER: Most benchmarks you find in READMEs are crap,
-including this one. These are out-of-date. If you care about
-performance, benchmark for yourself for your own use cases!
-
-## Help and Discussion
-
-If you need help or just want to talk about the http.rb,
-visit the http.rb Google Group:
-
-https://groups.google.com/forum/#!forum/httprb
-
-You can join by email by sending a message to:
-
-[httprb+subscribe@googlegroups.com](mailto:httprb+subscribe@googlegroups.com)
-
-If you believe you've found a bug, please report it at:
-
-https://github.com/httprb/http/issues
+- **Performance**: using native parsers and a clean, lightweight implementation,
+   http.rb achieves high performance while implementing HTTP in Ruby instead of C.
 
 
 ## Installation
@@ -108,13 +56,14 @@ require "http"
 
 ## Documentation
 
-[Please see the http.rb wiki](https://github.com/httprb/http/wiki)
+[Please see the http.rb wiki][documentation]
 for more detailed documentation and usage notes.
 
 The following API documentation is also available:
 
-* [YARD API documentation](http://www.rubydoc.info/gems/http/frames)
-* [Chainable module (all chainable methods)](http://www.rubydoc.info/gems/http/HTTP/Chainable)
+- [YARD API documentation](https://www.rubydoc.info/github/httprb/http)
+- [Chainable module (all chainable methods)](https://www.rubydoc.info/github/httprb/http/HTTP/Chainable)
+
 
 ### Basic Usage
 
@@ -141,7 +90,7 @@ We can also obtain an `HTTP::Response::Body` object for this response:
 ```
 
 The response body can be streamed with `HTTP::Response::Body#readpartial`.
-In practice, you'll want to bind the HTTP::Response::Body to a local variable
+In practice, you'll want to bind the `HTTP::Response::Body` to a local variable
 and call `#readpartial` on it repeatedly until it returns `nil`:
 
 ```ruby
@@ -158,13 +107,16 @@ and call `#readpartial` on it repeatedly until it returns `nil`:
 
 ## Supported Ruby Versions
 
-This library aims to support and is [tested against][travis] the following Ruby
-versions:
+This library aims to support and is [tested against][build-link]
+the following Ruby  versions:
 
-* Ruby 2.2.x
-* Ruby 2.3.x
-* Ruby 2.4.x
-* JRuby 9.1.x.x
+- JRuby 9.3
+- Ruby 2.6
+- Ruby 2.7
+- Ruby 3.0
+- Ruby 3.1
+- Ruby 3.2
+- Ruby 3.3
 
 If something doesn't work on one of these versions, it's a bug.
 
@@ -179,20 +131,36 @@ patches in a timely fashion. If critical issues for a particular implementation
 exist at the time of a major release, support for that Ruby version may be
 dropped.
 
-[travis]: http://travis-ci.org/httprb/http
-
 
 ## Contributing to http.rb
 
-* Fork http.rb on GitHub
-* Make your changes
-* Ensure all tests pass (`bundle exec rake`)
-* Send a pull request
-* If we like them we'll merge them
-* If we've accepted a patch, feel free to ask for commit access!
+- Fork http.rb on GitHub
+- Make your changes
+- Ensure all tests pass (`bundle exec rake`)
+- Send a pull request
+- If we like them we'll merge them
+- If we've accepted a patch, feel free to ask for commit access!
 
 
 ## Copyright
 
-Copyright (c) 2011-2018 Tony Arcieri, Alexey V. Zapparov, Erik Michaels-Ober, Zachary Anker.
+Copyright © 2011-2022 Tony Arcieri, Alexey V. Zapparov, Erik Michaels-Ober, Zachary Anker.
 See LICENSE.txt for further details.
+
+
+[//]: # (badges)
+
+[gem-image]: https://img.shields.io/gem/v/http?logo=ruby
+[gem-link]: https://rubygems.org/gems/http
+[license-image]: https://img.shields.io/badge/license-MIT-blue.svg
+[license-link]: https://github.com/httprb/http/blob/main/LICENSE.txt
+[build-image]: https://github.com/httprb/http/workflows/CI/badge.svg
+[build-link]: https://github.com/httprb/http/actions/workflows/ci.yml
+[codeclimate-image]: https://codeclimate.com/github/httprb/http.svg?branch=main
+[codeclimate-link]: https://codeclimate.com/github/httprb/http
+
+[//]: # (links)
+
+[documentation]: https://github.com/httprb/http/wiki
+[requests]: https://docs.python-requests.org/en/latest/
+[llhttp]: https://llhttp.org/

data/Rakefile

@@ -25,7 +25,7 @@ task :generate_status_codes do
 
   url = "http://www.iana.org/assignments/http-status-codes/http-status-codes.xml"
   xml = Nokogiri::XML HTTP.get url
-  arr = xml.xpath("//xmlns:record").reduce [] do |a, e|
+  arr = xml.xpath("//xmlns:record").reduce([]) do |a, e|
     code = e.xpath("xmlns:value").text.to_s
     desc = e.xpath("xmlns:description").text.to_s
 
@@ -35,7 +35,7 @@ task :generate_status_codes do
   end
 
   File.open("./lib/http/response/status/reasons.rb", "w") do |io|
-    io.puts <<-TPL.gsub(/^[ ]{6}/, "")
+    io.puts <<~TPL
       # AUTO-GENERATED FILE, DO NOT CHANGE IT MANUALLY
 
       require "delegate"
@@ -61,12 +61,4 @@ task :generate_status_codes do
   end
 end
 
-if ENV["CI"].nil?
-  task :default => %i[spec rubocop verify_measurements]
-else
-  case ENV["SUITE"]
-  when "rubocop"   then task :default => :rubocop
-  when "yardstick" then task :default => :verify_measurements
-  else                  task :default => :spec
-  end
-end
+task :default => %i[spec rubocop verify_measurements]

data/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are applied only to the most recent release.
+
+## Reporting a Vulnerability
+
+If you have discovered a security vulnerability in this project, please report
+it privately. **Do not disclose it as a public issue.** This gives us time to
+work with you to fix the issue before public exposure, reducing the chance that
+the exploit will be used before a patch is released.
+
+Please disclose it at [security advisory](https://github.com/httprb/http/security/advisories/new).
+
+This project is maintained by a team of volunteers on a reasonable-effort basis.
+As such, please give us at least 90 days to work on a fix before public exposure.