lkrequest 0.2.2__tar.gz → 0.2.3__tar.gz

{lkrequest-0.2.2 → lkrequest-0.2.3}/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All important changes to this project will be documented in this file.
 
+## lkrequest-py 0.2.3
+
+Adds the Chrome 155 fingerprint and picks up upstream's switch of the default
+fingerprint to it, plus upstream hardening of length fields read off the wire.
+Sessions can now be closed, and a session whose event hooks refer back to its
+owner is reclaimed instead of living for good. HTTP/2 requests abandoned after
+they were sent are now reset instead of holding their stream open, a WebSocket
+can send and close while another task is receiving, and upstream's pass over TLS,
+ECH and QUIC handshake behaviour is picked up, along with fixes to what a
+redirect carries along and to how a few responses are read. Several things are
+worth reading before upgrading, because they change the wire or what a call
+returns: a client built without a TLS or HTTP/2 profile now presents Chrome 155
+instead of Chrome 144; Firefox 156 and the Chrome presets differ in their HTTP/2
+stream numbering and dependencies; a redirect to another origin no longer carries
+the client's default `Authorization`, `Cookie` and `Host` headers along; a
+`Set-Cookie` with an empty `Max-Age` gives a session cookie instead of one that
+lasts until the year 9999; a `deflate` body that ends early is now an error; and
+`ProxyPool.acquire()` now waits, rather than answering "no proxy", while every
+proxy is cooling down.
+
+### 🚀 Features
+- **Closing A Session** — Added `Session.close()` and `Session.closed` on both session classes, and context-manager support: `with` on `BlockingSession`, `async with` on `Session`. Closing aborts the pooled connections, abandons the requests still in flight — they raise `RuntimeError("Session was closed while the request was in flight")` instead of carrying on — drops the event hooks and the callbacks of the session's own middleware, and makes the session refuse further requests and new hooks with `RuntimeError("Session is closed")`. Closing twice is harmless and cookies stay readable. Until now the only way to let go of a session's connections was `pool_clear()`, which empties the pool but leaves requests in flight running and the session usable; it is unchanged. `Client` has no counterpart, since it owns no connections — those belong to its sessions. The README gained a "Session lifecycle and memory" section: reuse a session rather than creating one per request, the default pool has no upper limit and drops an idle connection after 300 seconds (only when the session is next used), and the resident size of a process does not necessarily shrink when memory is freed.
+- **Chrome 155 Fingerprint** — Added `Client.chrome_155()` / `BlockingClient.chrome_155()`, the `"chrome_155"` name for `tls_profile=` / `h2_profile=` / `quic_profile=`, and `TlsProfile.chrome_155()`, `TlsProfile.chrome_155_quic()`, `H2Profile.chrome_155()`, `QuicProfile.chrome_155()`. Captured from Chrome 155.0.8059.40 on Windows: the TCP and QUIC ClientHellos, H2, the QUIC transport parameters and the Initial-packet generation rules all match Chrome 154. What differs is how the QUIC profile behaves once connected: `QuicProfile.chrome_155()` switches on 16 booleans that Chrome 154's lacks — Chrome 155's HTTP/3 request handling (among them a PRIORITY_UPDATE sent for each request stream before its HEADERS) and its loss-recovery and packetization timing — and nothing else in it moves. Unlike the Chrome 154 capture, this one completed an HTTP/3 navigation, so the H3 SETTINGS were observed directly rather than carried over — and matched the inherited ones.
+- **The Default Fingerprint Is Now Chrome 155** — inherited from upstream, and visible on the wire. `Client()` / `BlockingClient()` without `tls_profile=` used Chrome 144's TLS fingerprint and now uses Chrome 155's; without `h2_profile=`, the same for HTTP/2. Nothing else about the default changes: no TCP fingerprint, no QUIC profile, no default headers. The preset methods and named profiles are unaffected. Pass `tls_profile="chrome_144", h2_profile="chrome_144"` to keep the previous default.
+- **Per-Request HTTP/2 Priority Weight** — Added `h2_priority_weight=` (0–255) to every request method on both session classes. It sets the weight in the legacy priority field of the request's HTTP/2 HEADERS frame — on the request that opens a connection as on any other — independently of the `priority` header, the stream dependency and the exclusive flag; the next request goes back to the weight its profile sends. A profile whose HEADERS carry no legacy priority field (Safari 26) still sends none, and HTTP/1.1 and HTTP/3 are not affected. It is what reproduces Firefox 156's favicon request: `priority=RequestPriority(6, False)` together with `h2_priority_weight=21`. A value outside 0–255 is rejected before anything is sent.
+- **HTTP/2 Stream Numbering And Dependencies** — Added `H2Profile(initial_stream_id=...)` and a read-only `initial_stream_id`: the ID of the first request stream a connection opens, an odd number up to 2³¹ − 1 (`ValueError` otherwise; a profile saved without it keeps starting at 1). Added `"priority_chain"` as a `PriorityConfig(stream_dep_policy=...)` value. Two presets change on the wire as a result. Firefox 156 now opens its first request on stream 3, as its capture shows, and sends navigation HEADERS with weight 41 where it sent 42. The Chrome presets now point each stream's dependency at the newest still-active stream of equal or higher priority, dropping finished and reset streams, instead of at the stream opened just before it: `PriorityConfig.chrome().stream_dep_policy` is `"priority_chain"` where it was `"chain"`. `"chain"` itself behaves as it did.
+- **HTTP/3 Protocol-Error Retries** — Added `H3RetryMode` and `session(h3_retry_mode=...)` on both clients. `H3RetryMode.Safe`, the default, keeps the behaviour of earlier releases. `H3RetryMode.Chrome155ProtocolErrors` retries HTTP/3 stream and connection protocol errors and stateless resets up to twice per redirect hop, as long as no response headers have arrived, which is what Chrome 155 does. That replays a finite buffered request, **including a POST the server may already have processed**. Streaming uploads are not retried, a request sent with `idempotency=Idempotency.NotIdempotent` opts out, and a request that is not HTTP/3-only needs a protocol policy that allows falling back to TCP. It adds no status-code retries and leaves 0-RTT eligibility alone. Without the `quic-h3` build feature only `Safe` is accepted.
+
+### 🐞 Fixes
+- **Event Hooks No Longer Keep Their Session Alive** — a hook that referred back to the object holding the session — `session.on_response(self.log)` in a class that stores `self.session`, or a closure over the session — made a reference cycle that Python's collector could not see, because the hooks sat in a Rust `Vec` behind an `Arc`. The session, its connection pool and everything the owner held then stayed alive for the life of the process: on the order of 7 KB per session in a loop that created one per request, plus its open connection for as long as the server kept it open. The hooks are now kept in Python lists and the session classes report them to the collector, so such a cycle is reclaimed. The callbacks of **middleware** are still held where the collector cannot see them: those of a session's own middleware are released by `Session.close()`, and a callback of `Client(middleware=...)` that refers back to its own client keeps that client alive, so create such a client once rather than per request.
+- **Overflow-Checked Length Fields** — inherited from upstream. Lengths declared in HPACK, QUIC transport parameters and MASQUE capsules were added to buffer offsets without overflow checks, and on a 32-bit target a declared length of 4 GiB or more was truncated outright. They are now compared against the bytes actually present. The one place this surfaces in Python is `H2Profile.from_h2_frames()`: a header block whose declared lengths run past the frame now ends the pseudo-header scan at the last field that fits, instead of relying on unchecked arithmetic.
+- **Abandoned HTTP/2 Requests Are Reset** — inherited from upstream. A request the caller gave up on after it was sent — a timeout, a cancelled task, a dropped streaming response — was never reset with `RST_STREAM`, so its stream stayed open on the server for as long as the connection did. On a shared session that used up the server's concurrent-stream limit (typically 100): later requests then queued behind it without ever being sent, every one of them timed out, and the pool still counted the connection as healthy. A dropped session also kept its connections open for another 30 seconds, waiting out the abandoned streams. The client now sends `RST_STREAM(CANCEL)` for such a request and frees its slot, and a dropped session closes its connections at once. HTTP/1.1 was never affected.
+- **WebSocket Send And Close No Longer Wait For `recv()`** — a connection held one lock across every operation, so while one task was waiting in `recv()`, `send_text()`, `send_binary()` and `close()` from any other task or thread waited too. Against a server that only speaks when spoken to that is a deadlock: the message `recv()` is waiting for is the one `send_text()` cannot send. Receiving, sending and closing now proceed independently, and closing hands a `recv()` that is waiting the closing handshake. As before, once a connection is closed every operation raises `RuntimeError("WebSocket is closed")` and iterating it ends.
+- **WebSocket Upgrade Request Line And Host** — inherited from upstream. The HTTP/1.1 upgrade request went out in absolute-form (`GET https://host/path`), which only a proxy is meant to receive, and its `Host` header dropped the port. A server that routes on the path never matched it, and a `wss://` endpoint on any port but 443 was addressed as if it were on 443. The request line is now the path and query, and `Host` carries the port whenever it is not the scheme's default.
+- **`ProxyPool.acquire()` Does Not Answer With "No Proxy" While Proxies Cool Down** — inherited from upstream. When every proxy of a pool was cooling down, a pool could answer with no proxy at all, which a caller takes for a direct connection and so exposes its own address. A pool that has proxies now waits for one to recover; bound the wait with `asyncio.wait_for` if you need to. Only a pool created with an empty list returns `""`.
+- **First Request On A New HTTP/2 Connection Gets Its Priority** — inherited from upstream. The request that opens a connection now resolves its priority from the same request and client headers, and the same fetch-destination rules, as a request sent on a reused connection, so a navigation keeps its navigation priority on a fresh connection too.
+- **TLS, ECH And QUIC Handshake Corrections** — inherited from upstream: a large pass over how the handshake behaves, much of it visible on the wire. The client now refuses, with the alert Chromium or NSS sends, a server hello a browser would refuse (a version, cipher suite, compression method or ALPN protocol it never offered; a malformed or padded extension; a wrong session-ID echo; falling back to TLS 1.2 after a HelloRetryRequest), and does so before deriving any key. A TLS 1.3 handshake queues its compatibility ChangeCipherSpec until the client's final flight, as Chromium and NSS do, instead of sending it straight after the server hello. After a HelloRetryRequest the client drops pre-shared keys whose hash no longer matches, keeps the first ClientHello's trust-anchor order, and carries the cookie into the inner ClientHello of a real ECH handshake. ECH rejection and acceptance are handled across HelloRetryRequest and TLS 1.2 (an encrypted `ech_required` after Finished, and no usable connection or ticket), and over QUIC as `CRYPTO_ERROR(ech_required)`. ECH GREASE is generated the way each browser does it: an X25519 key pair for the `enc` field on Chromium, and Firefox's per-handshake choice between AES-128-GCM and ChaCha20-Poly1305.
+- **More Requests Count As Safe To Replay** — inherited from upstream. A request that an HTTP/2 GOAWAY cut off before any response headers arrived, or that HTTP/3 rejected (`H3_REQUEST_REJECTED`) before them, was never processed by the server and is now treated as safe to replay automatically.
+- **`dns_timeout` Covers Every Lookup** — inherited from upstream. `Client(dns_timeout=...)` is now a per-query deadline for each DNS query the client makes: address lookups and HTTPS-record lookups, and custom resolvers as well.
+- **A Redirect No Longer Resends The Client's Default Credentials To Another Origin** — inherited from upstream. The headers of `Client(default_headers=...)` were applied again on every hop of a redirect chain, so a default `Authorization`, `Cookie` or `Host` went along to the destination of a redirect to another origin, although the same headers set on the request itself were dropped there. Defaults are now filtered hop by hop the way a request's own headers are. A redirect that leaves the origin (scheme, host or port) no longer carries a default `Authorization`, `Cookie` or `Host`; one from https to http drops a default `Referer`; one that turns a POST into a GET drops the default `Content-Type`, `Content-Encoding`, `Content-Language`, `Content-Location` and `Content-Length`. A redirect within the origin keeps them, going back to the first origin does not bring back what an earlier hop dropped, and the client's defaults are untouched for the next request.
+- **A `Location` Written In Raw UTF-8 Is Followed** — inherited from upstream. A redirect whose `Location` held raw UTF-8 bytes (`/café`) was reported as a response without a `Location` and failed with "redirect response missing Location header". The value is now decoded as UTF-8, resolved against the current URL and percent-encoded on the way out, exactly as a percent-encoded `Location` is. One that is not valid UTF-8 raises `RequestError` saying so.
+- **An Empty `Max-Age` In `Set-Cookie` Is Ignored** — inherited from upstream. `Set-Cookie: sid=abc; Max-Age=` was read as a `Max-Age` too large to represent, so the cookie was stored with a deadline in the year 9999 instead of as a session cookie. Because `Max-Age` outranks `Expires`, a response that tried to delete the cookie with `Max-Age=; Expires=<a date in the past>` left it in place. `Session.set_cookie_raw()` behaved the same way. An empty `Max-Age` now counts as absent; the other attributes, and the last valid `Max-Age` when several are given, are read as before.
+- **`deflate` Bodies: Truncation And A Raw Stream That Looks Like zlib** — inherited from upstream. A `deflate` body that ended before its stream did came back as a shorter body without any error, for buffered and streaming responses alike; it is now a `RequestError`. RFC 9110 defines `deflate` as zlib, but some servers send a raw deflate stream, which the client used to tell apart by the first two bytes. A raw stream that begins with a stored block can start with `0x78 0x9c`, which reads as a valid zlib header, and was rejected as corrupt. Buffered and streaming responses now share one detector: zlib is tried first, and a raw stream is accepted instead only when zlib fails before producing any output and the bytes are the start of a valid stored block. A zlib stream with a bad checksum is still an error.
+- **A Proxy's Refusal After The Authentication Retry Keeps Its Status** — inherited from upstream. When a proxy answered a `CONNECT` with 407 and refused the retry that carried credentials, the `ProxyError` always said the authentication had failed, even for a 503 or a 402. A second 407 is still reported as an authentication failure; any other status is now reported as the tunnel being refused, with that status in the message.
+
 ## lkrequest-py 0.2.2
 
 Adds streaming uploads, the Chrome 153, Chrome 154 and Firefox 156 fingerprints,