libsoup3-3.8.0

[Bruce Dubbs]

New minor version.

[Joe Locash]

Changes in libsoup from 3.7.3 to 3.8.0:

* Harden authentication:
    * Check `nonce` validity in Digest authentication (CVE-2026-3099) [Milan Crha]
    * Do not send cached proxy credentials after a redirect to a different origin [Milan Crha]
* Harden multipart handling:
    * Fix an out-of-bounds read when less data than the boundary is buffered (CVE-2026-66337) [Patrick Griffis]
    * Limit the length of part headers [Milan Crha]
    * Fix a leak of the current part's headers [Patrick Griffis]
* Prevent request smuggling in the server:
    * Close the connection after an early response to `Expect: 100-continue` [Patrick Griffis]
    * Reject `Host` headers containing URI delimiters [Patrick Griffis]
    * Require chunk-size to begin with a hex digit [Samuel Dainard]
* http2:
    * Fix skipping over multiple buffered chunks of a response body [Milan Crha]
    * Fix a `GCancellable` leak [Michael Catanzaro]
* Fix the build on platforms without `dlfcn.h` [Yegor Yefremov]
* Update Belarusian translation [Vasil Pupkin]
* Update Slovenian translation [Martin]

Changes in libsoup from 3.7.2 to 3.7.3:

* Add `soup_message_set_compression_dictionary_id()` and `soup_message_get_compression_dictionary_id()` to send the `Dictionary-ID` header alongside `Available-Dictionary` [Patrick Griffis]
* Add `soup_websocket_extension_process_incoming_message_with_limit()` so extensions can bound how much they decompress [Zayd Rajab]
* Harden WebSocket handling:
    * Bound decompressed message size during inflation (CVE-2026-15709) [Zayd Rajab]
    * Reject oversized control frames (CVE-2026-15711) [Zayd Rajab]
    * Cap incoming frame payloads, message reassembly, and outgoing frames at what the underlying buffer can hold [Patrick Griffis]
    * Bound outgoing permessage-deflate buffer growth [Patrick Griffis]
    * Cap the number of queued unsolicited pongs [Patrick Griffis]
    * Emit `SoupWebsocketConnection::pong` with a `GBytes`, as declared [Patrick Griffis]
    * Store accepted WebSocket extensions per message rather than per handler [Felix Nilsson]
* Harden authentication and caching:
    * Do not send `Proxy-Authorization` through an established CONNECT tunnel (CVE-2026-66339) [Patrick Griffis]
    * Scope cached proxy credentials to the proxy they came from (CVE-2026-12547) [Patrick Griffis]
    * Reject caching authenticated responses in shared caches (CVE-2026-15713) [Milan Crha]
* Tighten HTTP parsing and validation:
    * Reject CRLF injection in the HTTP method (CVE-2026-3633) [Milan Crha, Patrick Griffis]
    * Fix `Range` parsing overflows and coalescing cost, and validate `Content-Range` when parsing it [Patrick Griffis]
    * Keep duplicate `Content-Length` headers when they are identical [Patrick Griffis]
    * Fix an out-of-bounds read in case of an excessively long multipart boundary [Mike Gorse]
    * Do not treat base64 data URI content as a NUL-terminated string [Patrick Griffis]
* http2:
    * Never send more body bytes than nghttp2 requested (CVE-2026-85534) [Patrick Griffis]
    * Keep the message alive across `io_run_until()` in `run_until_read()` [Patrick Griffis]
    * Do not assume that `GOAWAY` opaque data is NUL-terminated [Mike Gorse]
* server: Report the resource length in 416 responses [Patrick Griffis]
* session: Do not send a message cancelled while being queued [Patrick Griffis]
* cookie: Annotate constants' values [Maximiliano Sandoval]

Changes in libsoup from 3.7.1 to 3.7.2:

* Add support for compression dictionaries:
  * Support the dcb and dcz encodings [Patrick Griffis]
  * Add new `soup_message_set_compression_dictionary_hash()`, `SoupMessage::request-compression-dictionary`, and `SoupCompressionDictionaryRequest` APIs [Patrick Griffis]
* Remove color codes from http2 debug logs [Patrick Griffis]
* Add missing autoptr defines for `SoupMessageBody` [Patrick Griffis]
* http2: Fix content-sniffer running while message is paused [Patrick Griffis]
* http2: Consume buffered response body before cancel [Dominik Schnitzer]
* http2: Fix requeuing failed messages when connection is not reusable [Pablo Saavedra]
* soup-body-input-stream: Limit buffer read to the received content [Milan Crha]

Changes in libsoup from 3.6.6 to 3.7.1:

* Add support for the `zstd` content encoding [Patrick Griffis]
* Add `SoupWebsocketConnection:max-total-message-size` to limit incoming WebSocket message sizes [Ignacio Casal Quinteiro, Michael Catanzaro]
* Harden cookie and cookie jar handling:
    * Ignore cookies impersonating prefixed cookies, as well as cookies with empty names and values [Patrick Griffis]
    * Annotate `SoupCookieJar::changed` arguments as nullable [Corentin Noël]
    * Add `SoupCookieJarDB:max-size` to limit the file size of the database [Filipe Norte]
    * Expose `SoupCookieJarDB` construction failures via `GInitable`, and rename `SoupCookieJarDBError` to `SoupCookieJarError` [Patrick Griffis]
    * Avoid sending cookies to HTTP proxies for HTTPS requests [Carlos Garcia Campos]
* Tighten HTTP parsing and validation:
    * Reject multiple `Content-Length` headers and tighten `Content-Length` validation [Carlos Garcia Campos, Samuel Dainard]
* websocket: Fix an out-of-bounds read when reading an unmasked frame, and make `Sec-WebSocket-Protocol` matching case-sensitive [Mike Gorse, Diego Pino Garcia]
* http2: Fix graceful `GOAWAY` handling and several crashes and read/write edge cases [Carlos Alberto Lopez Perez, Eugene Mutavchi, Carlos Garcia Campos, Patrick Griffis, Michael Catanzaro]
* auth: Drop unused automatic NTLM auth and reject excessively long NTLM passwords [Michael Catanzaro, Mike Gorse]
* http1: Improve chunked request parsing [Carlos Garcia Campos]

Fixed at 012dacd105. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-054 has been issued.