See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Summary by cubic

Addresses high‑severity npm advisories and hardens HTTP, cookie, and brace‑expansion handling in built artifacts. Previously headers/content-type were coerced without checks and partial-range retries didn’t verify Content‑Length; now inputs are validated and unsafe values fail fast.

• Dependencies: bumps brace-expansion 5.0.8→5.0.9, undici 6.27.0→6.28.0, js-yaml 3.15.0→3.15.1; refreshes .licenses/ and rebuilds dist/.

• Behavior changes:

  • Header validation: rejects non‑primitive or unsafe coercions and invalid header values; Blob content-type is validated. Requests now throw on invalid headers instead of silently coercing.
  • Range retries: validates Content-Length for partial responses; mismatches abort with RequestRetryError.
  • Cookies: stricter RFC‑aligned domain/path checks and validation of cookie name/value during stringify; non‑ASCII and malformed domains are rejected.
  • Brace expansion: enforces maxLength across expansions and does not count empty values toward max, which may reduce generated results for patterns like {a,,b}.

• Migration actions:

  • Ensure all custom headers (including content-type) are plain strings/arrays of strings with valid ASCII values; remove objects/functions or values that rely on implicit coercion.
  • If relying on ranged downloads, verify servers return correct Content-Length for the requested range.
  • Fix any cookie domains/paths that don’t meet RFC constraints.

Written for commit 9191ea1. Summary will update on new commits.