Bump http from 5.3.1 to 6.0.4

[dependabot]

Bumps http from 5.3.1 to 6.0.4.

Release notes

Sourced from http's releases.

v6.0.3

Full Changelog: httprb/http@v6.0.2...v6.0.3

v6.0.2

What's Changed

• Fix RBS syntax error by @​hakanensari in httprb/http#837

Full Changelog: httprb/http@v6.0.1...v6.0.2

v6.0.1

Full Changelog: httprb/http@v6.0.0...v6.0.1

v6.0.0

What's Changed

• Fixed incorrect link in CHANGES.md by @​daniel-sabourin in httprb/http#738
• Add Connection#finished_request? by @​c960657 in httprb/http#743
• Bump llhttp-ffi (0.5.0) by @​bryanp in httprb/http#744
• Let the instrumenter log exceptions too by @​foca in httprb/http#746
• Run CI against Ruby 3.2 by @​koheisg in httprb/http#742
• Update README.md by @​sandstrom in httprb/http#751
• Downcase Content-Type charset name by @​paul in httprb/http#753
• Add base64 to runtime dependency by @​koic in httprb/http#759
• DummyServer::Servlet#not_found requires two arguments by @​c960657 in httprb/http#761
• fix: close sockets on connection initialize timeout by @​rpeng in httprb/http#762
• Prevent CRLF injection due to broken URL normalizer by @​c960657 in httprb/http#765
• Do more conservative URL normalization by @​c960657 in httprb/http#758
• Handle responses in the reverse order from the requests by @​souk4711 in httprb/http#766
• Add support for the PURGE HTTP method. by @​renchap in httprb/http#757
• Start 6.0.0 version by @​ixti in httprb/http#768
• SECURITY.md: use private vulnerability reporting feature by @​tarcieri in httprb/http#772
• Goodbye Hash rockets... by @​ixti in httprb/http#769
• Fixes comment typo in errors.rb by @​ajsharma in httprb/http#781
• Update base64 dependency version by @​SleepingInsomniac in httprb/http#780
• Add .retriable feature to Http - Rebased by @​tomprats in httprb/http#775
• Bump rubocop to v1.61 by @​tarcieri in httprb/http#788
• Drop depenency on base64 by @​Earlopain in httprb/http#778
• Add more granularity to ConnectionError through more specific error classes by @​omkarmoghe in httprb/http#783
• Cache header normalization to reduce object allocation by @​alexcwatt in httprb/http#789
• New feature: RaiseError by @​c960657 in httprb/http#792
• Correct typo in comments for retriable method by @​hakanensari in httprb/http#794
• Remove circular require by @​hakanensari in httprb/http#795
• Native llhttp for MRI by @​sebyx07 in httprb/http#800
• feat: introduce better error for wrong mime type by @​TheBlackArroVV in httprb/http#805
• chore: Cleanup and update gemspec by @​ixti in httprb/http#806
• fix: Simplify response and headers inspection by @​ixti in httprb/http#810
• feat: Add bin/console for development convenience by @​ixti in httprb/http#811
• Add ruby 3.4 support by @​ixti in httprb/http#808
• Introduce HTTP::Session for thread-safe request building by @​sferik in httprb/http#829
• Remove Headers::Mixin and [] / []= delegators from Request and Response by @​sferik in httprb/http#831

... (truncated)

Changelog

Sourced from http's changelog.

[6.0.4] - 2026-07-14

Fixed

• On Ruby 3.4+ with TCPSocket, the redundant Timeout.timeout wrap around socket-level connect_timeout is removed. The native timeout is used alone, which avoids a slow Thread leak from Timeout::Request retention under abnormal exit paths (see #542). On Ruby 3.2/3.3 and with custom socket classes the previous Timeout.timeout wrap is preserved.

Security

• HTTP::Request::Builder#make_request_uri now rejects protocol-relative inputs (//host/path) when resolving against a configured base_uri or persistent origin. Previously such inputs were treated as network-path references per RFC 3986 §5.2 and replaced the base authority — via URI#join on the base_uri branch and via string concatenation on the persistent branch — allowing an attacker who controlled the path argument to redirect the request to an arbitrary host and leak any connection-scoped headers (HTTP.auth(...), etc.). See GHSA-r98x-p6m8-xcrv for details.

[6.0.3] - 2026-04-20

Fixed

• Ship RBS signatures for downstream consumers. Previously only sig/http.rbs was packaged, but it referenced LLHttp::Parser and LLHttp::Delegate (defined only in the unshipped sig/deps.rbs), causing Cannot find type LLHttp::Delegate errors in Steep when loading library "http". Public LLHttp stubs are now shipped in sig/llhttp.rbs, and sig/manifest.yaml declares stdlib dependencies so consumers don't need to re-list them.

[6.0.2] - 2026-03-20

Fixed

• Fix RBS syntax error.

Changed

• Improve gem push workflow security and reliability.

[6.0.1] - 2026-03-16

Changed

• Exclude test files from gem package, reducing gem size by 50% (from 175 KB to 87 KB).

[6.0.0] - 2026-03-16

... (truncated)

Commits

• 942b1b3 Exclude non-runtime Gemfile groups in gem push workflow
• 76aa76c Update v6.0.4 release date and link CHANGELOG version headers
• 6d4df4d Update SimpleCov to version 1.0
• 1c7e992 Fix typos in code comments
• 9981d0c Release v6.0.4
• 45a8993 Follow-ups to httprb/http#840
• 79ecf7e Fix tests
• 7371ad8 Skip Timeout.timeout wrap when TCPSocket native connect_timeout is available
• 1a07d7a Polish GHSA-r98x-p6m8-xcrv fix
• c7517ab Reject protocol-relative inputs in base_uri / persistent resolution
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)