Update dependency req to ~> 0.7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
req (source)	prod	minor	~> 0.5 → ~> 0.7

---

Release Notes

wojtekmach/req (req)

v0.7.4

Compare Source

• put_params: Allow explicit duplicates.

  in v0.7.0 we made this change:

  Overwrite existing query params instead of appending.

  This was a regression for legitimate use cases where some servers require duplicate params.
  Now we allow explicit duplicates but otherwise overwrite any previously set:

    Req.get!("?id=1&foo=bar", params: [id: 2, id: 3]) # ?id=2&id=3&foo=bar
  

  • put_path_params: Do not overwrite redirect target.

v0.7.3

Compare Source

v0.7.2

Compare Source

• [encode_body]: Bring back form_multipart: [{string_name, value}].
  • [put_aws_sigv4]: Fix AWS SigV4 compatibility with Supabase Storage S3.

v0.7.1

Compare Source

• Deprecate cache: true/[cache] step. It will be removed in Req v0.8. I plan a comprehensive cache solution for Req v1.0+.

v0.7.0

Compare Source

• [Req]: Add Req.new(req, options).

  • [Req]: Treat URL userinfo as Basic Authentication.

  • [Req], [Req.Request]: Deprecate adapter: fun in favour of adapter: mod.

  • [Req.Request]: (BREAKING CHANGE) Remove current_request_steps field.

  • [Req.Request]: Fix redacting remaining auth values.

  • (BREAKING CHANGE) Replace run_finch step with [Req.Finch] adapter module.

  • (BREAKING CHANGE) Replace put_plug and run_plug steps with [Req.Plug] adapter module.

  • [Req.Finch]: Support finch: options.

  • [Req.Finch]: Support :request_timeout.

  • [Req.Finch]: Fix handling duplicate response headers.

  • [Req.Finch]: Deprecate finch: name in favour of finch: [name: name].

  • [Req.Finch]: Deprecate pool_timeout: value in favour of finch: [pool_timeout: value].

  • [Req.Finch]: Deprecate pool_max_idle_time: value in favour of finch: [pool_max_idle_time: value].

  • [Req.Finch]: Deprecate :finch_request.

  • [Req.Plug]: Handle individual response body chunks.

  • [Req.Plug]: Support non-UTF8 request params.

  • [Req.Plug]: Put original request private data in conn.private.

  • [Req.Test]: Allow descendant processes.

  • [Req.Test]: Fix concurrent plug fetches immediately after switching to shared mode.

  • [compress_body]: Do nothing when request content-encoding is already set.

  • [compress_body]: Update multipart boundary when re-running the step.

  • [compressed], [decode_body]: Replace optional ezstd dependency with Erlang/OTP 28+
    built-in :zstd.

  • [decode_body]: Deprecate :decode_json in favour of setting a custom JSON
    decoder via :decoders:

before:

    Req.get!(url, decode_json: [keys: :atoms])

after:

    Req.get!(url, decoders: [json: &Jason.decode(&1, keys: :atoms)])

• [encode_body]: (BREAKING CHANGE) Automatically change GET to POST when request body is set.

• [put_aws_sigv4]: Exclude accept-encoding, x-amzn-trace-id, and
  hop-by-hop headers from the signature.

• [put_aws_sigv4]: Correctly sign duplicate header values.

• [put_params]: (BREAKING CHANGE) Overwrite existing query params instead of appending.

• [put_path_params]: Preserve the path template when re-running the step.

• [redirect]: Strip userinfo from redirect locations and log a warning.

  Previously, redirecting to a URL with userinfo (e.g. http://user:pass@host)
  kept the userinfo in the request URL (without converting it to auth). It is
  now dropped so credentials supplied by the redirecting server aren't sent.

• [redirect]: Clear the request body, body options, and content headers when
  changing POST to GET after a 301, 302, or 303 response.

• [retry]: Use jitter by default.

• [retry]: Honor configured :retry_delay over Retry-After.

• (BREAKING CHANGE) Remove deprecated follow_redirects step.

• (BREAKING CHANGE) Remove deprecated output step.

• Require Elixir 1.15 or later.

v0.6.3

Compare Source

• [Req.Test]: Fix race condition

v0.6.2

Compare Source

• Use finch ~> 0.21.

v0.6.1

Compare Source

• compressed, decompress_body: Disable automatic decompression

  Decompression is now opt-in by setting compressed: true.

v0.6.0

Compare Source

• [encode_body]: Security fix for :form_multipart header injection
  (GHSA-px9f-whj3-246m).

  The multipart encoder interpolated the per-part name, filename, and
  content_type into the part headers without escaping, so an
  attacker-controlled value could inject extra headers or smuggle additional
  parts into the request. These values are now escaped per RFC 7578 / WHATWG
  form-data (", CR, and LF are percent-encoded).

  Thanks to @​PJUllrich for reporting it.

  • decode_body: Drop automatic zip/tar/tgz/gz/zst/csv decoding,
    (GHSA-655f-mp8p-96gv).

    Req previously auto-decoded archive and compressed response bodies (zip,
    tar, tgz, gz, zst, and csv) based on the server-supplied
    content-type, materialising the full decompressed contents in memory with
    no size cap. An attacker-controlled (or redirect-reachable) endpoint could
    return a tiny "decompression bomb" that expanded to gigabytes and exhausted
    the node's memory.

    Now only JSON is decoded by default. Other formats are opt-in via the new
    :decoders option, which defaults to [:json, :json_api]. Setting it
    replaces the default (include :json to keep JSON decoding), and false
    disables all decoding:

opt into archives (only for endpoints you trust):

    Req.get!(url, decoders: [:json, :zip])

**Note**: The decoded zip/tar is still list of
`{filename :: charlist(), contents :: binary}` tuples.
In the future release, this will be list of
`{filename :: binary(), contents :: binary()}` tuples.

While automatic CSV decoding wasn't a security issue, the behaviour based
on presence/absence of `nimble_csv` dependency was suprising. CSV support
is still built-in but need to be enabled with `decoders: [:csv]`.

Custom decoders are supported via `{format, codec}` tuples, where `codec` is
a module exporting `decode/1` or a 1-arity function returning an `:ok`/`:error`
tuple, for example:

    Req.get!(url, decoders: [:json, ics: &{:ok, ICal.from_ics(&1)}])

Thanks to @PJUllrich for reporting it.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: mix.lock

/usr/local/bin/mix: line 18: /opt/containerbase/tools/elixir/1.20.4/bin/mix: No such file or directory