0.10.0 Release

[liquidsec]

Summary

• Cookies across redirects (apply cookies from redirect hops to the hops that follow #75): a cookie set by one hop is sent on the hops that follow it within the same request, which is what lets a login or bot-check page resolve instead of looping. What a chain collects lives for that one request, so nothing carries between requests and a batch of 500 URLs stays 500 independent results. Selection follows RFC 6265 for Domain, Path and Secure, plus a Public Suffix List check so Domain=com or Domain=github.io can't carry a cookie onto an unrelated host, and a cookie may only widen within one registrable domain. A cookie set in the request's own Cookie header always wins over one the chain sets under the same name. What a chain will hold is capped at 4096 bytes per cookie, 50 cookies and 8KB total. redirect_cookies=False, or --no-redirect-cookies, reverts to the old behavior.
• Responses lost to decompression (Fix responses lost to decompression, add alpn_protocols to request() #78): a response declaring Content-Encoding on an empty body was thrown away entirely, which hit every bodyless redirect, HEAD, and 304, since we ask for gzip, deflate, br on every request. A body that won't decode now comes back undecoded with Response.decode_error saying why, rather than costing the whole response. Also: zlib-wrapped deflate (RFC 1950) is accepted, which is what the header is specified as and what IIS and several CDN fronts send; every Content-Encoding line is undone rather than just the first; and a stack that only partly comes off keeps the deepest result instead of reverting to the bytes that arrived.
• max_body_size now bounds both directions: it stops the read instead of buffering the whole body and slicing it, so a target can't answer with an unbounded body regardless of the cap, and it bounds decompressed output, so a small response can't inflate past it.
• alpn_protocols on request(): pick the ALPN offer per request. Requests using resolve_ip now speak HTTP/2 when ALPN negotiates it, instead of negotiating h2 and then sending HTTP/1.1 over it. Defaults are unchanged, since the offer is part of the client's TLS fingerprint: h2 then http/1.1 on the pooled path, http/1.1 alone on the resolve_ip / request_target path.
• New dependency: psl for the Public Suffix List, compiled in, so no network and no runtime lookup. About 823KB of .so, 297KB in a wheel.
• CI: Rust toolchain pinned in rust-toolchain.toml (1.97.1). A new stable's clippy had been failing every open PR at once, including PRs that touched nothing but a Python dev dependency, because the workflow lints with -D warnings. Pinning also means local cargo clippy matches CI.
• Dependency bumps: hyper 1.11.0, http 1.5.0, http-body-util 0.1.5, tokio 1.53.1, futures 0.3.34, serde 1.0.229, serde_json 1.0.151, clap 4.6.6, thiserror 2.0.20, bytes 1.12.1, ruff 0.16.2, actions/setup-python.
• Version: 0.9.0 -> 0.10.0 (Cargo.toml, pyproject.toml, Cargo.lock).
• Tests: 209 Rust unit tests, 41 Rust integration tests, 161 Python tests.

The cookie entries in CHANGELOG.md were filed under ## Unreleased while #75 was in flight. #87 folds them into the 0.10.0 section, and wants merging before this does.