http full changelog

← http releases CHANGELOG.md on GitHub

2.7.x

2.7.0

Sep 20, 2026

• 1198a524 Security: Added the scopeRedirects plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including localhost services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.

  {
    "plugins": {
      "http": {
        "scopeRedirects": true
      }
    }
  }

  It is opt-in because a redirect to a URL that is not allowed by the scope now fails with url not allowed on the configured scope instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. This will become the default in v3.

  Note that tauri_plugin_http::init() now returns TauriPlugin<R, Option<Config>> instead of TauriPlugin<R>.

2.6.x

2.6.1

Sep 16, 2026

• a21555dd (#3566 by @followdarko) Fix unhandled promise rejections on every fetch teardown: the request/body cleanup commands were fired as floating promises, and releasing an already-released resource rejects with The resource id N is invalid.. dropBody is now idempotent and both cleanup calls handle their own rejection.

2.6.0

Aug 31, 2026

• f8053e65 (#3527 by @Legend-Master) Documented Cargo feature flags in each plugin's crate-level documentation.
• 19fb3926 (#3528 by @Legend-Master) Added system-proxy feature to replace the old macos-system-configuration feature flag to match the new reqwest API.

Dependencies

• Upgraded to fs-js@2.5.2

2.5.x

2.5.9

May 2, 2026

Dependencies

• Upgraded to fs-js@2.5.1

2.5.8

Apr 4, 2026

• 29712892 (#3252 by @NVolcz) Correct Response header initialization to support cloning and ensure Set-Cookie visibility.

Dependencies

• Upgraded to fs-js@2.5.0

2.5.7

Feb 3, 2026

• 61e9b0ab (#3228) Cleanup resource when the returned ReadableStream.cancel is called to avoid memory leaks

2.5.6

Jan 14, 2026

• b1dbee2c (#3210 by @FabianLars) Fixed an issue that caused the Origin header to always be null on macOS, iOS and Linux.

2.5.5

Jan 8, 2026

• e8915f17 (#2562 by @amrbashir) Fix aborting a request in the middle of a streaming response.

Dependencies

• Upgraded to fs-js@2.4.5

2.5.4

Oct 27, 2025

• 93426f85 Fixed an issue that caused docs.rs builds to fail. No user facing changes.

Dependencies

• Upgraded to fs-js@2.4.4

2.5.3

Oct 26, 2025

Dependencies

• Upgraded to fs-js@2.4.3

2.5.2

Aug 20, 2025

Dependencies

• Upgraded to fs-js@2.4.2

2.5.1

Jul 20, 2025

Dependencies

• Upgraded to fs-js@2.4.1

2.5.0

Jun 25, 2025

• f209b2f2 (#2804 by @renovate) Updated tauri to 2.6

Dependencies

• Upgraded to fs-js@2.4.0

2.4.x

2.4.4

May 20, 2025

• ff384cba (#2636 by @asomethings) Properly handle responses with status code 204.

Dependencies

• Upgraded to fs-js@2.3.0

2.4.3

Apr 2, 2025

• 37c0477a (#2561) Add zstd cargo feature flag to enable reqwest/zstd flag.
• 9ebbfb2e (#1978) Persist cookies to disk and load it on next app start.

Dependencies

• Upgraded to fs-js@2.2.1

2.4.2

Mar 17, 2025

• a15eedf3 (#2535 by @amrbashir) Fix fetch occasionally throwing an error due to trying to close the underline stream twice.

2.4.1

Mar 15, 2025

• d3183aa9 (#2522 by @adrieljss) Fix fetch blocking until the whole response is read even if it was a streaming response.

2.4.0

Mar 10, 2025

• cb38f54f (#2479 by @adrieljss) Add stream support for HTTP stream responses.

2.3.x

2.3.0

Jan 27, 2025

• 10513649 (#2204 by @RickeyWard) Add dangerous-settings feature flag and new JS danger option to disable tls hostname/certificate validation.

2.2.x

2.2.0

Dec 9, 2024

• 3a79266b (#2173 by @FabianLars) Bumped all plugins to v2.2.0. From now, the versions for the Rust and JavaScript packages of each plugin will be in sync with each other.

Dependencies

• Upgraded to fs@2.2.0

2.0.x

2.0.4

Dec 2, 2024

• a3b553dd (#2079 by @amrbashir) Add tracing logs for requestes and responses behind tracing feature flag.

Dependencies

• Upgraded to fs@2.1.0

2.0.3

Oct 21, 2024

Dependencies

• Upgraded to fs@2.0.3

2.0.2

Dec 9, 2024

Dependencies

• Upgraded to fs-js@2.0.4

2.0.1

Oct 20, 2024

• cfd48b3b (#1941 by @Nipsuli) Allow skipping sending Origin header in HTTP requests by setting Origin header to an empty string when calling fetch.

• 9b2840db (#1884 by @amrbashir) Retain headers order.

• a1a82208 (#1873 by @lucasfernog) Downgrade MSRV to 1.77.2 to support Windows 7.

Dependencies

• Upgraded to fs@2.0.1

2.0.0

Oct 2, 2024

• e2c4dfb6 Update to tauri v2 stable release.

Dependencies

• Upgraded to fs@2.0.0

2.0.0-rc.x

2.0.0-rc.6

Oct 2, 2024

Dependencies

• Upgraded to fs@2.0.0-rc.6

2.0.0-rc.5

Sep 15, 2024

Dependencies

• Upgraded to fs@2.0.0-rc.5

2.0.0-rc.4

Sep 12, 2024

Dependencies

• Upgraded to fs@2.0.0-rc.4

2.0.0-rc.3

Sep 5, 2024

Dependencies

• Upgraded to fs@2.0.0-rc.3

2.0.0-rc.2

Aug 29, 2024

Dependencies

• Upgraded to fs@2.0.0-rc.2

• e2e97db5 (#1701 by @lucasfernog) Update to tauri 2.0.0-rc.8

2.0.0-rc.1

Aug 17, 2024

• 84f8bd5e (#1662 by @twlite) Fixed an issue with abort signal not aborting the fetch request.

2.0.0-rc.0

Aug 2, 2024

• 9887d1 Update to tauri RC.

Dependencies

• Upgraded to fs@2.0.0-rc.0

2.0.0-beta.x

2.0.0-beta.9

Jul 31, 2024

• 99d6ac0f (#1606 by @FabianLars) The JS packages now specify the minimum @tauri-apps/api version instead of a single exact version.
• 6de87966 (#1597 by @Legend-Master) Update to tauri beta.25.

2.0.0-beta.8

Jul 12, 2024

• ac9a25cc (#1395 by @amrbashir) Fix cancelling requests using AbortSignal.
• a6654932 (#1526 by @amrbashir) Fix missing Set-Cookie headers in the response which meant request.headers.getSetCookie() always returned empty array.
• 22a17980 (#1537 by @lucasfernog) Update to tauri beta.24.

2.0.0-beta.7

Jul 2, 2024

• 76daee7a (#1512 by @renovate) Update to tauri beta.23.

2.0.0-beta.6

Jun 17, 2024

• 0f739dbc (#1392 by @amrbashir) Allow setting Origin header when unsafe-headers feature flag is active.

Dependencies

• Upgraded to fs@2.0.0-beta.6

2.0.0-beta.5

May 30, 2024

• 9013854f(#1382) Update to tauri beta.22.

• 500ff10(#1166) Breaking change: Removed the default-tls feature flag. The rustls-tls, http2, macos-system-configuration, and charset feature flags are now enabled by default.

• e3d41f4(#1191) Internally use the webview scoped resources table instead of the app one, so other webviews can't access other webviews resources.

• 7e2fcc5(#1146) Update dependencies to align with tauri 2.0.0-beta.14.

• e3d41f4(#1191) Update for tauri 2.0.0-beta.15.

Dependencies

• Upgraded to fs@2.0.0-beta.5

2.0.0-beta.4

May 30, 2024

• 9d7ae45b(#1354) Include headers created by browser if not declared by user, which fixes missing headers like Content-Type when using FormData.
• 430bd6f4(#1363) Update to tauri beta.20.

Dependencies

• Upgraded to fs@2.0.0-beta.4

2.0.0-beta.3

May 1, 2024

• bd1ed590(#1237) Update to tauri beta.17.

• c873e4d(#1059) Fixes scope not allowing subpaths, query parameters and hash when those values are empty.

• a04ea2f(#1071) The global API script is now only added to the binary when the withGlobalTauri config is true.

• 753c7be(#1050) Add unsafe-headers cargo feature flag to allow using forbidden headers.

Dependencies

• Upgraded to fs@2.0.0-beta.3

2.0.0-beta.2

Mar 7, 2024

• ae56b13(#983) Allow User-Agent header to be set.
• 99bea25(#1005) Update to tauri beta.8.

2.0.0-beta.1

Feb 21, 2024

• 569defb Update to tauri beta.4.

2.0.0-beta.0

Feb 3, 2024

• d198c01(#862) Update to tauri beta.
• 1a34720(#858) Fix http fetch client option init with parameter connectTimeout

2.0.0-alpha.x

2.0.0-alpha.9

Dec 28, 2023

Dependencies

• Upgraded to fs@2.0.0-alpha.7

2.0.0-alpha.6

Dec 20, 2023

• bfa87da(#824) Add proxy field to fetch options to configure proxy.

2.0.0-alpha.5

Dec 20, 2023

• 387c2f9(#802) Update to @tauri-apps/api v2.0.0-alpha.13.

2.0.0-alpha.4

Dec 14, 2023

• 387c2f9(#802) Update to @tauri-apps/api v2.0.0-alpha.12.

2.0.0-alpha.3

Oct 29, 2023

• e438e0a(#676) Update to @tauri-apps/api v2.0.0-alpha.11.

• 2cb0fa7(#587) Remove cmd property which breaks invoke call.

• 4e2cef9(#593) Update to alpha.12.

Dependencies

• Upgraded to fs@2.0.0-alpha.2

2.0.0-alpha.2

Oct 23, 2023

• 5c13736(#673) Update to @tauri-apps/api v2.0.0-alpha.9.

• aec17a9(#558) Improve response performance by using the new IPC streaming data.

2.0.0-alpha.1

Aug 14, 2023

• 7d9df72(#428) Multipart requests are now handled in JavaScript by the Request JavaScript class so you just need to use a FormData body and not set the content-type header to multipart/form-data. application/x-www-form-urlencoded requests must be done manually.
• 7d9df72(#428) The http plugin has been rewritten from scratch and now only exposes a fetch function in Javascript and Re-exports reqwest crate in Rust. The new fetch method tries to be as close and compliant to the fetch Web API as possible.
• d74fc0a(#555) Update to alpha.11.

2.0.0-alpha.0

May 24, 2023

• 717ae67(#371) First v2 alpha release!