Raise HTTP.jl compat floors to 1.10.19 and 2.7 (#3622)

On the 1.x line, 1.10.17 is affected by GHSA-h3x8-ppwj-6vcj (CR/LF header injection, fixed in 1.10.19).

On the 2.x line, 2.7 is the first release that requires Reseau ≥ 1.4.3. Older Reseau sets `SO_REUSEADDR` on Windows TCP listeners, which on Windows lets a socket bind over a port another server is still listening on, so Pluto's search for a free port can settle on one that is already taken. 2.7 also includes 2.6.2, which runs server tasks on the `:interactive` thread pool, so with Julia's default threads from 1.12 on, Pluto's request handlers stay on one thread as they do with HTTP.jl 1; and it raises the server's request-line limit from 8 KiB to 64 KiB.

CI pins both floors on Julia 1.10 so that the lowest allowed versions stay tested, and the `PLUTO_TEST_HTTP_VERSION` check in `test/webserver.jl` accepts a full version as well as a major version.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: pankgeorg

.github/workflows/Test.yml

@@ -41,11 +41,15 @@ jobs:
                 # By default, resolve HTTP.jl freely — that gives us the latest 2.x.
                 http-version: [""]
                 # Pluto supports both HTTP.jl 1.x and 2.x (see src/webserver/HTTPCompat.jl),
-                # so pin 1.x on a few of the combinations as well.
+                # so pin the latest 1.x on a few of the combinations as well, and the lowest
+                # versions that the HTTP compat entry in Project.toml allows on the oldest Julia.
                 include:
                     - julia-version: "1.10"
                       os: ubuntu-latest
-                      http-version: "1"
+                      http-version: "1.10.19"
+                    - julia-version: "1.10"
+                      os: ubuntu-latest
+                      http-version: "2.7.0"
                     - julia-version: "1.12"
                       os: ubuntu-latest
                       http-version: "1"
@@ -68,7 +72,7 @@ jobs:
 
             - uses: julia-actions/cache@v3
 
-            - name: Pin HTTP.jl to ${{ matrix.http-version }}.x
+            - name: Pin HTTP.jl to ${{ matrix.http-version }}
               if: matrix.http-version != ''
               run: julia --project=. -e 'import Pkg; Pkg.add(name="HTTP", version="${{ matrix.http-version }}"); Pkg.pin("HTTP"); Pkg.status("HTTP")'
 

Project.toml

@@ -46,7 +46,7 @@ Downloads = "1"
 ExpressionExplorer = "0.5, 0.6, 1"
 FileWatching = "1"
 GracefulPkg = "2"
-HTTP = "^1.10.17, 2.4"
+HTTP = "^1.10.19, 2.7"
 HypertextLiteral = "0.7, 0.8, 0.9, 1"
 InteractiveUtils = "1"
 LRUCache = "1.6.2"

test/webserver.jl

@@ -54,9 +54,10 @@ end
     # differ in the parts exercised below: response framing, reading a request body, the
     # WebSocket upgrade, and closing a server that still has a WebSocket connected.
     @test Pluto.HTTP_IS_V2 == (pkgversion(HTTP) ≥ v"2")
-    # CI runs this file against both supported major versions, see .github/workflows/Test.yml
+    # CI runs this file against several HTTP.jl versions, see .github/workflows/Test.yml
     let pinned = get(ENV, "PLUTO_TEST_HTTP_VERSION", "")
-        isempty(pinned) || @test string(pkgversion(HTTP).major) == pinned
+        # `pinned` is a version prefix, like "1" or "2.7.0"
+        isempty(pinned) || @test startswith("$(pkgversion(HTTP)).", "$pinned.")
     end
 
     port = 13434