httr2 1.3.0

• Fixed OAuth token cache pruning so that it actually matches the encrypted .rds.enc files written to disk; previously the pruning pattern only matched an unencrypted .rds file that was never created, so cached tokens were never automatically deleted regardless of age.
• httr2 now requires rlang >= 1.3.0, which changes the hash used to name files cached by req_cache() and on-disk OAuth token caches (e.g. from req_oauth_auth_code(cache_disk = TRUE)). Existing cached files won't match the new hash, so they'll be silently ignored (triggering a normal cache miss/re-authentication) and cleaned up over time by the usual pruning rules; you can also delete them manually.
• oauth_cache_path() now defaults to a standard R cache directory (via tools::R_user_dir()). Because this release also changes the hash used for cache filenames, existing OAuth tokens will generally not be reused and you may need to authenticate once after upgrading. New tokens are written to the new location, and obsolete tokens in both the old and new locations are removed by the usual pruning rules. httr2 no longer requires the rappdirs package (#800).
• New oauth_cache_prune() lets you manually delete cached OAuth tokens older than a given number of days, exposing the pruning that httr2 already performs automatically on load.
• req_oauth_*() gains an expiry_margin argument to control how early cached OAuth tokens are treated as expired; the default margin increases from 5 to 30 seconds (@zacdav-db, #860).

httr2 1.2.3

• Mocked and cached responses now include the originating request in resp$request, just like real responses (#841).
• New httr2_translate() translates an httr2 request into the equivalent curl command (#795).
• last_response_json() now works with content-types that end with +json, e.g. application/problem+json (@cgiachalis, #782).
• oauth_*() token refresh now forwards token_params from the original flow, so extra token-endpoint parameters (e.g. a scope required on the token exchange) are sent on refresh as well as on the initial token request (@simonpcouch).
• oauth_client() gains a metadata argument: pass the result of oauth_server_metadata() and the client carries all of the server's endpoints, so the OAuth flows pick them up automatically instead of threading them into each call (#846).
• oauth_flow_auth_code() now correctly uses the same redirect URI for both authorization and token requests when using the default localhost redirect URL (@pedrobtz, #829).
• New oauth_server_metadata() discovers an OAuth/OpenID Connect issuer's endpoints from its .well-known metadata document (#845).
• req_auth_aws_v4() now correctly signs URLs containing encoded slashes (%2F) in path segments, such as ARNs in AWS Bedrock API paths (@thisisnic, #842).
• req_body_form() now creates a valid empty request body when no parameters are provided (@arcresu, #836).
• req_body_form() and req_url_query() no longer error with "C stack usage is too close to the limit" when given very long string values (#805).
• req_cache() no longer errors when a request is first performed with path then later without it (#840).
• req_error() is now applied to responses retrieved from the cache, so a custom is_error callback is respected on cache hits (#806).
• req_oauth_bearer_jwt() now uses its claim as the basis for a separate client assertion when the client also authenticates with auth = "jwt_sig", so you no longer need to supply the claim twice. As a result, oauth_client(auth = "jwt_sig") no longer requires a claim in auth_params at creation time (#825).
• req_oauth_device() gains a pkce argument to enable Proof Key for Code Exchange, matching oauth_flow_device() (#834).
• req_throttle() can now enforce multiple rate limits at once: supply a vector to capacity (and fill_time_s) to create one token bucket per limit, and each request must satisfy all of them (#555).
• resp_link_url() and iterate_with_link_url() no longer error on Link headers that contain a trailing comma (#804).
• resp_stream_aws() now parses byte, short, and integer headers as signed integers, matching the AWS event-stream specification (previously they were incorrectly read as unsigned).
• resp_stream_lines() no longer treats a bare carriage return (CR) as a line ending; only LF and CRLF terminate lines, which is what every modern streaming source produces.
• resp_stream_lines() no longer warns when the stream ends without a final line terminator (which is routine when streaming), and its warn argument is (softly) deprecated.
• resp_stream_lines(), resp_stream_sse(), and resp_stream_aws() now decode whole chunks at a time and hold the results in a queue, instead of rescanning and recopying the buffer for every line or event. This makes memory use and run time scale linearly rather than quadratically with the response size, so large streams use dramatically less memory and run much faster (e.g. reading a 1 MB response of short lines is now around 200x faster and allocates around 180x less memory) (#704).

httr2 1.2.2

• httr2 will now emit OpenTelemetry traces for all requests when tracing is enabled. Requires the otelsdk package (@atheriel, #729).
• req_throttle() no longer resets the token bucket when used repeatedly with the same host (#801) and never generates negative wait times (#820).
• req_perform_connection() no longer errors with no applicable method for 'close' applied to an object of class "c('httr2_failure', 'httr2_error', 'rlang_error', 'error', 'condition')" (#817).
• New resps_ok() returns a logical vector indicating which requests were successful (#807).
• url_modify() refactored to better retain exact formatting of URL not modified components (#788, #794)

httr2 1.2.1

• Colons in paths are no longer escaped.

httr2 1.2.0

Lifecycle changes

• req_perform_stream() has been soft deprecated in favour of
  req_perform_connection().

• Deprecated functions mutli_req_perform(), req_stream(), with_mock() and
  local_mock() have been removed.

• Deprecated arguments req_perform_parallel(pool),
  req_oauth_auth_code(host_name, host_ip, port), and
  oauth_flow_auth_code(host_name, host_ip, port) have been removed.

New features

• Redacted headers are no longer serialized to disk. This is important since it
  makes it harder to accidentally leak secrets to files on disk, but comes at a
  cost: you can longer perform such requests that have been saved and reloaded
  (#721).

• URL construction is now powered by curl::curl_modify_url(), and hence now
  (correctly) escapes the path component (#732). This means that
  req_url_path() now can only affect the path component of the URL, not
  the query params or fragment.

• New last_request_json() and last_response_json() to conveniently see
  JSON bodies (#734).

• New req_get_url(), req_get_method(), req_get_headers(),
  req_body_get_type(), and req_get_body() allow you to introspect a request
  object (#718).

• New resp_timing() exposes timing information about the request measured
  by libcurl (@arcresu, #725).

Minor improvements bug fixues

• Functions that capture interrutps (like req_perform_parallel() and friends)
  are now easier to escape if they're called inside a loop: you can press
  Ctrl + C twice to guarantee an exit (#1810).

• req_perform_iterative(), req_perform_sequential(),
  req_perform_parallel(), req_perform_promise(), and
  req_perform_connection() now support mocking (#651). To mock the response
  from req_perform_connection() create a response with the new StreamingBody
  for a body.

• new_response() is now exported (#751).

• req_body_json() and req_body_form() correctly unobfuscated inputs,
  as documented (#754).

• req_body_json_modify() can now be used on a request with an empty body.

• req_error() errors with long bodies are now correctly wrapped (#727).

• req_oauth_device() gains an open_browser argument that lets you take
  control of whether a browser is opened or the URL is printed (@plietar, #763)

• req_perform_parallel() handles progress argument consistently with other
  functions (#726).

• req_url_query() now re-calculates n lengths when using .multi = "explode"
  to avoid select/recycling issues (@Kevanness, #719).

• All print methods now send output to stdout, not the message stream.

httr2 1.1.2

• req_headers() more carefully checks its input types (#707).
• Fix AWS request signing due to argument 'cache' is missing error (#706, @jcheng5).

httr2 1.1.1

New features

• req_perform_parallel() lifts many of the previous restrictions. It supports simplified versions of req_throttle() and req_retry(), can refresh OAuth tokens, and checks the cache before/after each request. (#681).
• Default verbosity can be controlled by the HTTR2_VERBOSITY environment variable (#687).
• local_verbosity() matches the existing with_verbosity() and allows for local control of verbosity (#687).
• req_dry_run() and req_verbose() display compressed correctly (#91, #656) and automatically prettify JSON bodies (#668). You can suppress prettification with options(httr2_pretty_json = FALSE) (#668).
• req_throttle() implements a new "token bucket" algorithm that maintains average rate limits while allowing bursts of higher request rates.

Minor improvements and bug fixes

• aws_v4_signature() correctly processes URLs containing query parameters (@jeffreyzuber, #645).
• oauth_client() and oauth_token() implement improved print methods with bulleted lists, similar to other httr2 objects, and oauth_client() with custom auth functions no longer produces errors (#648).
• req_dry_run() omits headers that would vary in tests and can prettify JSON output.
• req_headers() automatically redacts Authorization headers (#649) and correctly implements case-insensitive modification of existing headers (#682).
• req_headers_redacted() now supports dynamic dots (#647).
• req_oauth_auth_code() no longer adds trailing "/" characters to properly formed redirect_uri values (@jonthegeek, #646).
• req_perform_connection() produces more helpful error messages when requests fail at the networking level.
• req_perform_parallel(pool) now is deprecated in favour of a new max_active argument (#681).
• req_user_agent() memoizes the default user agent to improve performance, as computing version numbers is relatively slow (300 µs).
• resp_link_url() once again respects the case insensitivity for header names (@DavidRLovell, #655).
• resp_stream_sse() automatically retrieves the next event when the current event contains no data, and returns data as a single string (#650).
• str() correctly redacts redacted headers (#682).

httr2 1.1.0

Lifecycle changes

• req_perform_stream() is superseded in favor of req_perform_connection(),
  which is no longer experimental (#625).

• with_mock() and local_mock() are defunct and will be removed in the next
  release.

New features

• is_online() wraps curl::has_internet(), making it easy to tell if you're
  currently online (#512).

• req_headers_redacted() makes it easier to redact sensitive headers (#561).

• req_retry() implements "circuit breaking", which immediatelys error after
  multiple failures to the same server (e.g. because the server is down)
  (#370).

• req_url_relative() navigates to a relative URL (#449).

• resp_request() returns the request associated with a response; this can
  be useful when debugging (#604).

• resp_stream_is_complete() checks if data remains in the stream (#559).

• url_modify(), url_modify_query(), and url_modify_relative() modify
  URLs (#464); url_query_parse() and url_query_build() parse and build
  query strings (#425).

Bug fixes and minor improvements

• OAuth response parsing errors now have a dedicated httr2_oauth_parse error
  class that includes the original response object (@atheriel, #596).

• curl_translate() converts cookie headers to req_cookies_set() (#431)
  and JSON data to req_body_json_modify() calls (#258).

• print.request() escapes {} in headers (#586).

• req_auth_aws_v4() formats the AWS Authorization header correctly (#627).

• req_retry() defaults to max_tries = 2 when nethier max_tries nor
  max_seconds is set. If you want to disable retries, set max_tries = 1.

• req_perform_connection() gains a verbosity argument, which is useful for
  understanding exactly how data is streamed back to you (#599).
  req_perform_promise() also gains a verbosity argument.

• req_url_query() can control how spaces are encoded with .space (#432).

• resp_link_url() handles multiple Link headers (#587).

• resp_stream_sse() will warn if it recieves a partial event.

• url_parse() parses relative URLs with new base_url argument (#449) and
  the uses faster and more correct curl::curl_parse_url() (#577).

httr2 1.0.7

• req_perform_promise() upgraded to use event-driven async based on waiting efficiently on curl socket activity (#579).
• New req_oauth_token_exchange() and oauth_flow_token_exchange() functions implement the OAuth token exchange protocol from RFC 8693 (@atheriel, #460).

httr2 1.0.6

• Fix stochastic test failure, particularly on CRAN (#572)
• New oauth_cache_clear() is an exported end point to clear the OAuth cache.
• New req_auth_aws_v4() signs request using AWS's special format (#562, #566).
• req_cache() no longer retrieves anything but GET requests from the cache.
• New resp_stream_aws() to retrieve AWS's special streaming format. With thanks to https://github.com/lifion/lifion-aws-event-stream/ for a simple reference implementation.