[dependabot]

Bumps curb from 1.4.0 to 1.4.1.

Changelog

Sourced from curb's changelog.

1.4.1 (unreleased)

• Fix CI fixtures for Windows file-URL normalization and libcurl/libpsl localhost cookie loading. Keep parallel multipart Ractor coverage on Windows without triggering Ruby VM bug #21537 through explicit worker GC; retain multipart compaction coverage in the PostField tests. Include this changelog and the transfer-guard regression tests in the gem package.
• Make Curl.safe! default to network_policy = :public, including calls without a configuration block. Global safe mode, safe_* helpers, and Easy#safe_http! now default to a configurable 10 MiB response-body cap, enforced for buffered responses and body callbacks. Explicit helper limits cannot weaken a tighter global cap. Trusted private destinations require an explicit global policy opt-out; raw requests outside safe mode retain their existing defaults. Add regression coverage for default SSRF blocking, multi policy refresh, body limits, and explicit overrides.
• Complete idle easy-handle detachment during repeated initialize, close, and reset: clear native attachment counts and Ruby request bookkeeping so the handle can be re-added immediately. Check failed libcurl escape/unescape allocations before accessing their results, raising Curl::Err::CurlError, and free returned buffers even if Ruby string allocation raises.
• Guard active multi transfers across GVL-releasing waits: reject access to attached easy handles and native multi mutations from other threads, including close/reset/clone, option changes, and removal. Reject destructive easy lifecycle operations and setopt while a transfer is active, while preserving cloning from callbacks on the performing thread. Release ownership on exceptions and interruption, and preserve it when reusing an autoclosed multi. Add concurrency regression tests for polling and socket-action performs.
• Protect multipart form construction from reentrant Curl::Easy access during field callbacks and string coercion, and keep the native lifecycle guard active through form cleanup. Use private native snapshots for multipart payloads so later callbacks, threads, or GC compaction cannot invalidate earlier fields. Avoid per-field VM-global GC root registration and an extra libcurl form copy; release temporary metadata snapshots immediately after form construction. Add regression coverage for POST/PATCH/PUT, exception recovery, string mutation, and compaction.
• Fix compiler-dependent crashes in multipart Curl::PostField uploads by coercing direct and block-provided content to strings before reading their pointers and lengths. Preserve TypeError for values without valid to_str conversion. Add regression coverage for content and buffered file fields, optional content types, and embedded NUL bytes.
• Fix SSRF protection in Curl.safe_* and Curl::Easy#safe_http!: enforce network_policy = :public alongside HTTP/HTTPS protocol limits, blocking loopback, private, and link-local destinations by default. Apply existing proxy and destination-override controls, and prevent weaker global or per-handle network policies from disabling protection. Safe helpers now reject trusted local services too; use raw helpers with explicit protocol limits for those requests. Response-body limits use the safe-mode default and can be configured through max_body_bytes. Add regression coverage for safe helpers, policy reapplication, and multi transfers.
• Fix crashes and uninitialized-memory reads when native operations are called on Curl::Easy.allocate or subclasses whose initializer omits super: reject uninitialized handles with Curl::Err::FailedInitError, initialize connection-info outputs, and check libcurl errors. Repeated initialize now detaches and frees the previous handle and rejects reinitialization during callbacks or native operations. Add regression coverage for allocation, subclasses, getters, lifecycle operations, and repeated initialization.
• Fix a use-after-free when Curl::Easy#clone or #dup is called from a callback during a multipart request: detach the temporary form from the clone before the original request frees it, and reset the clone's callback state. Supply new PostField objects to send a multipart request with the clone. Add regression coverage for body, header, progress, debug, and completion callbacks.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)