build(deps): bump isahc from 0.9.14 to 1.7.2

[dependabot]

Bumps isahc from 0.9.14 to 1.7.2.

Release notes

Sourced from isahc's releases.

Security dependency updates and patches

Security

• Upgrade curl-sys to 0.4.55 to pull in libcurl 7.83.1, which contains security patches for the below vulnerabilities. (#394) @​sagebind
  • CVE-2022-27778: curl removes wrong file on error
  • CVE-2022-27779: cookie for trailing dot TLD
  • CVE-2022-27780: percent-encoded path separator in URL host
  • CVE-2022-27781: CERTINFO never-ending busy-loop
  • CVE-2022-27782: TLS and SSH connection too eager reuse
  • CVE-2022-30115: HSTS bypass via trailing dot
• Fix several bugs with the auto_referer option (disabled by default) which could potentially result in sensitive headers being passed to redirect targets unintentionally. (#393) @​sagebind
  • Fix multiple Referer headers being included when two or more redirects are followed in a request
  • URL fragments and userinfo parts of the URL authority should not be included in the Referer header
  • Don't include a Referer header when redirecting from an HTTPS URL to an HTTP URL, as per RFC 7231 recommendation
  • Scrub sensitive headers when redirecting to a different authority

Dependency Updates

• Update Public Suffix List to 172bbfd (#395) @​teto-bot

Curl security updates

Security

• Update curl-sys to 0.4.54 to pull in libcurl 7.83.0, which contains security patches for CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, and CVE-2022-27776. (#391) @​david-perez

HTTP version support detection

Added

• Add new is_http_version_supported function which allows you to check whether support for a particular HTTP version is available at runtime. When statically linking this will be entirely dependent on your build configuration, but if you are dynamically linking to libcurl then it will vary from system to system. (#368) @​sagebind

Changed

• Preallocate buffer for async JSON decoding to improve performance. (#367) @​michalmuskala
• Re-enable content-length request test (#383) @​sagebind
• Add minimal versions test to CI (#373) @​sagebind
• Refactor test server to support writing raw response data. (#366) @​sagebind

Dependency Updates

• Update test-case requirement from 1.1 to 2.0 (#376) @​dependabot

New cookie APIs

Added

• Expose new APIs for cookie construction, updating, and adding to cookie jar. You can now create your own cookies with Cookie::builder and put arbitrary cookies into the cookie jar with CookieJar::set. (#264, #349) @​jacobmischka
• Add bytes() convenience methods to ReadResponseExt and AsyncReadResponseExt which read the entire response body into a Vec<u8>. (#352) @​sagebind
• Speed up CI by adding caching to CI (#358) @​sagebind

Security

... (truncated)

Commits

• 5c533f1 Update Public Suffix List to 172bbfd (#395)
• 937b905 Prepare 1.7.2 release
• 6332778 Upgrade curl-sys to 0.4.55 (#394)
• 17e625d Auto-referer header fixes (#393)
• b2827ab Prepare 1.7.1 release
• 9211bdd Update curl-sys to 0.4.54 (#391)
• 00cf764 Revert "Add experimental rustls support (#309)"
• e995eb4 Prepare 1.7.0 release
• a90a8c0 Re-enable content-length request test (#383)
• fad86fd Update test-case requirement from 1.1 to 2.0 (#376)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)