Changelog
All notable changes to hurlx are documented here. View all releases on GitHub →
Parser blank-line handling overhaul, comment parsing fix, entry state restoration, and runner redirect isolation fix.
🐛Bug Fixes
- –parser:
skipEmptyAndCommentsnow correctly loops over blank lines and comments instead of returning after the first one — fixes parsing of files with multiple consecutive blank lines or comments - –parser: comment text now uses the raw line with
#prefix stripped — preserves whitespace in comments like# Step 1 - –parser:
parseEntryusesunreadLine()instead of manualsavedLine/savedPosrestore — fixes state corruption when scanning ahead for response lines - –parser:
parseRequestandparseKeyValueSectionnowcontinueon blank lines instead of returning — allows headers and key-value sections to span blank lines correctly - –parser:
Parse()returns an error for unexpected trailing content instead of silently ignoring it - –parser: removed unused
colfield fromParserstruct - –runner:
applyRequestOptionsnow saves and restoresclient.CheckRedirect— prevents redirect policy from leaking between entries - –runner:
optsToEntryreturnsndirectly instead ofn + 1— fixes--to-entryoff-by-one that included one extra entry beyond the specified index
✅Tests Added
- –
TestParseResponseWithBlankLines— response headers followed by blank line then[Asserts]section - –
TestParseMultipleBlankLinesBetweenEntries— multiple consecutive blank lines between entries - –
TestParseOptionsAllFields— full options section with location, retry, and other fields - –
TestParseRequestWithMultipleHeadersAndBlankLines— headers with blank lines in between
Download v1.0.14
Variable scoping fix for chained entries, fractional duration support, and base64url padding fix.
🐛Bug Fixes
- –runner: pass entry-scoped
varstoevaluateQueryandcheckAssert— captured variables are now correctly visible in subsequent asserts within the same entry - –runner:
applyRequestOptionsnow writes option-defined variables to entry-scoped vars — fixes variable isolation across chained entries - –runner:
ParseDurationusesParseFloatinstead ofParseInt— fractional durations like1.5s,0.5m,50.5msnow work correctly - –filter:
decodeBase64URLSafestrips trailing=padding before NoPadding decode — fixes decoding of padded URL-safe base64 strings
✅Tests Added
- –
TestBase64UrlSafeDecodePadded— verify padded URL-safe base64 input is accepted - –
TestParseDurationfloat cases —1.5s,0.5m,0.25h,50.5ms - –
TestCheckIncludes— collection includes assertion coverage - –
TestRunWithVariables— end-to-end variable template substitution in URL - –
TestRunSSRFBlocked—file://URL scheme is rejected at runner level
Bug fixes for base64 decoding, runner state isolation, and assert value handling.
🐛Bug Fixes
- –filter: base64 decode now strips trailing
=padding before NoPadding decode — fixes decoding of any standard padded base64 string (e.g.SGVsbG8=,AA==) - –runner: reset redirect recorder per-entry — prevents redirect history leaking into subsequent chain steps
- –runner: on template render error, write to entry-scoped vars instead of shared runner vars — prevents cross-entry state pollution
- –runner: save/restore
Verboseandclient.TimeoutinapplyRequestOptions— per-entry option overrides no longer bleed into later entries - –runner:
contains,startsWith,endsWith,matchesasserts now useformatAssertValue— numeric and boolean assert values now work correctly - –runner:
optsToEntryoff-by-one fix —--to Nnow correctly includes entry N (was N-1)
✅Tests Added
- –
TestBase64RoundTrip— encode→decode round-trip for various byte lengths - –
TestBase64DecodePadded— verify padded base64 input is accepted - –
TestBase64UrlSafeRoundTrip— URL-safe variant round-trip
Repository housekeeping — no functional changes.
🧹Housekeeping
- –Untrack
.claude/,.workbuddy/memory/,.github/workflows/CLAUDE.md, andhurlx_test_binfrom version control - –Add above paths to
.gitignore— they are now kept local-only - –
.github/workflows/build.ymlcontinues to be tracked (CI requires it)
Template engine error propagation, runner state isolation, and security hardening.
✨Improvements
- –tmpl:
Render()now returns(string, error)— errors propagate cleanly instead of panicking - –tmpl:
generateUUIDandgenerateRandomHexreturn errors instead of panic on crypto failures - –tmpl: merged
getEnv/getenvbranches; addeduuidas alias fornewUuid - –runner: per-entry variable cloning prevents shared-state mutation across chain steps
- –runner: template render errors are now propagated for URL, headers, query, form, cookies, basicAuth, and multipart fields
🔒Security
- –runner: path-traversal guard added for body-file and multipart-file paths
- –importer: circular-import detection via an in-progress
resolvingset - –importer: path-traversal guard for body file paths
🔧Code Quality
- –cli:
filepath.WalkDirreplaces deprecatedfilepath.Walk - –cli: errors from
os.WriteFileandjson.MarshalIndentare now handled and reported
New template functions, runner improvements, and stdlib base64.
🚀New Features
- –tmpl: new
uuidalias fornewUuid - –tmpl:
date "format"supports Java-style and strftime format patterns - –tmpl:
randomHex Ngenerates N random hex bytes - –tmpl:
getenvas case-insensitive alias forgetEnv - –runner:
ConnectTimeoutandProxyoptions support
🐛Bug Fixes
- –filter: replaced hand-rolled base64 implementation with Go stdlib
encoding/base64 - –runner: fix multipart file close order
- –runner: fix gzip/deflate reader scope
- –runner: remove
brfrom Accept-Encoding (brotli not supported)
✨Improvements
- –Improve test pass rate from 89% to 96%
- –Fix 6 major issues across parser, runner, and filter packages
- –Fix integration tests: use jsonpath for headers
- –Replace xpath
string()with//title/text()
hurlx follows Semantic Versioning. All releases are available on GitHub Releases.