Actix actix-web-v4.18.2, actix-http-v3.20.3 and actix-http-v3.20.2 released!

[NewsBot]

Actix actix-web-v4.18.2, actix-http-v3.20.3 and actix-http-v3.20.2 has been released.

• Increase the default form payload limit to 32 KiB.
• Bound decompressed request payloads using the same configured size limits for form, JSON, bytes, and string extractors. GHSA-qph8-7859-gq2f
• Add UrlencodedError::OverflowUnknownLength error enum variant for form payloads that exceed the limit while streaming.
• Add a UTF-8 encoded filename* parameter in ContentDisposition::attachment() for non-ASCII filenames.
• Return 405 with an Allow header from the built-in app default when method guards reject matching resources, including macro routes.

Link: Release actix-web: v4.18.2 · actix/actix-web · GitHub

• Disable large-window Brotli decompression. GHSA-7p9w-p5qm-5gc5

Link: Release actix-http: v3.20.3 · actix/actix-web · GitHub

• Reject bare LF as last chunk terminator in chunked encodings. GHSA-2q7f-mf9f-5qhr

Link: Release actix-http: v3.20.2 · actix/actix-web · GitHub