Hurl

8.0.1 (2026-04-28)

Thanks to @verigak,

Bugs Fixed:

• Support _ in jsonpath member name shorthand #4995

8.0.0 (2026-04-24)

Thanks to @backtozero, @Hari-Oggy, @eyupcanakman, @AdmiralRazorbeard, @giorgiovilardo, @kikonen, @eirayuki, @aageneralov, @mateusz834, @msterin, @lillem4n, @jwadolowski, @ashishajr, @spiffytech, @rajiv,

Take a tour of this version here!

Breaking Changes:

• Use CookieStore in HurlResult (crate compatibility) #4697
• Delete deprecated --interactive option #4712
• Replace legacy env var variable configuration HURL_foo by HURL_VARIABLE_foo #4882
• Rename ignore-asserts to no-assert #4889
• Using new JSONPath module implementing RFC 9535 #4270

Enhancements:

• Add raw multiline strings and remove deprecated multiline attributes #1733
• Add --no-cookie-store option to deactivate cookie storage for one file #2168
• Rename --noproxy to --no-proxy with backward compatible alias #4709
• Separate color usage (ANSI codes) for standard output and standard error #4790
• Add support for asserting/capturing TLS certificate value #4698
• Use color/pretty when using output per request #4970
• Support color env variables configuration #4777
• Enhance error message for invalid filter input on filters #4381
• Add rawbytes query #4250
• Using new JSONPath module implementing RFC 9535 #4270
• Add --verbosity option (globally and per request) #4613
• Add Subject Alt Name (SAN) attribute for certificate assertions #4617

Bugs Fixed:

• Reject invalid header value on command line option #4843
• Fix single quote in cookie value breaking curl output #4557
• Add support for curl --data-raw option in hurlfmt import #4411
• Fix truncating existing output file when response is tiny #4576

Deprecations:

• Add charsetDecode filter and make decode deprecated #4732

7.1.0 (2025-11-18)

Thanks to @Nezteb, @quantonganh, @lambrospetrou, @linkdd, @gugahoa, @MikhailWahib, @ashishajr, @rcrisanti,

Take a tour of this version here!

Enhancements:

• Add CLI option to pretty print the response body #1760
• Add pretty print option #1760
• Support adding secret with HURL_SECRET_foo env variable #3901
• Use happy path with http/https scheme for URL parsing to improve stress test use-cases #4144
• Support --secrets-file for injecting secrets #4309
• Add --ntlm option per request #4322
• Add --negotiate option per request #4323
• Add utf8Decode/utf8Encode filters #4382
• Replace unmaintained encoding crate with encoding_rs crate #4399
• Enhance logging for retry #4419
• Add support for hour duration #4422
• Enhance --test duration logging #4423
• Add parsing support for more types of date time strings to toDate filter #4439 #4440 #4441
• HTML report enhancements #4445 #4446
• Add retry count in the progress bar (only if retry >= 1) #4511
• Add isList predicate #4520
• Add isObject predicate #4520

Bugs Fixed:

• Parse --user, --negotiate, and --ntlm options in hurlfmt #4213
• Add parsing support for more types of date time strings to toDate filter #4439 #4440 #4441
• Accept more path names when appending HTML reports #4459
• Fix filtering of Authorization: and Cookie: headers when following redirections #4460
• Fix supporting space in cookie storage cookie values #4461
• Fix implicit "Content-Type" headers when following redirections #4522
• Fix curl debug command with dot-prefixed cookie domain #4558

7.0.0 (2025-07-28)

Thanks to @ecolinet, @theoforger, @Muntaner, @ashishajr, @patkujawa-wf, @niklasweimann, @alanbondarun, @benkio, @dhth, @verigak, @markphilpot, @lambrospetrou, @aresler, @nfj25, @nwellnhof, @YannickAlex07, @lu-zero, @RaghavSood, @tjbrockmeyer,

Take a tour of this new version here!

Breaking Changes:

• Add replaceRegex filter and fix replace filter to not take regex #4018

Enhancements:

• Add query for HTTP redirects #922
• Add urlQueryParam filter #2199
• Show curl command when error format option is set to long #2226
• Add option to configure max-time per request #3162
• Add date comparison predicates #3480
• Add pinnedpubkey cli option #3563
• Add base64 url safe encode and decode filters #3840
• parse curl's --cookie flag #3877
• Show hurl --help with color #3882
• Add toHex filter #3963
• Add first and last filters #3998
• Remove hex crate dependency #4011
• Small tweaks to --test progress output #4028
• Add support for negative values for nth filter #4050
• Add option to configure pinnedpubkey per request #4084
• Add timeline link on status label in source and run pages #4128
• Support template in nth filter parameter #4152
• Implement predicate isUuid #4179
• Improve captures error messages when filter chain returned no value #4214
• Add --ntlm cli option #4216
• Add --negotiate option #4246

Bugs Fixed:

• Fix incorrect curl command for POST redirect #2797
• Fix hurlfmt to disallow invalid header argument in curl command #3668
• Parse verbose flag in curl command #3760
• Keep secret value forever, even if a secret variable override an existing one #3898
• Fix zsh completion #3938
• Parse cookie Expires date attribute with '-' #3956
• Replace deprecated libxml2 initGenericErrorDefaultFunc with xmlSetGenericErrorFunc #3975
• HTML report: fix span for lines in comment. #4002
• Fix HTML closing tag for line with trailing comment #4017
• Add replaceRegex filter and fix replace filter to not take regex #4018
• Fix request body during redirections #4073
• Fix "variables" token in GraphQL HTML export #4117
• Support negative index in jsonpath #4154

Security Issues Fixed:

• Fix JavaScript injection in HTML report through regex literal #4125

6.1.1 (2025-03-19)

Thanks to @lu-zero, @andrejohansson, @demostanis, @techfg,

Bugs Fixed:

• Fix hurlfmt spacing #3839
• Fix filename parsing #3848
• Fix jsonpath array wildcard with missing attribute #3859 #3869
• Fix predicate contains with none input #3868

6.1.0 (2025-03-12)

Thanks to @lilyhuang-github, @ashishajr, @kidbrax, @theoforger, @smokedlinq, @docwhat, @glb-cblin, @Enoz, @ikorason, @uday-rana, @lu-zero, @nghiab1906724, @overbyte,

See a tour of this version here!

Breaking Changes:

• Remove deprecated predicates (notEquals, greaterThan etc...) in favor of operators #3532
• Remove deprecated keyword HTTP/* for HTTP #3697

Enhancements:

• Removed limitation for --cookie-jar to use only one hurl file #2537
• Add HTTP version query #1706
• Add curl -H/--header option to globally add headers to all requests #1905 #2144
• Add toString Filter #2035 #3798
• Add base64 decode filter #2145
• Add base64 encode filter #2145
• Redacts secrets from JUnit reports #2947 #2972
• Redacts secrets from JSON report #2947 #2972
• Redact secret in HTML report #2947 #2972
• Redact secrets from curl export #2947 #2972
• Redact secrets from cookies export #2947 #2972
• Add IP address query #3106
• Add isIpv4 / isIpv6 asserts on IP versions #3106
• Allow sending empty HTTP header #3536
• Redact dynamic values from logs #3543
• Add header option per request #3575
• Fix invalid escape in hurlfmt parse func #3615
• hurlfmt: Use Hurl predicates identifiers for Hurl to JSON file export #3662
• Add aarch64 deb package #3829

Bugs Fixed:

• Fix missing request line errors in HTML report #3534
• Eval template in JSON object key #3593
• Show error message if format is invalid in format filter #3613
• Create parent folders if missing when using --cookie-jar FILE #3637
• Remove lint errors and Fix non-zero exit code in case of error #3648
• Support BigInteger in variable #3656
• fix hurlfmt html export loosing some whitespaces #3675
• Fix template to source #3675
• Fix changing HTTP version per request sometimes not effective #3719
• Add bash file completion for hurl/hurlfmt #3750
• Fix multilines HTML export #3768
• Change parsing file content type in multipart form data #3796

Deprecations:

• Deprecate includes in favor of contains predicate #1896
• Warn for deprecated multilines string attributes #3622
• Warn for --interactive deprecation #3763

6.0.0 (2024-12-03)

Thanks to @cemoktra, @zikani03, @lambrospetrou, @jmvargas, @quantonganh, @sandeshbhusal, @thePanz, @niklasweimann, @infogulch, @orlandow, @bp7968h,

See a tour of this version here!

Breaking Changes:

• Check that variables do not conflict with existing functions #3229
• Remove deprecated --fail-at-end option #3430
• Change API for setting variable in hurl::runner::run #3440
• Remove hurlfmt deprecated --format option #3445
• Rename feature flag from vendored-openssl to static-openssl #3460

Enhancements:

• Implement function newUuid #973
• Implement --limit-rate from curl #1222
• Add --curl option to export executed requests to curl commands #2679
• Configure --connect-timeout per request #3163
• Support short name for sections [QueryStringParams] => [Query], [FormParams] => [Form], [MultipartFormData] => [Multipart] #3238
• Remove url-specific parser (align with grammar) #3244
• Remove the crate float-cmp #3247
• Jsonpath / Add filter on boolean value #3252
• Jsonpath / Add non-equal filter on string and number value #3261
• Add support for backtick strings in predicates values #3317
• Categorise options in --help #3339
• Support more JSON / XML "like" mimetypes with debug output #3343
• Add curl debug command to --json and JSON report #3374
• Add curl debug command to HTML report #3386
• Render Date value #3431
• Add newDate generator #3443

Bugs Fixed:

• Fix reading standard input multiple times #3216
• Fix filename parsing (used by cert option) #3242
• Add additional check for --max-filesize option #3245
• Support case-insensitive Cookie Attributes #3265
• Allow any string in Location Header when not following redirection #3293
• Fix graceful shutdown of workers threads in --test #3297
• Fix missing space in variable option HTML export #3412

5.0.1 (2024-08-30)

Bugs Fixed:

• Fix regression in --output when output file doesn't exist #3195

5.0.0 (2024-08-29)

Thanks to @lambrospetrou, @OverkillGuy, @badboy, @DenuxPlays, @linkdd, @nkback, @claytonneal,

See a tour of this version here!

Breaking Changes:

• Encode oneline string only with one backtick #3113

Enhancements:

• Create intermediary directories if necessary when producing TAP report #2860
• Expose request comments in --out json (hurlfmt) #2850
• Create intermediary directories if necessary when producing JUnit report #2842
• Add global requests count in test summary #2832
• Replace output warnings by errors #2815
• Fix inconsistent case for fields queryString and httpVersion in --json #2804
• Run tests in parallel #2753
• Add support for importing curl url option in hurlfmt #2750
• Add JSON report #2738
• Add repeat option to repeat a sequence of Hurl file #2680
• Add repeat option per request #2680
• Add optional duration unit #2653
• Apply delay only once per entry, no matter how many retry #1973
• Add toFloat filter #1732
• Accept directory as Hurl arguments for processing file #1446

Bugs Fixed:

• Get SSL certificates info on reused connections, from a cache #3031
• Fix max-redirs: -1 in [Options] section #3023
• Fix error displayed in double with bad option #2920
• Fix hurlfmt exit code with lint error #2919
• Truncate file then append it when dumping response with --output. #2886
• Fix crash with --json option when capturing 'HttpOnly' and 'Secure' cookie attribute #2871
• Fix crash when capturing 'Expires' cookie attribute #2870
• Fix empty JSON key parsing #2836
• Do not filter 'Authorization' header if host doesn't change while following redirect #2823
• Fix sending 'Authorization' header from --user when following redirect #2812
• Fix URL when following redirect for certain 'Location' header #2783
• Fix powershell completion file #2729

4.3.0 (2024-04-23)

Thanks to @tarampampam, @CMiksche, @CodeMan99, @OverkillGuy, @hsanson, @jaminalder, @teto, @humphd, @mohammed90,

See a tour of this version here!

Enhancements:

• Support --user option per request #2585
• Add isNumber predicate #2538
• Create intermediate directory when using --report-html #2531
• Use '-' to read Hurl file from standard input #2523
• Add --from-entry option to execute a file from a given entry #2500
• Add isIsoDate predicate (take a string, checks YYYY-MM-DDTHH:mm:sssZ) #2427
• Add completion files in Linux/MacOS packages #2401
• Fix tarball layout to Linux filesystem #2401
• Add --max-filesize option to limit HTTP response #2353
• Display source request when there are asserts/runtime errors #2351
• Using explicit stdout output #2312
• Prevent raw binary response to be displayed on standard output #2306
• Add --netrc, --netrc-file and --netrc-optional options #2094
• Generate bash completion for hurl/hurlfmt #1864
• Generate powershell completion for hurl/hurlfmt #1864
• Generate fish completion for hurl/hurlfmt #1864
• Generate zsh completion for hurl/hurlfmt #1864
• Add experimental --parallel / --jobs options #88 #87

Bugs Fixed:

• Export begin_call, end_call timings fields to RFC3339 (microseconds) #2699
• Fix standalone css for regex #2693
• Fix charset parsing logic of Content-Type header #2540
• Fix filename templatization bug under certain conditions #2533
• Fix empty glob not always returning an error #2517
• Fix hurlfmt query certificate for hurl output format #2511
• Fix --test progress bar not displayed when verbose is used #2506
• Per request output takes file-root into account for path resolving #2445
• Fix silent error when verbose option use unset variable #2444
• Fix Content-type header override when used in lowercase #2416

Security Issues Fixed:

• Prevent script injection in HTML report #2719