#HttpClient
LightNews LightNews
jolicode.com
Jane 8 is out! 🎉

Plain PHP models with public typed properties, #OpenAPI clients running on #Symfony HttpClient, and lazy API calls by default thanks to PHP 8.4 lazy objects ⚡

Jane 8.1 also brings pagination, the most requested feature 💪

Read more 👇
jolicode.com/blog/jane-8...
Jane 8: modern PHP models, Symfony HttpClient and lazy API calls
Jane 7.14 shipped on September 1st. Exactly one month later, we tagged 8.0.0: a major version, with breaking changes we chose one by one. A major version of a code generator is a strange beast:
jolicode.com
November 9, 2026 at 3:57 PM
threadlinqs.bsky.social
A 2020 Python CRLF bug just resurfaced in four F5 product lines - header injection, restriction bypass. https://intel.threadlinqs.com/threat/TL-2026-5453?utm_source=bluesky #ThreatIntel #CVE_2020_26116 #Python #httpclient
November 6, 2026 at 10:55 PM
whatsnew.fyi
Symfony v6.4.50

Fixes 20 security issues, including HtmlSanitizer bypasses, SSRF gaps in HttpClient, skipped post-auth user checks and Request::getBaseUrl() host handling.
Symfony v6.4.50
Fixes 20 security issues, including HtmlSanitizer bypasses, SSRF gaps in HttpClient, skipped post-auth user checks and Request::getBaseUrl() host handling.
whatsnew.fyi
November 9, 2026 at 7:02 AM
patchthecve.bsky.social
CVE-2026-121971 HIGH (CVSS 8.2)
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_be
Fix: https://patchthecve.com/cve/CVE-2026-121971.html
November 4, 2026 at 6:01 PM
euvd-bot.bsky.social
🚨 EUVD-2026-117435
📊 2.3/10
🏢 sensiolabs

📝 The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117435

#cybersecurity #infosec #cve #euvd
November 5, 2026 at 2:02 PM
armenvardanyan.dev
Modern enterprise apps nowadays often involve launching long-running jobs and then polling the API for status

With RxJS you just need one flag (inclusive) to read and react to the final result:

#Angular #RxJS #WebDev
Angular code in export.ts. A component with selector 'app-export' and the template: <button (click)="start$.next()">Export report</button>, then @let job = exportJob(); @if (job?.status === 'running') shows <progress [value]="job.progress" max="100">, @else if (job?.status === 'done') shows <a [href]="job.fileUrl">Download report</a>. In class Export: private readonly http = inject(HttpClient); readonly start$ = new Subject<void>(); readonly exportJob = toSignal(this.start$.pipe(switchMap(() => this.http.post<{ id: string }>('/api/exports', {})), switchMap(({ id }) => timer(0, 2000).pipe(switchMap(() => this.http.get<ExportJob>(`/api/exports/${id}`)), takeWhile((job) => job.status === 'running', true))))). The takeWhile line is highlighted.
November 6, 2026 at 4:33 PM
euvd-bot.bsky.social
🚨 EUVD-2026-117008
📊 8.2/10
🏢 sensiolabs

📝 The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request befo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117008

#cybersecurity #infosec #cve #euvd
November 4, 2026 at 7:05 PM
takkanm.bsky.social
Released httpclient 2.10.0. It updates the bundled CA certificates and now rejects certificates containing the public keys of compromised eMudhra intermediate CAs. Thanks, yuuu!
rubygems.org/gems/httpcli...
github.com/nahi/httpcli...
httpclient | RubyGems.org | your community gem host
rubygems.org
October 31, 2026 at 7:12 AM
devleader.ca
You might not know of some of these tricks when downloading files in C#...

When we download files in C#, using an HttpClient will have default behavior that we stream the entire contents of the file into memory.
November 2, 2026 at 8:00 PM
armenvardanyan.dev
Retrying after an error is pretty much good UX by itself. However, you cannot keep hammering an endpoint with requests until it works (it might never work 😆 )

Thankfully, it is very easy to implement an exponential backoff with a combo of retry + timer in RxJS:

#RxJS #Angular #WebDev
Angular code in report.service.ts. An @Injectable({ providedIn: 'root' }) class ReportService with private readonly http = inject(HttpClient). Its getReport() method returns this.http.get<Report>('/api/report').pipe(retry({ ... })). The retry config (highlighted) has count: 3, with the comment "give up after 3 retries", and delay: (error: HttpErrorResponse, attempt) => { ... }. Inside, with the comment "a 404 won't fix itself, fail right away": if (error.status < 500) { return throwError(() => error); }. Then return timer(2 ** attempt * 1000), with the comment "wait 2s, 4s, 8s" (highlighted).
November 5, 2026 at 1:45 PM
throwable.bsky.social
📦 mtubis/html-translator-bundle v0.1.1

Symfony bundle for mtubis/html-translator: translate HTML with LLMs (OpenAI, Anthropic, Gemini, Ollama, …) while preserving markup — configuration, services, HttpClient, cache, console and profiler.

🔗 https://github.com/mtubis/html-translator-bundle
November 2, 2026 at 2:00 AM
startdebugging.bsky.social
Agent Framework 1.27 for .NET: a 302 can no longer move a workflow request onto your authenticated HttpClient. It throws instead.
https://startdebugging.net/2026/11/agent-framework-1-27-redirects-can-no-longer-switch-the-http-client/?utm_source=bluesky&utm_medium=social&utm_campaign=auto
November 2, 2026 at 4:13 AM
throwable.bsky.social
📦 mtubis/html-translator-bundle v0.1.0

Symfony bundle for mtubis/html-translator: translate HTML with LLMs (OpenAI, Anthropic, Gemini, Ollama, …) while preserving markup — configuration, services, HttpClient, cache, console and profiler.

🔗 https://github.com/mtubis/html-translator-bundle
November 1, 2026 at 1:59 AM
throwable.bsky.social
📦 omegaalfa/http-client v2.0.0

A lightweight, high-performance asynchronous HTTP client for modern PHP applications powered b FiberEventLoop.

🔗 https://github.com/omegaalfa/HttpClient
October 31, 2026 at 5:12 AM
threadlinqs.bsky.social
One leading // in a path and Faraday sends your Ruby service's request to the attacker's host. https://intel.threadlinqs.com/threat/TL-2026-4872?utm_source=bluesky #ThreatIntel #CVE_2026_25765 #Ruby #httpclient
October 31, 2026 at 2:25 AM
armenvardanyan.dev
Now you can (and should) put `@Service` instead of `@Injectable({providedIn: 'root'})`.

Which raises an important question: when WOULD you use `Injectable`?

#Angular #WebDev #TypeScript
TypeScript code in cart.store.ts comparing two versions of the same Angular service. 'Before': @Injectable({ providedIn: 'root' }) on export class CartStore, which injects HttpClient with inject(). 'Now (Angular 22+)': the same class with the decorator @Service() instead, highlighted.
October 29, 2026 at 2:02 PM
funkysi1701.com
.NET 10 is here! Discover amazing new features now! https://www.funkysi1701.com/posts/2025/blazor-and-dotnet10/ #Blazor #.NET10 #WebAssembly #Wasm #HttpClient #breakingchange #DotNet #VisualStudio #release #streamingresponse #C-Sharp
October 27, 2026 at 1:00 PM
throwable.bsky.social
📦 valtzu/symfony-outgoing-firewall v0.2.0

Rule-based firewall for outgoing Symfony HttpClient requests

🔗 https://github.com/valtzu/symfony-outgoing-firewall
October 28, 2026 at 12:41 AM
throwable.bsky.social
📦 valtzu/symfony-outgoing-firewall v0.1.0

Rule-based firewall for outgoing Symfony HttpClient requests

🔗 https://github.com/valtzu/symfony-outgoing-firewall
October 28, 2026 at 12:41 AM
geek.ch
Update zu .Net: "Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install. Applications must manually opt in request decompression or HttpClient response decompression, or they must manually invoke the Brotli decompression APIs provided by .NET."
October 27, 2026 at 9:58 AM
armenvardanyan.dev
You get signals back, just like with resources:
The same books.ts component. The highlighted template lines read the query's signals: books.isPending(), books.isError() and books.data(): @Component({ selector: 'app-books', template: ` @if (books.isPending()) { <p>Loading...</p> } @else if (books.isError()) { <p>Could not load books</p> } @else { @for (book of books.data(); track book.id) { <p>{{ book.title }}</p> } } `, }) export class Books { private readonly http = inject(HttpClient); readonly page = signal(2); readonly books = injectQuery(() => ({ queryKey: ['books', this.page()], queryFn: () => lastValueFrom( this.http.get<Book[]>('/api/books', { params: { page: this.page() } }), ), })); }
October 27, 2026 at 1:57 PM
armenvardanyan.dev
Since TanStack Query caches the responses by key, we can prefetch data in certain situations and have it ready for the future

#Angular #TanStack #WebDev #TypeScript
TypeScript code in books-api.ts: an Angular service whose book(id) method returns TanStack Query's queryOptions, with the queryOptions line highlighted: @Injectable({ providedIn: 'root' }) export class BooksApi { private readonly http = inject(HttpClient); book(id: number) { return queryOptions({ queryKey: ['book', id], queryFn: () => lastValueFrom(this.http.get<Book>(`/api/books/${id}`)), staleTime: 30_000, }); } } An Angular component in book-link.ts. Highlighted: the link with (mouseenter)="prefetch()", and the prefetch method calling this.queryClient.prefetchQuery(this.booksApi.book(this.book().id)): @Component({ selector: 'app-book-link', imports: [RouterLink], template: ` <a [routerLink]="['/books', book().id]" (mouseenter)="prefetch()"> {{ book().title }} </a> `, }) export class BookLink { private readonly queryClient = inject(QueryClient); private readonly booksApi = inject(BooksApi); readonly book = input.required<Book>(); prefetch() { this.queryClient.prefetchQuery(this.booksApi.book(this.book().id)); } }
October 28, 2026 at 10:49 AM
threadlinqs.bsky.social
Microsoft's emergency .NET patch fixes a Brotli decoder memory-corruption bug and more High flaws. https://intel.threadlinqs.com/threat/TL-2026-4438?utm_source=bluesky #ThreatIntel #CVE_2026_111497 #CVE_2026_114148 #httpclient
October 26, 2026 at 8:52 AM
armenvardanyan.dev
And, more powerful than resources, Angular Query also supports mutations! So you can perform requests with HTTP POST, DELETE, etc
Angular component in add-book.ts using TanStack Query's injectMutation. Highlighted: the mutationFn that POSTs the book, and onSuccess calling queryClient.invalidateQueries({ queryKey: ['books'] }): @Component({ selector: 'app-add-book', template: ` <button [disabled]="addBook.isPending()" (click)="addBook.mutate(draft())"> Add book </button> `, }) export class AddBook { private readonly http = inject(HttpClient); private readonly queryClient = inject(QueryClient); readonly draft = input.required<NewBook>(); readonly addBook = injectMutation(() => ({ mutationFn: (book: NewBook) => lastValueFrom(this.http.post<Book>('/api/books', book)), onSuccess: () => this.queryClient.invalidateQueries({ queryKey: ['books'] }), })); }
October 27, 2026 at 1:57 PM
armenvardanyan.dev
But you can manually set "staleness" and it will refetch the next time the data is used if the time has expired!
The same books.ts component with staleTime: 60_000 added and highlighted, commented 'fresh for 1 minute, no refetch until then': @Component({ selector: 'app-books', template: ` @if (books.isPending()) { <p>Loading...</p> } @else if (books.isError()) { <p>Could not load books</p> } @else { @for (book of books.data(); track book.id) { <p>{{ book.title }}</p> } } `, }) export class Books { private readonly http = inject(HttpClient); readonly page = signal(2); readonly books = injectQuery(() => ({ queryKey: ['books', this.page()], queryFn: () => lastValueFrom( this.http.get<Book[]>('/api/books', { params: { page: this.page() } }), ), staleTime: 60_000, // fresh for 1 minute, no refetch until then })); }
October 27, 2026 at 1:57 PM