8.1.0 ([2026-10-27)](https://github.com/Orange-OpenSource/hurl/blob/master/CHANGELOG.md#8](https://github.com/Orange-OpenSource/hurl/blob/master/CHANGELOG.md/issues/8).1.0)

Thanks to @BillyLiou, @Thomasdezeeuw, @eyupcanakman, @fubar-coder, @ptwales, @jgarte, @brenordv, @linkdd, @jkellz-dev, @josh-coderpad, @qrn12580, @1diot9, @Hama1cco,

Enhancements:

• Add --no-header option to remove specific HTTP header #4884
• Add --fail-with-body option to output response body when there are errors #4776
• Add no jsonpath coercion option #5077
• Add --proxy-header option to send header exclusively to a proxy #3944
• Add --http2-prior-knowledge command line option to use HTTP/2 without HTTP/1.1 Upgrade #5126
• Re-export Input struct from hurl_core to hurl #5128
• Add Sublime Text syntax highlighting #5298
• Add --tls-max option #3713
• Skip suggestion fo very long keyword #5360
• Add --tls-min option to set the minimum allowed TLS version #5335
• Add Hurl config file #3629

Bugs Fixed:

• Fix misleading error message for not-equal predicate #2841
• Fix variable option values starting with a number or boolean #5028
• Fix recorded headers when connecting to proxy with CONNECT #5091
• Fix Hurl debug curl command when request binary body contains NUL char #5141
• Don't fail build on Windows if file icon is not reachable #5207
• Fix parsing exponent in JSONPath expr #5342
• Add explicit nesting limit to JSONPath expression parsing #5350
• Fix hurlfmt panic when importing curl commands without a URL #5354
• Fix crash when receiving non UTF-8 server cookie #5356
• Fix crash for bad @cookie_storage_set comment (experimental feature) #5348
• Parse finite float in JSONPath #5330
• Escape curl command from --curl option and --verbose log #5374

Security Issues Fixed:

• Fix CVE-2026-63481 stripping cookie from Cookies section when redirecting to a different host #5118
• Fix escaping headers values in HTML report #5228
• Fix symlinks escaping file root #5289
• Fix credentials leaking using --header and following redirection #5310
• Add explicit nesting limit to JSON Body parsing #5317
• Fix escaping capture name in HTML report #5346