niquests

3.21.0 (2026-07-29)

Added

• First-class support for the WebAssembly System Interface (WASI) Component Model. (#364)

  Niquests can now run inside sandboxed WebAssembly components using the same
  Requests-compatible API available on native Python. This enables HTTP clients for
  edge functions, plug-ins, agent runtimes, and other capability-constrained
  applications without requiring application-specific adapters.

  Niquests automatically discovers the interfaces imported by the component and
  selects the most capable available transport. Synchronous applications can use
  native WASI Preview 2 sockets, while asynchronous applications can use Preview 3
  sockets. The socket transports retain urllib3.future's native behavior, including
  connection pooling, HTTP/2 multiplexing, streaming, trailers, WebSocket, SSE,
  redirects, retries, cookies, and timeout handling.

  Components that intentionally omit raw socket authority can instead use the
  host-managed wasi:http interfaces: HTTP 0.2 for synchronous applications and
  HTTP 0.3 for asynchronous applications. This provides a narrower capability surface
  in which the host controls DNS, TCP, TLS, certificate trust, protocol negotiation,
  and connection reuse. Niquests also supports hybrid worlds, using sockets where
  possible and WIT HTTP where host-managed TLS is required.

  No network or filesystem authority is ambient under WASI. A component's WIT world
  declares which interfaces it can access, while the runtime independently decides
  which capabilities to grant. Native hostname resolution therefore requires an
  explicit DNS grant, and host filesystem access remains unavailable unless a
  directory is deliberately preopened.

  HTTPS over native WASI sockets requires the rtls extra and urllib3.future
  2.24.900 or newer. When using WIT HTTP, TLS is provided according to the host's
  security policy instead.

  With this release, Niquests supports native Python, browser-side WebAssembly through
  Pyodide, and server-side WebAssembly through WASI while preserving the same familiar
  request API. See the WASI quickstart and advanced capability guide for deployment
  examples and transport-specific constraints.

• Explicit support for Python 3.15

• Custom json_encoder in Session and AsyncSession for request bodies. (#437)

• Top-level request APIs accept custom JSON encoders and TLS configuration.

Fixed

• CRL or OCSP unparsable/corrupted may raise CryptoError. (#430)
• A demoted (i.e. failed) HTTP/3 upgrade attempt could be retried when it should be permanently disabled. (#431)

3.20.1 (2026-07-09)

Fixed

• A session initialized with multiplexed=True can starve the event loop when responses are pending read (i.e. no promise left, only stream data read).
• Importing Niquests in a thread while another thread import any of our dependencies (e.g. h11) may result in a deadlock. (#415)

3.20.0 (2026-06-26)

Added

• Method/Verb QUERY as one of the promoted HTTP verb and available through top level function shortcuts and Session/AsyncSession methods.
  This is following the RFC 10008. A long awaited standardized verb. Any other non-standard verb is still supported through manual request(...) calls.
• A TLSConfiguration object to let you take a deeper control over the TLS configuration.
  This object will allow you to change min, max TLS version, as the cipher list and finally the desired TLS backend.

Fixed

• Typing overload for AsyncResponse iter_lines method. (#413)

3.19.1 (2026-06-08)

Fixed

• Relative Location redirects no longer raise MissingSchema when the request targets a
  synthetic scheme such as wsgi:// or asgi://. (#406)

3.19.0 (2026-06-01)

Added

• Session and AsyncSession constructors now accept params, cookies, proxies, verify and cert
  so that per-request defaults can be configured at initialization, consistently with headers and auth. (#400)
  Ease forward the migration from httpx for interested users.
• A plain http.cookiejar.CookieJar (or a mapping) provided as cookies is now coerced into a
  RequestsCookieJar. The Session/AsyncSession constructor always coerces (so session.cookies.set(...)
  works), while at the request level an unknown CookieJar subclass (e.g. MozillaCookieJar or any
  file-backed/custom jar) is left untouched to preserve its behavior. (#401, #404)
• Support for the alternative TLS backend BoringSSL via the utls extra.
  Niquests now offer a first-class TLS browser impersonation without ever-changing your http client.
  It is automatically done (e.g. negotiated) once the extra is installed. You will need to keep it
  regularly updated so that you have the latest TLS specs of modern browsers.
• Session and AsyncSession constructors now accept allow_incoming_cookies (defaults to True).
  Set it to False to ignore every cookie sent by the remote peer (via Set-Cookie) so that nothing
  is merged into the session jar, including cookies carried across redirect hops. Outgoing cookies you
  set yourself are still emitted.
• Session.request/AsyncSession.request (and the verb shortcuts) now accept an override_scheme
  keyword argument. When a base_url is set on the Session, it override the scheme of the final
  (merged) URL just before the adapter is picked, so you can target a different scheme (e.g. sse,
  ws/wss, optionally with an implementation suffix like sse+unix) without retyping the full URL. (#325)

Changed

• The cookies attribute of Session, AsyncSession and Response is now always typed as
  RequestsCookieJar instead of RequestsCookieJar | CookieJar. This restores the ergonomic mapping
  interface (e.g. session.cookies.set(...)) when using static type checkers. (#401, #404)

  This is not a runtime breaking change: reading .cookies is unchanged, and a native CookieJar
  is still accepted everywhere it is passed as an argument (it is coerced when relevant). We do,
  however, acknowledge a static-typing trade-off: assigning a custom/non-RequestsCookieJar jar
  directly to the attribute (e.g. session.cookies = MozillaCookieJar(...)) now makes type checkers
  such as mypy complain, since the attribute is annotated as RequestsCookieJar. The assignment keeps
  working at runtime; if you rely on it, add a # type: ignore. We chose narrowing on
  purpose the predominant path is that RequestsCookieJar is expected while subclasses (custom implementation)
  are a niche usage.

• CaseInsensitiveDict is now generic over its key and value types (CaseInsensitiveDict[_KT, _VT],
  mirroring dict/Mapping), and Response.headers/Response.trailers are typed as
  CaseInsensitiveDict[str, str]. Reading a response header (e.g. response.headers["Content-Type"])
  now yields str instead of str | bytes, removing the need for a cast/assert to use the headers
  as a plain string mapping with static type checkers. (#401)

  This is purely a typing improvement with no runtime change: the class still subclasses
  collections.abc.MutableMapping (it merely also gains typing.Generic), so the Python 3.7 floor and
  the existing behavior are preserved, and no new dependency is introduced. Unsubscripted
  CaseInsensitiveDict keeps its historical str | bytes key/value types, so existing annotations are
  unaffected.

3.18.8 (2026-05-10)

Fixed

• Avoid starting the background idle watcher/task in session-less requests.
• pre_request hook not dispatched when passing through Session.send. (#389)
• Repeated/redundant "is_ip_private" in CRL/OCSP algorithm. Now cached.
• Response.iter_content inline typing definition missed allowing None. (#392)

3.18.7 (2026-04-28)

Fixed

• Session/AsyncSession with multiplexed=True (i.e. lazy response resolution) performance improvement. Up to 20% gain.

3.18.6 (2026-04-13)

Fixed

• AsyncResponse aenter is not awaitable. (#374)

3.18.5 (2026-04-10)

Fixed

• sse scheme (web extension) urls preparation are skipped. (#372)

Fixed

• Failing basic isinstance check due to unintended modules duplicate via niquests.packages compat module. (#361)
• ASGI/WSGI extensions aren't inheriting from HTTP extensions, thus breaking typing expectations on usage. (#361)

Fixed

• Lowered default keepalive_delay from 1h to 10min.

Misc

• Officialize support for rtls alternative TLS backend.

Fixed

• Unprepared URLs when scheme don't contain http.
• Edge case false positive scheme detection in url. (#349)
• Netrc don't work when base_url is set. (#348)

Fixed

• Module 'importlib' has no attribute 'util'. (#344)

Added

• Experimental support for WASM through Pyodide. (#219) Niquests should be able to automatically operate in the browser or a Node interpreter. We tested Chrome (v137+), Firefox (v131+), and Node (v22+). You must enable JSPI if not already available by default.
• Passing auth parameter through Session or AsyncSession constructor. (#337)
• Automatic WebSocket and SSE for ASGI and Automatic SSE for WSGI.
• Automatic WebSocket and SSE for Unix socket through psse+unix:// and ws+unix:// schemes. (#325)

Fixed

• Coroutine tell never awaited when using aiofiles file wrapper or alike in async. (#334)
• Missing typing overload for AsyncSession.send method. (#335)

Misc

• Improved import delay performance by delaying some dependencies load (notably qh3 and wassima). (#333)
• Made niquests.typing.TLSVerifyType without a lazy PathLike reference for Python 3.9+ (#324)

Added

• Native support for http+unix connections without 3rd party support in both sync and async context. (#315)
• ASGI (e.g. fastapi) app direct usage within AsyncSession and WSGI (e.g. Flask) app direct usage within Session. (#316)
• Passing hooks directly in the Session or AsyncSession constructor. (#321)
• Rate limiter helpers LeakyBucketLimiter and TokenBucketLimiter that can be passed directly to the hooks parameter of Session or AsyncSession for automatic request throttling. (#321)

Fixed

• Method get of CaseInsensitiveDict ambiguous return type. (#288)
• More precise type definitions for PathLike, and IO. (#290)

Changed

• Our typing definitions are now publicly exposed via niquests.typing. This aims to considerably ease extending Niquests.

Misc

• Restore function utils.guess_json_utf from Requests era. (#313)
• Making request with empty url when base_url is set don't add trailing slash at the end. (#319)

Fixed

• Accidental deadlock on a specific case within the revocation checks in sync mode (threads).

Added

• Custom strategies for TLS revocation check per Session or AsyncSession via the new revocation_configuration parameter that takes a RevocationConfiguration object.
• Hook can now be created via a custom class. You may now inherit from niquests.LifecycleHook or niquests.AsyncLifecycleHook depending on your use case. This should considerably ease the scenario where you need to create complex hooks.
• Session underlying pooling state inspecting through repr(my_session) for debugging purposes.
• Exposed ServerSentEvent in top level package imports to ease SSE related developments.
• AsyncHTTPDigestAuth counterpart of HTTPDigestAuth for async usage.
• Shortcut to pass default headers via Session or AsyncSession construction.

Fixed

• In high concurrency scenarii the revocation check may run for multiple newly acquired connection causing a performance slowdown at warmup.

Fixed

• The return type of CaseInsensitiveDict.items() could be a list instead of an expected tuple. (#276)
• Omitting hooks (keys) in Session.hooks dict causing an error at merge with request specific hooks.
• CRL cache not persisted when pickling Session.

Changed

• Disabled OCSP and CRL signature check when either the target site is located in a private network OR at least one proxy is used. See #274 for the rationale behind it.

Fixed

• Using Happy Eyeballs algorithm in async could trigger a warning about OCSP/CRL check in strict mode while no error really occurred. This was due to async cancellation propagated to tasks that did not finish through after getting a valid connection usable.

Security

• Prevent MITM attack with OCSP. Previous to that version we did not check the signature against the issuer public key. While this sort of attack are indubitably rare, we prefer encouraging users to upgrade as soon as possible.

Added

• Support for CRLs in addition to our OCSP solution when the peer certificate does not support OCSP. It acts as a fallback method to check for the revocation status. This comes (in response to) shortly after the removal of Let's Encrypt OCSP responder. We are investigating if we should implement a boolean toggle to let the user prefer CRL instead of OCSP by default in a next version. Give us your ideas and feedbacks before!
• Explicit support for Python 3.14

Changed

• wassima upperbound to version 2 that includes various QoL improvements and stopped relying on Rust. The package is now pure Python and ships with the CCADB store as a fallback.
• urllib3-future lower bound version is raised to 2.13.903 for newest requirements.
• 4 failures (e.g. timeout) in a row with OCSP or CRL will now result in silently disabling the revocation check when strict mode is disabled.

Fixed

• OCSP caching was not used when a redirection (3XX) occurred and following_redirect is enabled.

Removed

• PicoTLS module attached to our OCSP extension in favor of solely doing AIA fetching for the intermediate. The module was error-prone (silently failing) and often did not go through his main goal of getting the intermediate. Now that we have a proper signature verification algorithm available we can enable AIA fetching by default.

Fixed

• Prevent accessing lazy attr if it does not exist (e.g. requests_cache mixin) (#243)
• Session hooks are not fired for the pre_request hook. (#242)
• OCSP redundant calls made from session-less requests.

Added

• "Repr" for our HTTPAdapter and AsyncHTTPAdapter for debugging purposes. (#201) (#227)
• Top level aget, apost, aput, ..., as the asynchronous counterpart of niquests.get, niquests.post, ...
• Global timeout configuration per Session or AsyncSession. Like Session(timeout=10). (#232)
• iter_raw method in Response and AsyncResponse in order to retrieve content from remote without decompression. (#233)

Fixed

• Missing awaited coroutine in AsyncResponse.close(...). (#231)
• Attempt to call close coroutine (urllib3 raw Response) in async mode when the response is not awaitable.

Added

• Internal shortcut to urllib3-future as niquests.packages.urllib3. This immediately helps end-user migrating from Requests to Niquests and avoid the confusion around urllib3 and urllib3-future. The package own code benefit from it. idna, charset_normalizer (+ aliased as chardet) can be used also.

Misc

• The documentation is improved. Especially around sync/async examples and migration snippets.

Removed

• Dependency on idna. Since qh3 version 1.4, we can rely on their internal idna encoder that does not require any external dependencies. This change does not affect the feature on international domain names. If idna is installed, it will be used instead.
• Dependency on kiss-headers. We decided to vendor kiss-headers into Niquests for several reasons. The principal one is that the project is stable and require next to no maintenance. And pulling extra dependencies affect some end-users. We are in the process of measuring potential interest for kiss-headers models. We may decide to remove its support completely in a next major version.

Changed

• Relaxed strict compliance on JSON parsing. We brought strict compliance into Niquests, a response must explicitly set Content-Type: application/json or alike prior to attempt parsing the JSON string. We decided to relax that constraint as old and bad-behaving server may send JSON with missing or broken Content-Type.

Fixed

• Parsing of special scheme that exceed 9 characters on rare custom adapters.

Changed

• Default Content-Type for json payloads changed from application/json; charset="utf-8" to application/json;charset=utf-8. While the previous default was valid, this is the preferred value according to RFC9110. (#204)

Misc

• Removed a useless hasattr control to support older version of urllib3-future (<2.5).
• Updated our pre-commit configuration and reformatted files accordingly.

Fixed

• Certificate validation may end up in error in highly concurrent environment using the experimental freethreaded build. This was due to a racing condition in our "verify" caching logic (e.g. avoid creating duplicate ssl_context where one is sufficient). The GIL prevented this issue.

Fixed

• Restoring the state of AsyncSession through pickle.
• Typing definition for query parameter not accepting None as values. (#193)
• Overload incorrect definition for AsyncSession::get. (#192)

Added

• Support for PathLike objects for verify parameter when passing a ca bundle path. (#194)
• Caching and restoring OCSP state through pickling Session or AsyncSession.
• Caching and restoring QUIC known compatible hosts through pickling Session or AsyncSession.
• Shortcut convenient access to Retry and Timeout configuration objects in top-level import.

Fixed

• Invoking niquests in more than one event loop, even if no loop concurrence occurs. (#190) The faulty part was the shared OCSP cache that was automatically bound the first event loop and could not be shared across more than one loop. Keep in mind that Niquests async is task safe within a single event loop. Sharing a single AsyncSession across more than one event loop is unpredictable. We've waived that limitation by binding the ocsp cache to a single Session. (both sync & async)
• Undesirable socket.timeout error coming from the ocsp checker when running Python < 3.9.

Fixed

• Static type checker getting confused around AsyncSession and attached overloads (AsyncResponse or Response). (#185)

Changed

• Default keepalive (HTTP/2, and HTTP/3) changed to 1 hour. In conformance with urllib3-future.

Removed

• Automatic resolution of pending lazy responses if there are too many of them. Previously, we hardcoded a limit of 128 * NUM_CONN_POOL maximum inflight (aka. unresolved/lazy) response. This was unrealistic due to a number of factors like (but not limited to): A) remote peers can choose at will the max streams. B) we can have multiple pool with multiple (varying) max capacities. C) retrieving max streams per pool per conn is a very costly procedure (in terms of performance). We will revisit this later on. You still can set max_in_flight_multiplexed in your HTTPAdapter to restore this broken behavior.

Fixed

• SSE request block IO by default. Integrate better with urllib3-future new SSE web extension.
• Passing a list instead of tuple for multipart file upload ends in failure.

Changed

• urllib3-future lower bound version is raised to 2.12.900 to ensure built-in support for SSE.
• help script now yield if websocket extra is present and actual version.
• exception raised when no adapter were found now include a hint when the intent was websocket and extra isn't installed.

Fixed

• async version of iter_line. (#182)

Added

• base_url parameter to niquests.Session or niquests.AsyncSession. automatically prefix every request emitted with it. (#179)

Fixed

• warning about coroutine method 'aclose' of 'AsyncSession.resolve_redirects' was never awaited.

Fixed

• Resolving lazy responses when emitted through a SOCKS, HTTP or HTTPS proxy. (#170)

Fixed

• Ensure stream, and verify both defaults to your Session parameters.

Fixed

• Exception leak from urllib3-future when gathering / resolving lazy responses.

Added

• Automatic Advanced Keep-Alive for HTTP/2 and HTTP/3 over QUIC by sending PING frames. New Session, and Adapter parameters are now available: keepalive_delay, and keepalive_idle_window. This greatly improves your daily experience working with HTTP/2+ remote peers.

Fixed

• Unshielded picotls assertion error in Python < 3.10 when trying to fetch the peer intermediate certificate.

Fixed

• Exception leak from urllib3-future when using WebSocket.
• Enforcing HTTP/3 in an AsyncSession. (#152)
• Adapter kwargs fallback to support old Requests extensions.
• Type hint for Response.extension linked to the generic interface instead of the inherited ones.
• Accessing WS over HTTP/2+ using the synchronous session object.

Misc

• Documentation improvement for in-memory certificates and WebSocket use cases.

Changed

• urllib3-future lower bound version is raised to 2.10.904 to ensure exception are properly translated into urllib3-future ones for WS.

Added

• Support for WebSocket over HTTP/1, HTTP/2 and HTTP/3. It brings a unified API that makes you leverage our powerful features like Happy Eyeballs, SOCKS/HTTP/HTTPS proxies, thread/task safety etc...
• Hook for catching early responses like "103 Early Hints".

Fixed

• Informational responses are fully supported over HTTP/1, HTTP/2 and HTTP/3.

Changed

• urllib3-future lower bound version is raised to 2.10.900.

Added

• Support for HTTP Trailers.
• Help script now yield warnings if update are available for each sub dependencies.

Fixed

• Setting a list of Resolver.

Changed

• urllib3-future lower bound version is raised to 2.9.900 (for http trailer support).
• relax strict kwargs passing in Session adapters (required for some plugins).

Fixed

• DummyLock injected into RequestsCookieJar is not fully compatible, thus breaking AsyncSession on certain scenario. (#136)

Added

• Official support for Python 3.13 This has been tested outside GitHub CI due to httpbin unready state for 3.13[...]
• Support for asynchronous auth callables.
• Support for asynchronous bodies through AsyncIterable that yield either bytes or str.
• Support for purposely excluding a domain/port from connecting to QUIC/HTTP3 via the quic_cache_layer property of Session. In order to exclude cloudflare.com from HTTP3 auto-upgrade:

  from niquests import Session
  
  s = Session()
  s.quic_cache_layer.exclude_domain("cloudflare.com")
  

Fixed

• auth argument not accepting a function according to static type checkers. (#133)
• RequestsCookieJar having a lock in AsyncSession. Its effect has been nullified to improve performances.

Changed

• urllib3-future lower bound version is raised to 2.8.902

Added

• TransferProgress tracking in Response when downloading using stream=True based on the Content-Length. (#127) There's no easy way to track the "real" amount of bytes consumed using "iter_content" when the remote is sending a compressed body. This change makes it possible to track the amount of bytes consumed. The Response object now contain a property named download_progress that is either None or a TransferProgress object.
• HTTP/2 with prior knowledge over TLS or via an unencrypted connection. disable_http1 toggle is now available through your Session constructor. In consequence, you may leverage all HTTP/2 capabilities like multiplexing using a plain (e.g. non-TLS) socket. You may enable/disable any protocols per Session object (but not all of them at once!). In non-TLS connections, you have to keep one of HTTP/1.1 or HTTP/2 enabled. Otherwise, one of HTTP/1.1, HTTP/2 or HTTP/3. A RuntimeError may be thrown if no protocol can be used in a given context.

Changed

• Relax main API constraint in get, head, options and delete methods / functions by accepting kwargs.
• urllib3-future lower bound version is raised to 2.8.900

Fixed

• CaseInsensitiveDict repr (to string) causing an unexpected error when upstream have multiple values for a single header. (#129)

Misc

• Minor docs typos (#128)
• Reformatted error messages in our OCSP module for better readability.
• Added real test cases for our OCSP module to ensure its reliability.

Fixed

• ReasonFlag not properly translated to readable text when peer or intermediate certificate is revoked.

Fixed

• Support localhost as a valid domain for cookies. The standard library does not allow this special domain. Researches showed that a valid domain should have at least two dots (e.g. abc.com. and xyz.tld. but not com.). Public suffixes cannot be used as a cookie domain for security reasons, but as localhost isn't one we are explicitly allowing it. Reported in https://github.com/httpie/cli/issues/602 RequestsCookieJar set a default policy that circumvent that limitation, if you specified a custom cookie policy then this fix won't be applied.

Changed

• Lazy load the OCSP extension in order to improve the import performance.

Removed

• Class variable disable_thread in AsyncSession that is no longer relevant since the native asyncio implementation. (PR #122)

Changed

• Avoid parsing X509 peer certificate in the certificate revocation check process over and over again.
• Avoid iterating over header items redundantly or needlessly.

Fixed

• Fixed encoding data with None values and other objects. This was a regression introduced in our v3. #119

Changed

• Various minor performance improvements.

Fixed

• "Help" program python -m niquests.help that depended on h2 while not required anymore.
• Minor performance regression in async while checking OCSP when certificate isn't eligible (e.g. no OCSP url provided).

Changed

• urllib3.future lower bound constraint has been raised to version 2.7.905 to ensure inclusion of jh2 instead of h2.

Fixed

• Handling broken environments with a graceful exception with a detailed error message.

Added

• Support for qh3 version 1.0.0 This qh3 release enable a greater flexibility by dropping cryptography. We had to adapt the OCSP code as we relied on cryptography. HTTP/3 experience is greatly improved.

Changed

• urllib3.future lower bound constraint has been raised to version 2.7.904 to ensure support for the last qh3 release.

Fixed

• Improved compatibility with third party mocking tool that are bound to requests.
• OCSP check did not warn if the HTTP server responded with a non 2xx response in strict mode.

Added

• Support for Happy Eyeballs. This feature is disabled by default, you must pass happy_eyeballs=True within your session constructor or http adapter in order to leverage this.

Fixed

• Missed close implementation in AsyncSession causing the underlying poolmanager to remain open.
• Additional OCSP requests (following a redirect) did not use specified custom DNS resolver.

Changed

• urllib3.future lower bound constraint has been raised to version 2.7.900 for the newly added happy eyeballs feature.

Added

• Support to verify the peer certificate fingerprint using verify=... by passing a string using the following format: verify="sha256_748c76348778cb4a536e7ec12bc9aa559c12770bd1419c7ffe516006e1dea0ec". Doing so disable the certificate usual verification and only checks for its fingerprint match.

Fixed

• Multiplexed request in async did not support awaitable in hooks.
• Setting verify=... and cert=... then change it for the same host did not apply to the underlying (existing) connection pool.

Misc

• Overall performance improvements in both async and sync requests.
• Update pre-commit dependencies (ruff, pyupgrade, and mypy).
• Fixed SessionRedirect in tests that produced an incomplete Response instance that wasn't suitable for tests.

Fixed

• A rare error that occurs on PyPy, especially on Windows, complaining about a missing release call.

Misc

• Allow latest dependencies version for httpbin, Flask and werkzeug in tests.
• Remove wheel from test dependencies.

Fixed

• ImportError in an attempt to retrieve ConnectionInfo.

Changed

• General performance improvements.

Changed

• General performance improvements.

Changed

• Replaced the thread pool executor for the true asyncio implementation. The asynchronous part is rewritten.
• urllib3.future lower bound constraint has been raised to version 2.6.900 for the newly added asynchronous interfaces.

Added

• Support for awaitable hooks in AsyncSession.
• Extendable AsyncBaseAdapter.
• Support for orjson if installed in environment to dramatically increase performance in JSON deserialization.
• Extra speedups to increase overall performances by including optional dependencies such as zstandard, brotli and orjson.

Fixed

• A rare error when leveraging multiplexing when a proxy is used.
• Bypass proxies when looking to validate certificate revocation status in Python < 3.10 with OCSP.

Fixed

• Unintentional performance regression with multiple concurrent multiplexed connection within a single Session.