fix(webhooks): enforce HTTP/1.1 in op_proxy_request

Author: azasypkin

.cargo/config.toml

@@ -1,2 +1,7 @@
 [target.'cfg(all())']
 rustflags = ["--cfg", "uuid_unstable"]
+
+[env]
+# Limit test parallelism to avoid exceeding PostgreSQL's max_connections (default 100).
+# Each #[sqlx::test] gets a pool of up to 5 connections plus 20 for the master pool.
+RUST_TEST_THREADS = "5"

components/secutils-docs/docs/guides/platform/deno_runtime.mdx

@@ -351,7 +351,7 @@ By default, `op_proxy_request` only allows requests to **publicly routable** IP
 :::
 
 :::info Limits
-Each responder has a maximum number of concurrent proxy requests it can handle simultaneously (configurable per subscription tier). When the limit is reached, additional requests receive a `429 Too Many Requests` response with a `Retry-After` header. The upstream response body size is also limited (default: 10 MB) to prevent memory exhaustion. Every proxy request has a timeout (default: 30 s) that can be lowered per-request via the `timeout` field but cannot exceed the server-configured maximum.
+Each responder has a maximum number of concurrent proxy requests it can handle simultaneously (configurable per subscription tier). When the limit is reached, additional requests receive a `429 Too Many Requests` response with a `Retry-After` header. The upstream response body size is also limited (default: 10 MB) to prevent memory exhaustion. Every proxy request has a timeout (default: 30 s) that can be lowered per-request via the `timeout` field but cannot exceed the server-configured maximum. All proxy requests use **HTTP/1.1** - HTTP/2 is not supported.
 :::
 
 :::tip Response tracking

src/js_runtime/op_proxy_request.rs

@@ -62,7 +62,9 @@ impl ProxyState {
             &self.client
         };
         cell.get_or_init(|| {
-            let mut builder = reqwest::Client::builder().redirect(RedirectPolicy::none());
+            let mut builder = reqwest::Client::builder()
+                .redirect(RedirectPolicy::none())
+                .http1_only();
             if insecure {
                 builder = builder.danger_accept_invalid_certs(true);
             }