When a tiny, widely used HTTP client slips into an insecure default mode, the consequences ripple far beyond a single library — they reach package managers, CI pipelines, internal tooling, and any application that quietly trusts “https://” without actually verifying who’s on the other end...