Migrate to HTTP.jl 2.x (require 2.4)

[dependabot]

Migrates Pluto's web server to the HTTP.jl 2.x API. HTTP.jl 2.0 is a breaking rewrite built on the Reseau transport layer, so this adapts the server code and drops pre-2.0 compatibility.

(This branch started as the Dependabot compat bump; the commits on top implement the actual migration.)

Version requirement: HTTP = "2.4"

• The mixed HTTP+WebSocket server helper HTTP.WebSockets.upgrade(f, stream) (Pluto serves HTTP and WebSockets on one port) is not in 2.0.0 — it was added in 2.1.0 (JuliaWeb/HTTP.jl#1255).
• HTTP.jl 2.0–2.3 are affected by 14 security advisories, JLSEC-2026-611 … JLSEC-2026-624 (HTTP/2 stream-cap DoS, fileserver path traversal, redirect/cookie/origin handling, request smuggling, SSE injection, weak WebSocket masking RNG, HPACK desync, …), all fixed in v2.4.0 (SecurityAdvisories.jl#549).

So the floor is 2.4. The 2.4 API surface Pluto uses is identical to 2.1 (verified: WebSockets.upgrade still takes check_origin).

Changes

• WebServer.jl — listen! no longer accepts server=/on_shutdown/stream/verbose, so Pluto binds the TCP.Listener itself (keeping the port-hint search) and passes it to listen!. The graceful close(::HTTP.Server) now waits for active WebSocket connections, so client shutdown runs from RunningPlutoServer before the server is closed.
• The server Stream only exposes request metadata via http.message; the handler now rebuilds the request with its body, assigns http.response, and writes the body bytes (mirroring HTTP's own stream handler). A client disconnect surfaces as SystemError under Reseau, so it's swallowed alongside IOError.
• HTTP.WebSocket / HTTP.send move under HTTP.WebSockets. WebSocket Origin checking is left off (as in 1.x) because it breaks proxied setups like Binder/JuliaHub; the server secret is the real auth.
• auth_middleware — Headers is no longer a plain vector, so the filter! is replaced with setheader (which de-duplicates).
• readtimeout → read_idle_timeout.
• Tests — test/Configuration.jl: the cookie-jar keyword is cookiejar, not jar (the old name was silently ignored). test/compiletimes.jl: the HTTP-get warmup hit http://github.com, whose redirect to https is now followed into Reseau's TLS stack; kept it a plain request with redirect=false.

Verification

Backend tests pass on CI for the supported Julia versions, and a local smoke test (boot server → HTTP routes → WebSocket upgrade) passes against HTTP 2.4.0:

• Configurations: 182/182
• Web server: 25/25

Notes

• Julia ~1.13.0-0 is expected to fail (unrelated to HTTP).
• The pre-existing MoreAnalysis test failure on main (which the suite hits after the HTTP tests) is fixed separately in Fix MoreAnalysis tests after deprecation removal #3577.

[pankgeorg]

So, there is a concern in that HTTP.jl#2.X is new, and not really security hardened.