drop duplicate Host headers when building the request

[arshsmith1]

What do these changes do?

ClientRequestBase._update_headers sets the Host header with headers.pop(hdrs.HOST, host) and then calls self.headers.extend(headers). CIMultiDict.pop() removes only the first entry for a key, and ClientSession._prepare_headers deliberately keeps caller-supplied duplicates (it calls result.add() when a name repeats). So a request built from a multidict holding two Host entries keeps the second one after the pop, and extend() re-adds it, so the request goes out with two Host header lines. Multiple Host headers are a request-smuggling / host-confusion primitive, and RFC 9112 wants exactly one.

popall() removes every caller-supplied copy before extend() runs, so a single canonical Host survives while a lone caller override still behaves the same.

Are there changes in behavior for the user?

Only for the duplicate case. A single Host header, whether derived from the URL or supplied once by the caller, is unchanged. Several caller Host headers now collapse to the first rather than all going out on the wire.

Is it a substantial burden for the maintainers to support this?

No. It swaps one call for its popall equivalent and adds a regression test next to the existing Host-header tests.

Related issue number

None.

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes — N/A, no public API change
• If you provide code modification, please add yourself to CONTRIBUTORS.txt
• Add a new news fragment into the CHANGES/ folder

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.99%. Comparing base (d8b943b) to head (96163bb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13379   +/-   ##
=======================================
  Coverage   98.99%   98.99%           
=======================================
  Files         132      132           
  Lines       49290    49293    +3     
  Branches     2566     2566           
=======================================
+ Hits        48795    48798    +3     
  Misses        371      371           
  Partials      124      124           

Flag	Coverage Δ
Autobahn	22.06% <50.00%> (+<0.01%)	⬆️
CI-GHA	98.90% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.67% <100.00%> (+<0.01%)	⬆️
OS-Windows	97.03% <100.00%> (+<0.01%)	⬆️
OS-macOS	97.93% <100.00%> (+<0.01%)	⬆️
Py-3.10	98.13% <100.00%> (+<0.01%)	⬆️
Py-3.11	98.38% <100.00%> (+<0.01%)	⬆️
Py-3.12	98.47% <100.00%> (+<0.01%)	⬆️
Py-3.13	98.45% <100.00%> (-0.01%)	⬇️
Py-3.14	98.47% <100.00%> (+<0.01%)	⬆️
Py-3.14t	97.56% <100.00%> (-0.01%)	⬇️
Py-pypy-3.11	97.40% <100.00%> (+<0.01%)	⬆️
VM-macos	97.93% <100.00%> (+<0.01%)	⬆️
VM-ubuntu	98.67% <100.00%> (+<0.01%)	⬆️
VM-windows	97.03% <100.00%> (+<0.01%)	⬆️
cython-coverage	38.13% <25.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing arshsmith1:drop-duplicate-host-header (96163bb) with master (d8b943b)}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩