chore(deps): update dependency hackney to v4.2.0 #40
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/hackney-4.x-lockfile"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.0.0→4.2.0Release Notes
benoitc/hackney (hackney)
v4.2.0Compare Source
Added
familyconnect option (inet|inet6) is forwarded to QUIC, which resolves DNS and races addresses with Happy Eyeballs (RFC 8305). IPv6 literals such ashttps://[::1]/work too.{host, port, transport}and replayed on the next connection; a bodyless one-shot request is then sent as 0-RTT, otherwise the ticket gives a resumed handshake. Controlled by thezero_rttoption, with an explicitsession_tickettaking precedence. Newhackney_h3helpers:early_data_accepted/1,get_session_ticket/1,wait_session_ticket/2.Fixed
ssl_options(cacerts,insecure) that previously did not reach the QUIC layer.exit:{normal, _}/exit:noprocto the caller; request, body and streaming calls return{error, closed}instead (#861).localhost) or a binary is accepted again for the plain, connect and socks5 proxy tuples instead of being silently ignored (#858).Dependencies
v4.1.0: hackney 4.1.0Compare Source
WebTransport client. Drop-in addition alongside the WebSocket API, no breaking changes.
Added
hackney:wt_connect/1,2,wt_send/2,wt_recv/1,2,wt_setopts/2,wt_close/1,2), mirroring the WebSocketws_*API so code switches by swapping thews_prefix forwt_. Runs over HTTP/3 (default) or HTTP/2. One session multiplexes many streams (wt_open_stream/2,wt_stream_send/3,4,wt_stream_recv/2,3,wt_close_stream/2,wt_reset_stream/3,wt_stop_sending/3) plus unreliable datagrams (wt_send_datagram/2) andwt_session_info/1. No custom wire framing, so it interoperates with any WebTransport server. Caller path and headers are checked for CR/LF/NUL and a buffer cap bounds unread data. See the WebTransport Guide.Dependencies
webtransport0.2.6.Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md
v4.0.3: hackney 4.0.3Compare Source
OTP 29 support and HTTP/3 server-certificate verification. Drop-in upgrade from 4.0.2, no API changes.
Security
insecureoption and any configured CA (cacerts/cacertfileinssl_options) through to the QUIC connection, so verification can be disabled or pointed at a custom trust store. Without a configured CA, quic uses its default trust store.Changed
catch Exprform withtry ... catchso hackney compiles cleanly on OTP 29.Dependencies
Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md
v4.0.2: hackney 4.0.2Compare Source
Bug-fix release. Drop-in upgrade from 4.0.1, no API changes.
Bug Fixes
set_ownerrace and falls through to a fresh connection instead of crashing on a bad match, and an async ownership handoff to an already-closed pooled connection stops it promptly so the pool drops it from rotation.hackney:body/1,2andhackney:stream_body/1again so the response body can be read afterstart_response/1in streaming body mode (#849). The migration guide and examples referenced these but they were not exported. The getting-started guide and README were corrected as well.Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md
v4.0.1: hackney 4.0.1Compare Source
Security release. Fixes 9 reported vulnerabilities (4 high, 4 medium, 1 low) plus one hardening change across the HTTP/1.1, HTTP/2, HTTP/3, WebSocket, cookie and URL handling code. No API changes, so it is a drop-in upgrade from 4.0.0.
If you use hackney directly or through a library (HTTPoison, Tesla's hackney adapter, ExAws, and others), please upgrade.
Security
High
Medium
Low
Hardening
to_atom/1no longer falls back tolist_to_atom/1, removing an atom-leak path (GHSA-6rmf, no CVE assigned).Dependencies
Credits
Thanks to PJUllrich, Ganbagana and tepel-chen for the reports, and to maennchen for coordinating disclosure.
Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.