chore(deps): update dependency hackney to v4.7.4

MaidFox commented

2026-08-11 06:47:52 -07:00

Member

This PR contains the following updates:

Package	Type	Update	Change
hackney (source)	prod	patch	`4.7.2` → `4.7.4`

Release Notes

benoitc/hackney (hackney)

`v4.7.4`

Compare Source

Fixed

A connection attempt that outlives its timeout no longer terminates the pool,
and with it every caller of that pool. The dial is made with the request's
connect_timeout, and a call that times out, like a connection process that
dies while dialing, comes back as a checkout error (#927, #928, thanks
@aboroska).
Handing a pooled connection to a new owner, and the prewarm dial, are guarded
like the other calls the pool makes into a connection process. A connection
that is gone or wedged is dropped instead of taking the pool down (#929).
Stopping a connection from inside the pool is bounded to 100ms, after which
the connection is killed. A connection wedged in a transport call, which a
failed dial makes likely, used to hold every caller of the pool for as long
as the transport took to return (#929).
The health probes the pool runs on a connection (is_ready, checkin_info,
set_owner, get_state) take an explicit timeout, and the pool passes
250ms. h2_conn_usable/1 used the 5s default, so one wedged HTTP/2
connection stalled the pool for 5 seconds on every checkout for that host
(#929).

Added

Fault injection test harness for the pool: a transport which can be told to
misbehave, a sentinel which makes a dead pool visible, fault and chaos
suites, and a structural test which fails if the pool calls a connection
process outside a try. DEVELOPMENT.md explains how to use it (#929).

Changed

Update dependencies to their latest releases: h2 0.12.0 and webtransport
0.4.5 (#930).

hackney 4.7.3 is a bugfix and hardening release for the Erlang HTTP client. It clears a few ways a pooled connection could stall or leak, hardens CRLF handling on the proxy and streaming request paths, restores curl-style Content-Length: 0 on empty POST/PUT/PATCH bodies (so servers such as AWS that require the header are happy again), and refreshes every dependency to its latest release.

Upgrading from 4.7.2 needs no code changes.

Fixed

Reusing a pooled HTTP/2 or HTTP/3 connection no longer crashes the caller of
hackney:connect/4 when the pooled connection terminates during the checkout
liveness probe. The get_state probe is guarded so a terminating connection
falls through to a fresh one (#914).
hackney_url:normalize/2 now rejects a host that reaches an IP literal only
after IDNA folds the Unicode full-stop variants (U+3002/U+FF0E/U+FF61) to
ASCII dots (for example 127。0。0。1 becoming 127.0.0.1), closing a bypass
of the percent-encoded-IP check.
The CONNECT proxy handshake rejects CR/LF/NUL in the target host instead of
concatenating it into the request line and Host header.
The pooled HTTPS upgrade bounds the TLS handshake with connect_timeout
(ssl:connect/3), so a server that stalls the handshake no longer pins the
connection process and its pool slot (#916).
The streaming request path sanitizes header values (CR/LF) like the buffered
path, and the request method is validated (CR/LF/NUL) at every entry point,
not just the request target.
A response body cut short by the peer closing mid-transfer no longer leaks
the connection process. read_full_body/2 hands back socket = undefined,
so the connection went straight to closed and never reached the reuse
check added for #902. An unpooled connection arms no grace timer there and,
when started under hackney_conn_sup, has the supervisor as its owner, so
the owner-DOWN clause never fired either: the process parked forever holding
every refc binary it had read. Callers could not clean up, since a
synchronous request returns the body directly and the truncated read still
reports {ok, Body} (#918). The same applies to a failed body read and to
bodyless (204/304) responses.
hackney_conn:get_location/1 and set_location/2 no longer exit with
noproc when the connection has already stopped, which would otherwise
propagate out of hackney:request/5 on the redirect path.

Changed

Like curl, an empty body on a body-bearing method (POST/PUT/PATCH) now sends
Content-Length: 0; bodyless methods (GET/HEAD/DELETE) are unchanged (#917).
Update dependencies to their latest releases: quic 1.8.0, webtransport
0.4.4, mimerl 1.5.0, and cowboy 2.18.0 for the test suite.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [hackney](https://hex.pm/packages/hackney) ([source](https://github.com/benoitc/hackney)) | prod | patch | `4.7.2` → `4.7.4` | --- ### Release Notes <details> <summary>benoitc/hackney (hackney)</summary> ### [`v4.7.4`](https://github.com/benoitc/hackney/releases/tag/4.7.4) [Compare Source](https://github.com/benoitc/hackney/compare/4.7.3...4.7.4) ##### Fixed - A connection attempt that outlives its timeout no longer terminates the pool, and with it every caller of that pool. The dial is made with the request's `connect_timeout`, and a call that times out, like a connection process that dies while dialing, comes back as a checkout error ([#927](https://github.com/benoitc/hackney/issues/927), [#928](https://github.com/benoitc/hackney/issues/928), thanks [@aboroska](https://github.com/aboroska)). - Handing a pooled connection to a new owner, and the prewarm dial, are guarded like the other calls the pool makes into a connection process. A connection that is gone or wedged is dropped instead of taking the pool down ([#929](https://github.com/benoitc/hackney/issues/929)). - Stopping a connection from inside the pool is bounded to 100ms, after which the connection is killed. A connection wedged in a transport call, which a failed dial makes likely, used to hold every caller of the pool for as long as the transport took to return ([#929](https://github.com/benoitc/hackney/issues/929)). - The health probes the pool runs on a connection (`is_ready`, `checkin_info`, `set_owner`, `get_state`) take an explicit timeout, and the pool passes 250ms. `h2_conn_usable/1` used the 5s default, so one wedged HTTP/2 connection stalled the pool for 5 seconds on every checkout for that host ([#929](https://github.com/benoitc/hackney/issues/929)). ##### Added - Fault injection test harness for the pool: a transport which can be told to misbehave, a sentinel which makes a dead pool visible, fault and chaos suites, and a structural test which fails if the pool calls a connection process outside a `try`. `DEVELOPMENT.md` explains how to use it ([#929](https://github.com/benoitc/hackney/issues/929)). ##### Changed - Update dependencies to their latest releases: `h2` 0.12.0 and `webtransport` 0.4.5 ([#930](https://github.com/benoitc/hackney/issues/930)). ### [`v4.7.3`](https://github.com/benoitc/hackney/releases/tag/4.7.3) [Compare Source](https://github.com/benoitc/hackney/compare/4.7.2...4.7.3) hackney 4.7.3 is a bugfix and hardening release for the Erlang HTTP client. It clears a few ways a pooled connection could stall or leak, hardens CRLF handling on the proxy and streaming request paths, restores curl-style `Content-Length: 0` on empty POST/PUT/PATCH bodies (so servers such as AWS that require the header are happy again), and refreshes every dependency to its latest release. Upgrading from 4.7.2 needs no code changes. ##### Fixed - Reusing a pooled HTTP/2 or HTTP/3 connection no longer crashes the caller of `hackney:connect/4` when the pooled connection terminates during the checkout liveness probe. The `get_state` probe is guarded so a terminating connection falls through to a fresh one ([#914](https://github.com/benoitc/hackney/issues/914)). - `hackney_url:normalize/2` now rejects a host that reaches an IP literal only after IDNA folds the Unicode full-stop variants (U+3002/U+FF0E/U+FF61) to ASCII dots (for example `127。0。0。1` becoming `127.0.0.1`), closing a bypass of the percent-encoded-IP check. - The CONNECT proxy handshake rejects CR/LF/NUL in the target host instead of concatenating it into the request line and `Host` header. - The pooled HTTPS upgrade bounds the TLS handshake with `connect_timeout` (`ssl:connect/3`), so a server that stalls the handshake no longer pins the connection process and its pool slot ([#916](https://github.com/benoitc/hackney/issues/916)). - The streaming request path sanitizes header values (CR/LF) like the buffered path, and the request method is validated (CR/LF/NUL) at every entry point, not just the request target. - A response body cut short by the peer closing mid-transfer no longer leaks the connection process. `read_full_body/2` hands back `socket = undefined`, so the connection went straight to `closed` and never reached the reuse check added for [#902](https://github.com/benoitc/hackney/issues/902). An unpooled connection arms no grace timer there and, when started under `hackney_conn_sup`, has the supervisor as its `owner`, so the owner-DOWN clause never fired either: the process parked forever holding every refc binary it had read. Callers could not clean up, since a synchronous request returns the body directly and the truncated read still reports `{ok, Body}` ([#918](https://github.com/benoitc/hackney/issues/918)). The same applies to a failed body read and to bodyless (204/304) responses. - `hackney_conn:get_location/1` and `set_location/2` no longer exit with `noproc` when the connection has already stopped, which would otherwise propagate out of `hackney:request/5` on the redirect path. ##### Changed - Like curl, an empty body on a body-bearing method (POST/PUT/PATCH) now sends `Content-Length: 0`; bodyless methods (GET/HEAD/DELETE) are unchanged ([#917](https://github.com/benoitc/hackney/issues/917)). - Update dependencies to their latest releases: `quic` 1.8.0, `webtransport` 0.4.4, `mimerl` 1.5.0, and `cowboy` 2.18.0 for the test suite. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

MaidFox added 1 commit

2026-08-11 06:47:53 -07:00

chore(deps): update dependency hackney to v4.7.3

Lint / Lint (pull_request) Successful in 2m8s

Details

Nix check / check-nix (pull_request) Successful in 6m32s

Details

04740c3c5c

MaidFox force-pushed renovate/hackney-4.x-lockfile from 04740c3c5c

Lint / Lint (pull_request) Successful in 2m8s

Details

Nix check / check-nix (pull_request) Successful in 6m32s