Bump hackney from 1.25.0 to 4.1.0

[dependabot]

Bumps hackney from 1.25.0 to 4.1.0.

Release notes

Sourced from hackney's releases.

hackney 4.1.0

WebTransport client. Drop-in addition alongside the WebSocket API, no breaking changes.

Added

• WebTransport client API (hackney:wt_connect/1,2, wt_send/2, wt_recv/1,2, wt_setopts/2, wt_close/1,2), mirroring the WebSocket ws_* API so code switches by swapping the ws_ prefix for wt_. Runs over HTTP/3 (default) or HTTP/2. One session multiplexes many streams (wt_open_stream/2, wt_stream_send/3,4, wt_stream_recv/2,3, wt_close_stream/2, wt_reset_stream/3, wt_stop_sending/3) plus unreliable datagrams (wt_send_datagram/2) and wt_session_info/1. No custom wire framing, so it interoperates with any WebTransport server. Caller path and headers are checked for CR/LF/NUL and a buffer cap bounds unread data. See the WebTransport Guide.

Dependencies

• Add webtransport 0.2.6.

Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md

hackney 4.0.3

OTP 29 support and HTTP/3 server-certificate verification. Drop-in upgrade from 4.0.2, no API changes.

Security

• HTTP/3 now verifies the server certificate. quic 1.4.4 authenticates the server by default; hackney passes the request's insecure option and any configured CA (cacerts/cacertfile in ssl_options) through to the QUIC connection, so verification can be disabled or pointed at a custom trust store. Without a configured CA, quic uses its default trust store.

Changed

• Replace the deprecated catch Expr form with try ... catch so hackney compiles cleanly on OTP 29.

Dependencies

• Bump quic to 1.4.5 (fixes server-cert chain validation when the server sends an extra cross-sign above the anchored intermediate).
• Bump h2 to 0.6.1 (OTP 29 deprecated-catch fix).

Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md

hackney 4.0.2

Bug-fix release. Drop-in upgrade from 4.0.1, no API changes.

Bug Fixes

• Fix an intermittent pool crash when a server closes a pooled keep-alive connection during checkout (#850). The checkout now tolerates the set_owner race and falls through to a fresh connection instead of crashing on a bad match, and an async ownership handoff to an already-closed pooled connection stops it promptly so the pool drops it from rotation.
• Expose hackney:body/1,2 and hackney:stream_body/1 again so the response body can be read after start_response/1 in streaming body mode (#849). The migration guide and examples referenced these but they were not exported. The getting-started guide and README were corrected as well.

Full changelog: https://github.com/benoitc/hackney/blob/master/NEWS.md

hackney 4.0.1

Security release. Fixes 9 reported vulnerabilities (4 high, 4 medium, 1 low) plus one hardening change across the HTTP/1.1, HTTP/2, HTTP/3, WebSocket, cookie and URL handling code. No API changes, so it is a drop-in upgrade from 4.0.0.

If you use hackney directly or through a library (HTTPoison, Tesla's hackney adapter, ExAws, and others), please upgrade.

Security

High

• CVE-2026-47066 (GHSA-6cp8): infinite loop in the Alt-Svc response parser.

... (truncated)

Changelog

Sourced from hackney's changelog.

4.1.0 - 2026-05-29

Added

• WebTransport client API (hackney:wt_connect/1,2, wt_send/2, wt_recv/1,2, wt_setopts/2, wt_close/1,2). It mirrors the WebSocket API so code can switch by swapping the ws_ prefix for wt_. Runs over HTTP/3 (QUIC) by default, HTTP/2 optional. One session multiplexes many streams (wt_open_stream/2, wt_stream_send/3,4, wt_stream_recv/2,3, wt_close_stream/2, wt_reset_stream/3, wt_stop_sending/3) plus unreliable datagrams (wt_send_datagram/2) and wt_session_info/1. Backed by the webtransport library. Caller-supplied request headers and path are checked for CR/LF/NUL, and a buffer cap bounds unread data. See the WebTransport Guide.

Dependencies

• Add webtransport 0.2.6.

4.0.3 - 2026-05-28

Security

• HTTP/3 now verifies the server certificate. quic 1.4.4 authenticates the server by default; hackney passes the request's insecure option and any configured CA (cacerts/cacertfile in ssl_options) through to the QUIC connection, so verification can be disabled or pointed at a custom trust store. Without a configured CA, quic uses its default trust store.

Changed

• Replace the deprecated catch Expr form with try ... catch so hackney compiles cleanly on OTP 29.

Dependencies

• Bump quic to 1.4.5.
• Bump h2 to 0.6.1.

4.0.2 - 2026-05-25

Bug Fixes

• Fix an intermittent pool crash when a server closes a pooled keep-alive connection during checkout (#850). The checkout now tolerates the set_owner race and falls through to a fresh connection instead of crashing on a bad match, and an async ownership handoff to an already-closed pooled

... (truncated)

Commits

• c93ce0a Set 4.1.0 release date
• 97a95f6 Merge pull request #857 from benoitc/webtransport-client
• c4ce1fe Bump version to 4.1.0
• 943fe28 Add WebTransport client (wt_* API)
• 0570bfb Merge pull request #856 from benoitc/h3/quic-1.4.4-verify
• d543f12 deps: bump quic to 1.4.5
• 8315f8e ci: install ca_root_nss on FreeBSD for H3 verification
• 0a1244a h3: honor custom CA from ssl_options
• ff1a88c h3: do not force certifi as the QUIC trust store
• 5edfa60 ci: bump rebar3 to 3.25.0 for OTP 29 support
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #483.