Bump hackney from 1.25.0 to 4.3.0

[dependabot]

Bumps hackney from 1.25.0 to 4.3.0.

Release notes

Sourced from hackney's releases.

4.3.0

Added

• Opt-in pooling of HTTPS/1.1 connections via {ssl_pooling, true} (request option or application env, default false). Upgraded SSL connections return to the pool keyed by the hash of their effective TLS options and are reused only on an exact match, skipping the handshake on follow-up requests. (#872)
• TLS 1.3 session resumption for the default TLS config. With no ssl_options, connections use {session_tickets, auto}. Disable with the tls_session_resumption env. Custom ssl_options never resume (the OTP ticket store is node-wide and a resumed session skips certificate validation). (#872)

Changed

• Shared HTTP/2 and HTTP/3 connections, and cached 0-RTT tickets, are keyed by the effective TLS options, so requests with different ssl_options no longer share a connection or resume each other's tickets.
• The per-request TLS options hash is memoized in a bounded ETS cache.
• SNI: no server_name_indication is sent for IP-literal hosts (RFC 6066) across HTTP/1.1, HTTP/2 and HTTP/3. A user-supplied server_name_indication is honored consistently as both the wire value and the verification target, and disable suppresses SNI without weakening verification.
• Bump quic to 1.6.5 and webtransport to 0.4.0.

4.2.3

Dependencies

• h2 0.8.0 -> 0.9.0
• webtransport 0.3.2 -> 0.3.3
• parse_trans 3.4.1 -> 3.4.2
• cowboy 2.12.0 -> 2.16.0 (test only); ranch test helper updated for the ranch 2.x protocol callback

4.2.2

Fixed

• Pool no longer crashes when a pooled connection dies during the liveness check. find_available could call hackney_conn:is_ready/1 on a connection that died right after the is_process_alive/1 check, and the resulting noproc exit took down the pool. The dead connection is now skipped. (#869)

4.2.1

Dependencies

• quic 1.6.3 -> 1.6.4.
• webtransport 0.3.1 -> 0.3.2.
• certifi 2.16.0 -> 2.17.0.

4.2.0

Added

• IPv6 for HTTP/3. The family connect option (inet | inet6) is forwarded to QUIC, which resolves DNS and races addresses with Happy Eyeballs (RFC 8305). IPv6 literals such as https://[::1]/ work too.
• 0-RTT and session resumption for HTTP/3. Session tickets are cached per {host, port, transport} and replayed on the next connection; a bodyless one-shot request is then sent as 0-RTT, otherwise the ticket gives a resumed handshake. Controlled by the zero_rtt option, with an explicit session_ticket taking precedence. New hackney_h3 helpers: early_data_accepted/1, get_session_ticket/1, wait_session_ticket/2.

Fixed

• Recover from an expired cross-signed root instead of failing the handshake (e.g. Let's Encrypt's ISRG Root X2 cross-signed by the expired ISRG Root X1), across HTTP/1.1, HTTP/2, HTTP/3 and WebTransport. A genuinely expired leaf or intermediate still fails, and partial chains keep working.
• HTTP/3 connections from the pool now apply ssl_options (cacerts, insecure) that previously did not reach the QUIC layer.
• A pooled connection that stops between checkout and the request call no longer leaks exit:{normal, _} / exit:noproc to the caller; request, body and streaming calls return {error, closed} instead (#861).
• A proxy host given as an atom (e.g. localhost) or a binary is accepted again for the plain, connect and socks5 proxy tuples instead of being silently ignored (#858).

Dependencies

• quic 1.4.5 -> 1.6.3.
• h2 0.6.1 -> 0.8.0.

... (truncated)

Changelog

Sourced from hackney's changelog.

4.3.0 - 2026-06-12

Added

• Opt-in pooling of HTTPS/1.1 connections. With {ssl_pooling, true} (request option, or the ssl_pooling application env; default false) an upgraded SSL connection returns to the pool keyed by the hash of its effective TLS options and is reused only on an exact match, skipping the TLS handshake on follow-up requests. The default is unchanged: SSL connections are closed at checkin. (#872)
• TLS 1.3 session resumption for requests using hackney's default TLS config. When no ssl_options are passed, connections are opened with {session_tickets, auto} so fresh connections to the same server resume the session instead of paying a full handshake. Disable with the tls_session_resumption application env (default true). Requests with custom ssl_options deliberately get no resumption: OTP's ticket store is node-global and a resumed handshake skips certificate validation, so only the shared default trust config may use it (trust isolation). (#872)

Changed

• Shared HTTP/2 connections are keyed by the effective TLS options, and shared HTTP/3 connections plus cached 0-RTT session tickets by the QUIC trust options. Requests with different ssl_options no longer share a multiplexed connection or resume each other's tickets.
• The TLS options hash computed for every pooled HTTPS request is memoized in a bounded ETS cache keyed by the pre-merge inputs and the relevant application envs, skipping a sha256 over the full CA bundle on cache hits.
• SNI handling. No server_name_indication is sent when the host is an IP literal (RFC 6066), on HTTP/1.1, HTTP/2 and HTTP/3. A user-supplied server_name_indication in ssl_options is now honored consistently as both the wire value and the hostname-verification target, works on the HTTP/3 path too, and disable suppresses SNI without weakening verification.
• Bump quic to 1.6.5 and webtransport to 0.4.0.

4.2.3 - 2026-06-10

Dependencies

• h2 0.8.0 -> 0.9.0.
• webtransport 0.3.2 -> 0.3.3.
• parse_trans 3.4.1 -> 3.4.2.
• cowboy 2.12.0 -> 2.16.0 (test only); ranch test helper updated for the ranch 2.x protocol callback.

4.2.2 - 2026-06-07

... (truncated)

Commits

• 7cc30cc Release 4.3.0
• ce45e6c Merge pull request #874 from benoitc/feature/sni-and-dep-bumps
• ec5ac8f Apply SNI fixes to the proxy leg and unify ssl option building
• cddb839 Improve client-side SNI handling
• 442c980 Bump quic to 1.6.5 and webtransport to 0.4.0
• 48094e7 Merge pull request #873 from benoitc/feature/872-ssl-pooling
• d3a44ed Memoize the TLS options hash in a bounded ETS cache
• 0ae01e1 Enable TLS 1.3 session resumption for default TLS config
• a62d2e5 Pool HTTPS/1.1 connections behind the ssl_pooling option
• de151bd Key shared HTTP/3 connections and 0-RTT tickets by TLS trust options
• Additional commits viewable in compare view

[dependabot]

Superseded by #490.