[dependabot]

Bumps the prod group with 1 update: hackney.

Updates hackney from 4.8.6 to 4.9.1

Release notes

Sourced from hackney's releases.

4.9.1

Fixed

• The documentation builds again. A misplaced doc comment in 4.9.0 made edoc fail, which also blocked publishing that release to Hex.

4.9.0

Added

• A max_body_size request option caps a response body that hackney buffers for you (the default hackney:request result, or body/1). It defaults to 512 MiB and also accepts the 1.x name max_body; infinity turns it off (#980).

Fixed

• URLs that hide a loopback or private IP inside a percent-encoded bracketed IPv6 address, or behind a trailing dot, are now refused like other IP literals. The earlier fix for CVE-2026-47076 missed these two spellings, so such a URL still reached the address it denotes (#987).
• Pinning your own CA with cacerts or cacertfile now actually limits which servers are trusted. hackney still accepted any certificate chain that included a publicly trusted root, so a pinned connection could reach a server its CA never vouched for (#978).
• Following a redirect no longer resends basic_auth and cookie to another port on the same host, or over plain HTTP after HTTPS. Only a redirect to the same scheme, host and port keeps them, unless you set location_trusted (#979).
• A server sending an endless or highly compressed body can no longer exhaust memory. Buffered bodies had no limit on HTTP/1.1, HTTP/2 and HTTP/3, and auto_decompress inflated the whole body at once. Both now stop at max_body_size with {error, body_too_large} (#980).
• HTTPS proxies reached through CONNECT now get the same certificate checks as the target: hackney's CA bundle and a hostname check against the proxy. The connection to the proxy only set the server name, so on OTP 27 and later it failed unless proxy_ssl_options set cacerts or verify_none. An explicit {verify, verify_none} is still honoured (#988).
• A proxy_auth_fun that returns a value containing CR, LF or NUL is now refused with {error, {proxy_auth_error, invalid_header}}. The value was written as is into the CONNECT request, so those bytes added header lines of their own (#989).
• A slow or unreachable host no longer stalls every request that goes through the same pool. The pool opened new connections itself, so while one host took its time to answer, checkouts for every other host waited, for up to connect_timeout. The requester now opens its own connection, as in hackney 1.x (#973).
• A failed TLS handshake on a pooled connection no longer frees a max_per_host slot held by another request. The slot was released twice, so the host could get one more concurrent connection than allowed (#984).

... (truncated)

Changelog

Sourced from hackney's changelog.

4.9.1 - 2026-10-26

Fixed

• The documentation builds again. A misplaced doc comment in 4.9.0 made edoc fail, which also blocked publishing that release to Hex.

4.9.0 - 2026-10-25

Added

• A max_body_size request option caps a response body that hackney buffers for you (the default hackney:request result, or body/1). It defaults to 512 MiB and also accepts the 1.x name max_body; infinity turns it off (#980).

Fixed

• URLs that hide a loopback or private IP inside a percent-encoded bracketed IPv6 address, or behind a trailing dot, are now refused like other IP literals. The earlier fix for CVE-2026-47076 missed these two spellings, so such a URL still reached the address it denotes (#987).
• Pinning your own CA with cacerts or cacertfile now actually limits which servers are trusted. hackney still accepted any certificate chain that included a publicly trusted root, so a pinned connection could reach a server its CA never vouched for (#978).
• Following a redirect no longer resends basic_auth and cookie to another port on the same host, or over plain HTTP after HTTPS. Only a redirect to the same scheme, host and port keeps them, unless you set location_trusted (#979).
• A server sending an endless or highly compressed body can no longer exhaust memory. Buffered bodies had no limit on HTTP/1.1, HTTP/2 and HTTP/3, and auto_decompress inflated the whole body at once. Both now stop at max_body_size with {error, body_too_large} (#980).
• HTTPS proxies reached through CONNECT now get the same certificate checks as the target: hackney's CA bundle and a hostname check against the proxy. The connection to the proxy only set the server name, so on OTP 27 and later it failed unless proxy_ssl_options set cacerts or verify_none. An explicit {verify, verify_none} is still honoured (#988).
• A proxy_auth_fun that returns a value containing CR, LF or NUL is now refused with {error, {proxy_auth_error, invalid_header}}. The value was written as is into the CONNECT request, so those bytes added header lines of their own (#989).
• A slow or unreachable host no longer stalls every request that goes through the same pool. The pool opened new connections itself, so while one host took its time to answer, checkouts for every other host waited, for up to connect_timeout. The requester now opens its own connection, as in hackney 1.x (#973).

... (truncated)

Commits

• 69d7e7a Merge pull request #993 from benoitc/release/4.9.1
• e2aa38e Release 4.9.1
• e5b956c Fix edoc: move stop_conn/1 doc back above it
• 0f5db33 Merge pull request #992 from benoitc/release/4.9.0
• f66e393 Release 4.9.0
• 535b112 Merge pull request #989 from benoitc/fix/proxy-auth-header-ctl
• 5ee7d7d Refuse CR/LF/NUL in the proxy_auth_fun result
• 77792c4 Merge pull request #988 from benoitc/fix/connect-proxy-tls-verify
• 6823f5c Verify HTTPS CONNECT proxies like the target
• b1f0a41 Merge pull request #987 from benoitc/fix/normalize-ip-literal-forms
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions