chore(deps): bump hackney from 1.25.0 to 4.7.2

[dependabot]

Bumps hackney from 1.25.0 to 4.7.2.

Release notes

Sourced from hackney's releases.

4.7.2

Bump quic to 1.7.1. A clean QUIC connection close (idle pooled HTTP/3 connections, orderly shutdown) no longer emits ERROR and CRASH reports from quic_h3_connection nor propagates an abnormal exit to the connection owner. This also removes the intermittent eunit group cancellation in the h3/wt test suites.

See NEWS.md for details. PR #913.

4.7.1

Chunked decoding no longer fails with {error, invalid_chunk_size} when the CRLF terminating a chunk-size line is split across two socket reads (buffer ending on a lone \r). The parser now waits for the \n (#901).

A malformed chunk-size line or chunk terminator now fails cleanly with {error, invalid_chunk_size} or {error, poorly_formatted_chunked_size} instead of crashing the parser with a case_clause error.

See NEWS.md for details. PR #912.

4.7.0

HTTP/2 request bodies larger than the peer's flow control window no longer fail with {error, send_buffer_full}. Body sends block until the server opens the window, bounded by the new send_timeout option (default 30000 ms, infinity allowed, nonblock restores the old fail-fast behavior). If the window never opens the request fails with {error, timeout} and the abandoned stream is reset so its buffered body does not linger on a shared connection. Applies to whole-body and streamed HTTP/2 request bodies; HTTP/1.1 and HTTP/3 are unchanged.

HTTP/2 async requests now deliver their response messages: the stream entry stored an internal reference where the delivery code expected the stream_to pid, so every async HTTP/2 response was silently dropped.

HTTP/2 {async, once} now honors stream_next/1 with the same contract as HTTP/1.1: status and headers eagerly, then one message per pull. once streams use h2 manual flow control, so a slow consumer keeps the peer's window closed and in-flight data stays bounded to one window.

Connections created with hackney:connect/4 and {pool, false} honor a {send_timeout, T} connect option; pooled connections keep the default and take the per-request option instead.

See NEWS.md for details. PR #911.

4.6.1

Changed

• Bump h2 to 0.11.0. It adds h2:peername/1, which returns the peer's {IpAddress, Port} for a live connection. Additive only; no behavior change for hackney.

4.6.0

Added

• set_owner/2 now works while a response body is streaming, in both the synchronous and the async path. It used to return {error, invalid_state} once the body had started. This lets a short lived worker run a request and hand the still streaming response to a longer lived process before it exits, without stopping the connection.
• connect/4 accepts a binary host, restoring the 1.x behavior. A binary is converted to a string, so callers passing a binary host no longer fail.

Fixed

• A non-reusable connection (flagged no_reuse for proxy tunnels, SSL upgrades or a disabled pool, or answered with Connection: close) is now closed and its process stopped when a synchronous request completes, instead of parking in connected forever. With a long lived owner nothing stopped it, so one hackney_conn process leaked per request until the node ran out of memory (#902). The sync and async reuse decision now share the same check, which also stops a no_reuse pooled connection on the async path.

hackney 4.5.2

Dependency bump release. No API changes.

Changed

• Bump h2 to 0.10.4. It fixes a regression from 0.10.3 where a blocking send whose data had fully drained received {error, stream_closed} when the stream closed on its END_STREAM chunk. A waiting sender is now settled as ok once the send buffer has drained, and only gets the close-reason error when data is still outstanding.
• Bump quic to 1.7.0. Relevant to hackney's HTTP/3 client: the connection flow-control window now slides forward with received bytes instead of stalling after 8 MiB, so large HTTP/3 downloads keep flowing; the idle timer restarts on received activity per RFC 9000 §10.1; an invalid peer SETTINGS frame now closes the connection cleanly instead of crashing; and a client recognizes a server stateless reset (RFC 9000 §10.3) and closes promptly instead of waiting for the idle timeout.
• Bump webtransport to 0.4.3, which aligns its transitive h2 (0.10.4) and quic (1.7.0) dependencies with hackney's own, so the wt_* API runs on the same HTTP/2 and HTTP/3 stack versions.

4.5.1

Changed

... (truncated)

Changelog

Sourced from hackney's changelog.

4.7.2 - 2026-07-17

Changed

• Bump quic to 1.7.1. A clean QUIC connection close (idle pooled HTTP/3 connections, orderly shutdown) no longer emits ERROR and CRASH reports from quic_h3_connection nor propagates an abnormal exit to the connection owner. This also removes the intermittent eunit group cancellation in the h3/wt test suites.

4.7.1 - 2026-07-17

Fixed

• Chunked decoding no longer fails with {error, invalid_chunk_size} when the CRLF terminating a chunk-size line is split across two socket reads (buffer ending on a lone \r). The parser now waits for the \n (#901).
• A malformed chunk-size line or chunk terminator now fails cleanly with {error, invalid_chunk_size} or {error, poorly_formatted_chunked_size} instead of crashing the parser with a case_clause error.

4.7.0 - 2026-07-17

Fixed

• HTTP/2 request bodies larger than the peer's flow control window no longer fail with {error, send_buffer_full}. Body sends now block until the server opens the window with WINDOW_UPDATE frames, bounded by the new send_timeout request option (default 30000 ms, infinity allowed). If the window never opens the request fails with {error, timeout} instead of hanging, and the abandoned stream is reset (RST_STREAM) so its buffered body does not linger on a shared connection. Pass {send_timeout, nonblock} to restore the previous non-blocking behavior. Applies to whole-body and streamed HTTP/2 request bodies; HTTP/1.1 and HTTP/3 are unchanged.
• HTTP/2 async requests now deliver their response messages. The stream entry stored the internal call reference where the delivery code expected the stream_to pid, so every async HTTP/2 response was silently dropped and the caller never received {hackney_response, Ref, ...} messages.
• HTTP/2 {async, once} now honors stream_next/1 with the same contract as HTTP/1.1: status and headers are delivered eagerly, then each stream_next/1 delivers exactly one message (a body chunk or done). Previously every frame was pushed eagerly, identical to {async, true}. once-mode streams run h2 manual flow control, so a slow consumer keeps the peer's window closed and in-flight data stays bounded to one window.
• Connections created with hackney:connect/4 and {pool, false} honor a {send_timeout, T} connect option again (hackney:send_request/2 has no per-request options channel). Pooled connections keep the constant default

... (truncated)

Commits

• 9d684fb Release 4.7.2
• ed264d5 Merge pull request #913 from benoitc/bump/quic-1.7.1
• 3ba2d56 Bump quic to 1.7.1
• 447d868 Release 4.7.1
• 87a75e8 Merge pull request #912 from benoitc/fix/chunk-size-split-crlf
• 6a5db75 Wait for the LF when a chunk-size line splits on the CR
• 1c34f0b Release 4.7.0
• f62ce83 Merge pull request #911 from benoitc/fix/h2-blocking-send-flow-control
• 3818b68 Route raw-server test notifications through a collector
• 4589443 Fix review findings: h2 async once, manual send_timeout, dialyzer
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)