chore(deps): bump hackney from 1.25.0 to 4.7.4

[dependabot]

Bumps hackney from 1.25.0 to 4.7.4.

Release notes

Sourced from hackney's releases.

4.7.4

Fixed

• A connection attempt that outlives its timeout no longer terminates the pool, and with it every caller of that pool. The dial is made with the request's connect_timeout, and a call that times out, like a connection process that dies while dialing, comes back as a checkout error (#927, #928, thanks @​aboroska).
• Handing a pooled connection to a new owner, and the prewarm dial, are guarded like the other calls the pool makes into a connection process. A connection that is gone or wedged is dropped instead of taking the pool down (#929).
• Stopping a connection from inside the pool is bounded to 100ms, after which the connection is killed. A connection wedged in a transport call, which a failed dial makes likely, used to hold every caller of the pool for as long as the transport took to return (#929).
• The health probes the pool runs on a connection (is_ready, checkin_info, set_owner, get_state) take an explicit timeout, and the pool passes 250ms. h2_conn_usable/1 used the 5s default, so one wedged HTTP/2 connection stalled the pool for 5 seconds on every checkout for that host (#929).

Added

• Fault injection test harness for the pool: a transport which can be told to misbehave, a sentinel which makes a dead pool visible, fault and chaos suites, and a structural test which fails if the pool calls a connection process outside a try. DEVELOPMENT.md explains how to use it (#929).

Changed

• Update dependencies to their latest releases: h2 0.12.0 and webtransport 0.4.5 (#930).

4.7.3

hackney 4.7.3 is a bugfix and hardening release for the Erlang HTTP client. It clears a few ways a pooled connection could stall or leak, hardens CRLF handling on the proxy and streaming request paths, restores curl-style Content-Length: 0 on empty POST/PUT/PATCH bodies (so servers such as AWS that require the header are happy again), and refreshes every dependency to its latest release.

Upgrading from 4.7.2 needs no code changes.

Fixed

• Reusing a pooled HTTP/2 or HTTP/3 connection no longer crashes the caller of hackney:connect/4 when the pooled connection terminates during the checkout liveness probe. The get_state probe is guarded so a terminating connection falls through to a fresh one (#914).
• hackney_url:normalize/2 now rejects a host that reaches an IP literal only after IDNA folds the Unicode full-stop variants (U+3002/U+FF0E/U+FF61) to ASCII dots (for example 127。0。0。1 becoming 127.0.0.1), closing a bypass of the percent-encoded-IP check.
• The CONNECT proxy handshake rejects CR/LF/NUL in the target host instead of concatenating it into the request line and Host header.

... (truncated)

Changelog

Sourced from hackney's changelog.

4.7.4 - 2026-08-12

Fixed

• A connection attempt that outlives its timeout no longer terminates the pool, and with it every caller of that pool. The dial is made with the request's connect_timeout, and a call that times out, like a connection process that dies while dialing, comes back as a checkout error (#927, #928, thanks @​aboroska).
• Handing a pooled connection to a new owner, and the prewarm dial, are guarded like the other calls the pool makes into a connection process. A connection that is gone or wedged is dropped instead of taking the pool down (#929).
• Stopping a connection from inside the pool is bounded to 100ms, after which the connection is killed. A connection wedged in a transport call, which a failed dial makes likely, used to hold every caller of the pool for as long as the transport took to return (#929).
• The health probes the pool runs on a connection (is_ready, checkin_info, set_owner, get_state) take an explicit timeout, and the pool passes 250ms. h2_conn_usable/1 used the 5s default, so one wedged HTTP/2 connection stalled the pool for 5 seconds on every checkout for that host (#929).

Added

• Fault injection test harness for the pool: a transport which can be told to misbehave, a sentinel which makes a dead pool visible, fault and chaos suites, and a structural test which fails if the pool calls a connection process outside a try. DEVELOPMENT.md explains how to use it (#929).

Changed

• Update dependencies to their latest releases: h2 0.12.0 and webtransport 0.4.5 (#930).

4.7.3 - 2026-08-11

Fixed

• Reusing a pooled HTTP/2 or HTTP/3 connection no longer crashes the caller of hackney:connect/4 when the pooled connection terminates during the checkout liveness probe. The get_state probe is guarded so a terminating connection falls through to a fresh one (#914).
• hackney_url:normalize/2 now rejects a host that reaches an IP literal only after IDNA folds the Unicode full-stop variants (U+3002/U+FF0E/U+FF61) to ASCII dots (for example 127。0。0。1 becoming 127.0.0.1), closing a bypass of the percent-encoded-IP check.
• The CONNECT proxy handshake rejects CR/LF/NUL in the target host instead of concatenating it into the request line and Host header.

... (truncated)

Commits

• 9928f3c Merge pull request #931 from benoitc/release/4.7.4
• 77bfbe1 Release 4.7.4
• d1c6b4b Merge pull request #930 from benoitc/deps/h2-webtransport-bump
• e77b7b7 Bump h2 to 0.12.0 and webtransport to 0.4.5
• affd91d Merge pull request #929 from benoitc/test/pool-fault-injection
• 86180b6 Merge pull request #928 from aboroska/fix-slow-connect-crashing-pool
• c6be2ec Wait for the crash sentinel to stop before starting a new one
• 721cf78 Bound every health probe the pool makes on a connection
• 6a1b671 Add fault injection and chaos tests for the pool
• c8c0895 Survive a connection process dying mid-connect
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like hackney is up-to-date now, so this is no longer needed.