Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 28, 2025

Bumps hackney from 1.22.0 to 1.25.0.

Release notes

Sourced from hackney's releases.

1.25.0 - 2025-07-24

IMPORTANT CHANGE

  • change: insecure_basic_auth now defaults to true instead of false

    This restores backward compatibility with pre-1.24.0 behavior where basic auth was allowed over HTTP connections. If you need strict HTTPS-only basic auth:

    • Set globally: application:set_env(hackney, insecure_basic_auth, false)
    • Or per-request: {insecure_basic_auth, false} in options

Hex.pm : https://hex.pm/packages/hackney/1.25.0 Doc: https://hexdocs.pm/hackney/readme.html

1.24.1 - 2025-05-26

Changes

1.24.1 - 2025-05-26

  • fix: remove unused variable warning in hackney.erl

1.24.0 - 2025-05-26

  • security: fix basic auth credential exposure vulnerability
  • security: add application variable support for insecure_basic_auth
  • fix: NXDOMAIN error in Docker Compose environments (issue #764)
  • fix: stream_body timeout after first chunk (issue #762)
  • fix: SSL hostname verification with custom ssl_options and SSL message leak in async streaming
  • fix: pool connections not freed on 307 redirects and multiple pool/timer race conditions
  • fix: socket leaks, process deadlocks, ETS memory leaks, and infinite gen_server calls
  • fix: controlling_process error handling in happy eyeballs and connection pool return
  • improvement: update GitHub Actions to ubuntu-22.04 and bump certifi/mimerl dependencies

Breaking Change

The new insecure_basic_auth application variable defaults to false for security. If your application relies on insecure basic auth over HTTP, you must explicitly set application:set_env(hackney, insecure_basic_auth, true) to maintain previous behavior.

Hex.pm : https://hex.pm/packages/hackney/1.24.1 Doc: https://hexdocs.pm/hackney/readme.html

1.24.0 - 2025-05-26

Changes

  • security: fix basic auth credential exposure vulnerability

... (truncated)

Changelog

Sourced from hackney's changelog.

1.25.0 - 2025-07-24

** IMPORTANT CHANGE **

  • change: insecure_basic_auth now defaults to true instead of false

    This restores backward compatibility with pre-1.24.0 behavior where basic auth was allowed over HTTP connections. If you need strict HTTPS-only basic auth:

    • Set globally: application:set_env(hackney, insecure_basic_auth, false)
    • Or per-request: {insecure_basic_auth, false} in options

1.24.1 - 2025-05-26

  • fix: remove unused variable warning in hackney.erl

1.24.0 - 2025-05-26

  • security: fix basic auth credential exposure vulnerability
  • security: add application variable support for insecure_basic_auth
  • fix: NXDOMAIN error in Docker Compose environments (issue #764)
  • fix: stream_body timeout after first chunk (issue #762)
  • fix: SSL hostname verification with custom ssl_options and SSL message leak in async streaming
  • fix: pool connections not freed on 307 redirects and multiple pool/timer race conditions
  • fix: socket leaks, process deadlocks, ETS memory leaks, and infinite gen_server calls
  • fix: controlling_process error handling in happy eyeballs and connection pool return
  • improvement: update GitHub Actions to ubuntu-22.04 and bump certifi/mimerl dependencies

1.23.0 - 2025-02-25

  • fix: happy eyeball use correct timeout during connection
  • fix: don't wrap connection error
  • improvement: only spawn ipv6 worker when needed
Commits
  • 8c00789 Merge pull request #778 from benoitc/insecure-basic-auth-default-true
  • a1d4108 change insecure_basic_auth default to true
  • e2bbdf7 bump unicode compat lib
  • 3b901a6 update readme
  • d59b422 fix: remove unused variable warning and bump version to 1.24.1
  • 30447da fix version in readme
  • fd82258 fix documentation warnings
  • 1239ec6 update NEWS.md with stream_body timeout fix for issue #762
  • 96e881e fix stream_body timeout issue by reverting breaking error format change
  • 431b4f5 Fix typos in NEWS.md
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [hackney](https://github.com/benoitc/hackney) from 1.22.0 to 1.25.0.
- [Release notes](https://github.com/benoitc/hackney/releases)
- [Changelog](https://github.com/benoitc/hackney/blob/master/NEWS.md)
- [Commits](benoitc/hackney@1.22.0...1.25.0)

---
updated-dependencies:
- dependency-name: hackney
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested review from noslav and rogarcia July 28, 2025 18:37
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jul 28, 2025

The reviewers field in the dependabot.yml file will be removed soon. Please use the code owners file to specify reviewers for Dependabot PRs. For more information, see this blog post.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code labels Jul 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file elixir Pull requests that update Elixir code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants