hackney Files

hackney 4.7.3 is a bugfix and hardening release for the Erlang HTTP client. It clears a few ways a pooled connection could stall or leak, hardens CRLF handling on the proxy and streaming request paths, restores curl-style Content-Length: 0 on empty POST/PUT/PATCH bodies (so servers such as AWS that require the header are happy again), and refreshes every dependency to its latest release.

Upgrading from 4.7.2 needs no code changes.

Fixed

• Reusing a pooled HTTP/2 or HTTP/3 connection no longer crashes the caller of hackney:connect/4 when the pooled connection terminates during the checkout liveness probe. The get_state probe is guarded so a terminating connection falls through to a fresh one (#914).
• hackney_url:normalize/2 now rejects a host that reaches an IP literal only after IDNA folds the Unicode full-stop variants (U+3002/U+FF0E/U+FF61) to ASCII dots (for example 127。0。0。1 becoming 127.0.0.1), closing a bypass of the percent-encoded-IP check.
• The CONNECT proxy handshake rejects CR/LF/NUL in the target host instead of concatenating it into the request line and Host header.
• The pooled HTTPS upgrade bounds the TLS handshake with connect_timeout (ssl:connect/3), so a server that stalls the handshake no longer pins the connection process and its pool slot (#916).
• The streaming request path sanitizes header values (CR/LF) like the buffered path, and the request method is validated (CR/LF/NUL) at every entry point, not just the request target.
• A response body cut short by the peer closing mid-transfer no longer leaks the connection process. read_full_body/2 hands back socket = undefined, so the connection went straight to closed and never reached the reuse check added for [#902]. An unpooled connection arms no grace timer there and, when started under hackney_conn_sup, has the supervisor as its owner, so the owner-DOWN clause never fired either: the process parked forever holding every refc binary it had read. Callers could not clean up, since a synchronous request returns the body directly and the truncated read still reports {ok, Body} (#918). The same applies to a failed body read and to bodyless (204/304) responses.
• hackney_conn:get_location/1 and set_location/2 no longer exit with noproc when the connection has already stopped, which would otherwise propagate out of hackney:request/5 on the redirect path.

Changed

• Like curl, an empty body on a body-bearing method (POST/PUT/PATCH) now sends Content-Length: 0; bodyless methods (GET/HEAD/DELETE) are unchanged (#917).
• Update dependencies to their latest releases: quic 1.8.0, webtransport 0.4.4, mimerl 1.5.0, and cowboy 2.18.0 for the test suite.