fix(deps): bump hackney to 4.x to address security advisories#104
fix(deps): bump hackney to 4.x to address security advisories#104jtippett wants to merge 1 commit into
Conversation
hackney <= 4.0.1 is affected by a batch of advisories fixed in 4.0.2+ (e.g. CVE-2026-47075 CRLF injection / HTTP request splitting, CVE-2026-47066 infinite loop, CVE-2026-47070, CVE-2026-47077). There is no 1.x backport, so the previous `~> 1.9` constraint could only resolve to vulnerable releases. Widen the constraint to `~> 1.21 or ~> 4.0 and >= 4.0.2`, mirroring Tesla's own hackney adapter constraint, and update the lock so it resolves to hackney 4.4.5. Tesla is bumped 1.8.0 -> 1.20.0 because older Tesla capped its optional hackney dependency at `~> 1.6`, which blocked 4.x resolution. workos uses hackney only as the default Tesla adapter (never directly), and the test suite runs against Tesla.Mock, so the major bump is absorbed by Tesla's adapter. Full suite passes (113 tests).
Greptile SummaryThis PR updates the HTTP dependency set used by the SDK. The main changes are:
Confidence Score: 5/5The dependency-only changes are merge-safe based on the provided compile, test, and audit verification. The changed files are limited to dependency constraints and lockfile updates, and the described verification covers compilation, the test suite, and package audit results.
 T-Rex LogsWhat T-Rex did
Reviews (1): Last reviewed commit: "fix(deps): bump hackney to 4.x to addres..." | Re-trigger Greptile |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cd57e85968
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "idna": {:hex, :idna, "6.1.1", "8a63070e9f7d0c62eb9d9fcb360a7de382448200fbbd1b106cc96d3d8099df8d", [:rebar3], [{:unicode_util_compat, "~> 0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "92376eb7894412ed19ac475e4a86f7b413c1b9fbb5bd16dccd57934157944cea"}, | ||
| "jason": {:hex, :jason, "1.4.1", "af1504e35f629ddcdd6addb3513c3853991f694921b1b9368b0bd32beb9f1b63", [:mix], [{:decimal, "~> 1.0 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "fbb01ecdfd565b56261302f7e1fcc27c4fb8f32d56eab74db621fc154604a7a1"}, | ||
| "h2": {:hex, :h2, "0.10.2", "ea0146b9c8b5f3b5de16045765f5684db38ef1e66f1c60444890948cb1003e47", [:rebar3], [], "hexpm", "497a899f338b42e6a0b292524e635b0ce6f9379fa39395c8e38d06351cd9b9cf"}, | ||
| "hackney": {:hex, :hackney, "4.4.5", "a908f620525bb886a16613532324762e5166287f8c00c9888a762edee11a30c0", [:rebar3], [{:certifi, "~> 2.17.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:h2, "~> 0.10.1", [hex: :h2, repo: "hexpm", optional: false]}, {:idna, "~> 7.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:mimerl, "~> 1.4", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.4.2", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:quic, "~> 1.6.5", [hex: :quic, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:webtransport, "~> 0.4.1", [hex: :webtransport, repo: "hexpm", optional: false]}], "hexpm", "6d72bef4e135e94c522c271e11fbb6933efb0006ef235a3933807d0be73b71ec"}, |
There was a problem hiding this comment.
The CI matrix still includes an OTP 25.3 job (.github/workflows/main.yml:30-31) and that job runs mix do deps.get, deps.compile (.github/workflows/main.yml:57-59), but this lock entry makes quic a non-optional transitive dependency of hackney 4.4.5. quic 1.6.x declares {minimum_otp_vsn, "26"}, so the OTP 25 job and users on that still-supported runtime will fail during dependency compilation even though mix.exs still advertises broad Elixir support. Please either drop OTP 25 support or avoid resolving a hackney version that pulls this OTP 26-only dependency for supported builds.
Useful? React with 👍 / 👎.
1 participant
Summary
hackneyreleases<= 4.0.1are affected by a batch of security advisories fixed in hackney 4.0.2+, including:There is no 1.x backport, so the previous
{:hackney, "~> 1.9"}constraint could only ever resolve to vulnerable releases (the lockfile sat at1.20.1).Changes
~> 1.21 or ~> 4.0 and >= 4.0.2, mirroring Tesla's own hackney adapter constraint. This keeps backward compatibility for downstream consumers still on hackney 1.x while allowing (and, on a fresh resolve, preferring) the patched 4.x line.mix.lockso it resolves to hackney 4.4.5.~> 1.6, which blocked 4.x resolution. Recent Tesla declares~> 1.21 or ~> 4.0 and >= 4.0.2and its hackney adapter supports the 4.x API.Why this is low-risk
Tesla.Mock, so hackney isn't exercised in tests.Verification
MIX_ENV=prod mix compile --force— clean compile with hackney 4.4.5 + tesla 1.20.0.mix test— 113 passed.mix hex.audit— no retired packages.