From 555b59998a45e5489330aa70b7f039ff9a19e675 Mon Sep 17 00:00:00 2001 From: Benoit Chesneau Date: Thu, 24 Sep 2026 10:09:53 +0200 Subject: [PATCH] Release 4.8.0 --- NEWS.md | 18 ++++++++++++++++-- SECURITY.md | 3 ++- src/hackney.app.src | 2 +- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/NEWS.md b/NEWS.md index 86b4fe2e..417479c5 100644 --- a/NEWS.md +++ b/NEWS.md @@ -1,7 +1,7 @@ # NEWS -unreleased ----------- +4.8.0 - 2026-09-24 +------------------ ### Fixed @@ -50,6 +50,20 @@ unreleased option. It was handed to quic, which only takes DER `cacerts`, so it was ignored and verification failed as `{error, timeout}`. `hackney:request/5` was not affected. +- Connection-specific headers are dropped from HTTP/2 and HTTP/3 requests. + A caller's `Connection: keep-alive`, legal in HTTP/1.1 and banned by + RFC 9113 8.2.2 and RFC 9114 4.2, reached the header block and every request + failed before anything was written. hackney picks the protocol through ALPN, + so the caller cannot know which rules apply: `Connection`, `Keep-Alive`, + `Proxy-Connection`, `Transfer-Encoding` and `Upgrade` are stripped alongside + `Host`. `TE` is kept, being allowed with the value `trailers` + (#935, thanks @lennartschoch). +- A pooled HTTP/1.1 connection handed to a requester no longer closes itself + under the request. Checkout left the keepalive timer running, armed before + the readiness probe, so a connection could pass the probe and then fire the + timer, and the request that followed came back as `{error, invalid_state}`. + The timer is disarmed on checkout and re-armed when the connection returns + to the pool (#934, thanks @lennartschoch). - A request that races a peer-initiated close now returns `{error, closed}` instead of `{error, invalid_state}`. A connection that sees the peer close stays alive briefly so late calls get an answer, and during that window every diff --git a/SECURITY.md b/SECURITY.md index 8ddcaabd..1b656e4c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,8 @@ ## Supported Versions -Security fixes are applied to the latest minor release on the `master` branch. +Security fixes are applied to the latest minor release on the `master` branch, +currently the 4.8.x line. | Version | Supported | | ------- | --------- | diff --git a/src/hackney.app.src b/src/hackney.app.src index 756941ba..349a2d3e 100644 --- a/src/hackney.app.src +++ b/src/hackney.app.src @@ -4,7 +4,7 @@ {application, hackney, [ {description, "Simple HTTP client with HTTP/1.1, HTTP/2, and HTTP/3 support"}, - {vsn, "4.7.4"}, + {vsn, "4.8.0"}, {registered, [hackney_pool]}, {applications, [kernel, stdlib,