build(deps-dev): bump hackney from 1.25.0 to 4.8.4

[dependabot]

Bumps hackney from 1.25.0 to 4.8.4.

Release notes

Sourced from hackney's releases.

hackney 4.8.4

Fixed

• hackney:close/1 on a shared pooled HTTP/2 connection resets only the caller's own streams. It stopped the connection, failing every other caller's streams on it. The connection still closes itself once idle with no stream open.
• A connection opened without a pool honours connect_timeout above 8 seconds, and a dial that outlives it returns {error, connect_timeout}. The wait was capped at 8 seconds and ended as an exit in the caller. A dial stuck in the transport no longer holds the caller past its deadline either (#945).

hackney 4.8.3

Fixed

• hackney_conn:set_owner/2 works while a streamed request body is being sent. It returned {error, invalid_state}.
• A response body cut short by the server closing the connection is an error. For a chunked or Content-Length body, body/1 returns {error, {closed, Partial}} with the bytes that arrived, and stream_body/1 and async responses end with {error, closed}. They reported a short body as complete. A body with neither still ends when the connection closes.
• An HTTPS request through a CONNECT proxy reached over TLS ({proxy_transport, ssl}) works. The target TLS handshake ran over the proxy TLS socket as if it were plain TCP and failed.
• A pooled connection from hackney:connect/* stays with its caller between requests, and hackney:close/1 checks it back into the pool. It went back to the pool after every response while the caller still used it, so the pool could stop it in the middle of the next request ({error, closed}) or lend it to another process.

hackney 4.8.2

Fixed

• A connection opened without a pool is owned by the process that opened it and closes when that process dies. It was started under hackney_conn_sup and owned by it, so a killed caller left the connection and its socket open until the server closed it (idle_timeout defaults to infinity). Covers request/5 and connect/* with {pool, false}, streamed request bodies, async responses, HTTP proxies, CONNECT and SOCKS5 tunnels, HTTP/2 and HTTP/3, and h2_open/* streams. With stream_to, the stream_to process owns the connection, as before. hackney_conn:set_owner/2 still moves ownership.
• An HTTP/1.1 connection waiting for a response closes within a second of its owner dying. It was blocked in the socket read and noticed only when the response came, the server closed, or recv_timeout expired.
• A CONNECT or SOCKS5 tunnel socket belongs to its connection. It stayed with the process that opened it, so after hackney_conn:set_owner/2 it still

... (truncated)

Changelog

Sourced from hackney's changelog.

4.8.4 - 2026-09-27

Fixed

• hackney:close/1 on a shared pooled HTTP/2 connection resets only the caller's own streams. It stopped the connection, failing every other caller's streams on it. The connection still closes itself once idle with no stream open.
• A connection opened without a pool honours connect_timeout above 8 seconds, and a dial that outlives it returns {error, connect_timeout}. The wait was capped at 8 seconds and ended as an exit in the caller. A dial stuck in the transport no longer holds the caller past its deadline either (#945).

4.8.3 - 2026-09-27

Fixed

• hackney_conn:set_owner/2 works while a streamed request body is being sent. It returned {error, invalid_state}.
• A response body cut short by the server closing the connection is an error. For a chunked or Content-Length body, body/1 returns {error, {closed, Partial}} with the bytes that arrived, and stream_body/1 and async responses end with {error, closed}. They reported a short body as complete. A body with neither still ends when the connection closes.
• An HTTPS request through a CONNECT proxy reached over TLS ({proxy_transport, ssl}) works. The target TLS handshake ran over the proxy TLS socket as if it were plain TCP and failed.
• A pooled connection from hackney:connect/* stays with its caller between requests, and hackney:close/1 checks it back into the pool. It went back to the pool after every response while the caller still used it, so the pool could stop it in the middle of the next request ({error, closed}) or lend it to another process.

4.8.2 - 2026-09-26

Fixed

• A connection opened without a pool is owned by the process that opened it and closes when that process dies. It was started under hackney_conn_sup and owned by it, so a killed caller left the connection and its socket open until the server closed it (idle_timeout defaults to infinity). Covers request/5 and connect/* with {pool, false}, streamed request bodies, async responses, HTTP proxies, CONNECT and SOCKS5 tunnels, HTTP/2 and HTTP/3, and h2_open/* streams. With stream_to, the stream_to process owns the connection, as before. hackney_conn:set_owner/2 still moves

... (truncated)

Commits

• c0d4969 Merge pull request #960 from benoitc/release/4.8.4
• 3c80fae Wait for the pool checkin in h1_request_releases
• 065bd77 Release 4.8.4
• 652073e Merge pull request #959 from benoitc/fix/h2-close-shared
• d2a9982 Honour connect_timeout on a connection opened without a pool
• 93f22b5 Keep a shared HTTP/2 connection open on close/1
• c52f081 Merge pull request #958 from benoitc/release/4.8.3
• 4b720ed Release 4.8.3
• f44dcd9 Merge pull request #957 from benoitc/fix/pooled-reuse-after-body
• 83dd84b Keep a pooled connect/* conn with its caller until close
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)