4.10.0

Security

• A server could make hackney buffer an unlimited amount of data despite
  max_body_size, by sending an HTTP/1.1 chunked body made of one very
  large chunk: the limit was only checked once a whole chunk had arrived.
  Chunk data is now handed on as it arrives, so the limit holds and
  streamed reads no longer wait for the end of a chunk. A chunk-size line
  longer than 4096 bytes or a size of more than 16 hex digits is now
  refused.

Changed

• An HTTP/2 or HTTP/3 request made when the connection is at the server's
  limit on concurrent streams now waits for a free stream instead of
  failing at once. Many servers allow 100 or 128 at a time, so a
  burst of requests used to fail where HTTP/1.1 would have queued them. A
  request waits up to checkout_timeout, then fails with
  checkout_timeout. Based on work by Lennart Schoch (#972).
• A request the server refused without processing it, because of a
  GOAWAY, an HTTP/2 refused stream or an HTTP/3 rejected request, is now
  sent once more on a fresh connection, whatever its method. It used to
  fail, and most callers did not know that error was safe to retry. A body
  given as a function is not sent twice. Based on work by Lennart Schoch
  (#971).
• quic 2.6.1, h2 0.15.0 and webtransport 0.5.3. These bring fixes for an
  HTTP/3 header block that could keep a CPU busy for minutes, and for two
  HTTP/2 denial-of-service attacks (MadeYouReset and SETTINGS flood), plus
  many protocol conformance and reliability fixes.
• WebTransport now speaks draft-17 over HTTP/3 and draft-16 over HTTP/2.
  Servers on older drafts may no longer connect; a draft07 compat mode
  is available for draft-07 servers. WebTransport over HTTP/2 now needs
  TLS 1.3.
• When an HTTP/3 server closes the connection with an error code, the
  error you get now carries that code and phrase instead of reporting a
  normal close.

Added

• WebTransport subprotocol negotiation with the protocols and
  require_protocol options of wt_connect. The server's choice is in
  wt_session_info/1.
• In active mode, WebTransport sends {stream_credit, bidi | uni} once the
  server allows more streams after wt_open_stream/2 hit its limit.

Fixed

• An HTTP/3 request whose stream the server reset after sending headers
  waited until its timeout. It now fails at once with the reset reason.
• A request body given as a function crashed the connection on HTTP/2
  and HTTP/3; it worked only on HTTP/1.1. It is now sent as the function
  yields it, on all three. If the function fails part way, you get its
  error and the half-sent request is cancelled (#1001).
• wt_close/2 with a reason longer than 1024 bytes returned ok but
  never closed the session. It now returns an error and the session stays
  open. The same now applies to an error code over 32 bits or a reason
  that is not valid UTF-8, which the drafts forbid.
• Reading a chunked HTTP/1.1 body no longer slows down with large chunks.
  The time grew with the square of the chunk size: a 16 MB body sent as
  one chunk took about 10 seconds on loopback, and now takes about 25 ms
  (#998, #378).
• Pooled requests to http+unix URLs now work. They always failed with
  nxdomain, so only unpooled requests could reach a unix socket. Socket
  paths with capital letters also work now (#997).
• hackney:cookies/1 no longer crashes when a response has an empty
  Set-Cookie header; that header is skipped and the other cookies are
  returned (#994).