4.9.0

Added

• A max_body_size request option caps a response body that hackney
  buffers for you (the default hackney:request result, or body/1).
  It defaults to 512 MiB and also accepts the 1.x name max_body;
  infinity turns it off (#980).

Fixed

• URLs that hide a loopback or private IP inside a percent-encoded
  bracketed IPv6 address, or behind a trailing dot, are now refused like
  other IP literals. The earlier fix for CVE-2026-47076 missed these two
  spellings, so such a URL still reached the address it denotes (#987).
• Pinning your own CA with cacerts or cacertfile now actually limits
  which servers are trusted. hackney still accepted any certificate chain
  that included a publicly trusted root, so a pinned connection could reach
  a server its CA never vouched for (#978).
• Following a redirect no longer resends basic_auth and cookie to
  another port on the same host, or over plain HTTP after HTTPS. Only a
  redirect to the same scheme, host and port keeps them, unless you set
  location_trusted (#979).
• A server sending an endless or highly compressed body can no longer
  exhaust memory. Buffered bodies had no limit on HTTP/1.1, HTTP/2 and
  HTTP/3, and auto_decompress inflated the whole body at once. Both now
  stop at max_body_size with {error, body_too_large} (#980).
• HTTPS proxies reached through CONNECT now get the same certificate checks
  as the target: hackney's CA bundle and a hostname check against the
  proxy. The connection to the proxy only set the server name, so on
  OTP 27 and later it failed unless proxy_ssl_options set cacerts or
  verify_none. An explicit {verify, verify_none} is still honoured (#988).
• A proxy_auth_fun that returns a value containing CR, LF or NUL is now
  refused with {error, {proxy_auth_error, invalid_header}}. The value was
  written as is into the CONNECT request, so those bytes added header lines
  of their own (#989).
• A slow or unreachable host no longer stalls every request that goes
  through the same pool. The pool opened new connections itself, so while
  one host took its time to answer, checkouts for every other host waited,
  for up to connect_timeout. The requester now opens its own connection,
  as in hackney 1.x (#973).
• A failed TLS handshake on a pooled connection no longer frees a
  max_per_host slot held by another request. The slot was released twice,
  so the host could get one more concurrent connection than allowed (#984).

Changed

• Buffered downloads over 512 MiB now fail with {error, body_too_large}
  unless you raise max_body_size (#980).
• If you pin cacerts that include the bundled public roots, hackney no
  longer falls back to trusting a cross-signed root it finds in the
  server's chain. Add the root you need to your list, or pass your own
  partial_chain (#978).