From 7e4d828a736202593c101ee5fb783fd0edd59669 Mon Sep 17 00:00:00 2001
From: janwillemvd <jan-willem@qdentity.nl>
Date: Sun, 9 Aug 2026 09:45:50 +0200
Subject: [PATCH] Allow hackney 4.x

excontainers only reaches hackney through Tesla.Adapter.Hackney and makes no
direct :hackney calls, so it can follow Tesla's supported range. Pinning to
~> 1.16 was holding consumers on hackney 1.x, which carries four unpatched
advisories (GHSA-gp9c-pm5m-5cxr high, GHSA-j9wq-vxxc-94wf, GHSA-mp55-p8c9-rfw2,
GHSA-pj7v-xfvx-wmjq), all first patched in 4.0.1.
---
 mix.exs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mix.exs b/mix.exs
index 8812633..5ff1978 100644
--- a/mix.exs
+++ b/mix.exs
@@ -47,7 +47,9 @@ defmodule Excontainers.MixProject do
       # {:dep_from_hexpm, "~> 0.3.0"},
       # {:dep_from_git, git: "https://github.com/elixir-lang/my_dep.git", tag: "0.1.0"}
 
-      {:hackney, "~> 1.16"},
+      # Only ever reached through Tesla.Adapter.Hackney, so we mirror Tesla's own
+      # supported range: hackney 2.x/3.x/4.0.0/4.0.1 lack exports Tesla relies on.
+      {:hackney, "~> 1.16 or ~> 4.0 and >= 4.0.2"},
       {:jason, ">= 1.0.0"},
       {:tesla, "~> 1.4"},
       {:gestalt, "~> 1.0 or ~> 2.0"},