Override hackney to 4.x to clear 1.x security advisories

[clairenlin]

What & why

Every application depending on zexbox is being flagged for hackney security advisories. This fixes the root cause.

Root cause: zexbox → instream (2.2.1, latest, released 2023) → hackney. instream hard-depends on {:hackney, "~> 1.1", optional: false}, so hackney is always compiled in and pinned to the 1.x line. hackney 1.25.0 carries four open advisories, all fixed only in 4.0.1+:

Advisory	Severity
GHSA-gp9c-pm5m-5cxr ssl:connect/2 post-handshake upgrade has no timeout	high
GHSA-j9wq-vxxc-94wf CR/LF injection in query parameter	moderate
GHSA-pj7v-xfvx-wmjq SSRF allowlist bypass via percent-encoded host	moderate
GHSA-mp55-p8c9-rfw2 CRLF / header injection via domain/path	low

Why all consumers see it: zexbox's audit alias silenced this locally with --ignore-package-names hackney, but that flag only applies to zexbox's own mix audit run. Downstream apps run their own audits / Dependabot, which don't inherit the flag — so vulnerable hackney 1.25.0 lights up everywhere.

Fix

Override to a patched hackney "~> 4.0" (resolves to 4.6.0). 4.x is a documented drop-in for the request/5 + body/1 API instream uses; it also bumps cowlib/gun so the raw audit is now completely clean. The --ignore-package-names hackney workaround is removed.

⚠️ Consumers must act

Mix ignores :override in nested dependencies — it's only honoured in the top-level project. So this override fixes zexbox's own CI but does not transitively fix consuming apps. Each consuming app must add to its own deps:

{:hackney, "~> 4.0", override: true}

Once this ships, apps still on the old resolution will hit a dependency-divergence error on mix deps.get (instream's ~> 1.1 vs zexbox's ~> 4.0) until they add the override. That's a deliberate, loud forcing function for a security fix — flagging it here so the rollout can be coordinated. README + CHANGELOG document it.

Verification

• mix deps.get → hackney 4.6.0
• mix compile → clean (only pre-existing instream deprecation warning)
• mix audit → No vulnerabilities found
• mix test → 34 tests, 0 failures

🤖 Generated with Claude Code