[nelsonmestevao]

Why

hackney 1.x has five open advisories, and no 1.x fix is coming:
CVE-2026-47069, CVE-2026-47071, CVE-2026-47075, CVE-2026-47076 and CVE-2026-115693.

mix.exs still allowed ~> 1.20, so a project could resolve hackney 1.x through testcontainers and get all five. This PR requires ~> 4.9. httpoison 3.0 and ex_aws 2.7 already need hackney 4, so most projects are there already.

CVE-2026-115693 also affects hackney 4.x before 4.9.0, and it reaches testcontainers directly. Testcontainers.Connection.build_ssl_options/0 passes ca.pem from DOCKER_CERT_PATH as cacertfile. Before hackney 4.9.0, that CA did not limit trust: any chain ending in a public root was accepted. With DOCKER_TLS_VERIFY set, someone on the network path with a public cert for the Docker host's name could pose as the daemon.

What changed

mix.exs: {:hackney, "~> 4.9"}

mix.lock (mix hex.audit is now clean):

Package	From	To	Fixes	Scope
hackney	4.8.5	4.9.1	CVE-2026-115693, CVE-2026-112880, CVE-2026-113440, CVE-2026-115700, CVE-2026-97200	runtime
ssl_verify_fun	1.1.7	1.1.9	CVE-2026-117666	runtime
postgrex	0.22.3	0.22.4	CVE-2026-66838	test
decimal	2.4.1	3.2.0	CVE-2026-32686, CVE-2026-97853	test

Other lock changes:

• certifi 2.18.0, h2 0.12.5 and quic 2.1.3, which hackney 4.9 needs.
• myxql 0.9.0 and xandra 0.20.0, which decimal 3 needs.
• metrics and unicode_util_compat are removed. They were left over from hackney 1.x.

CI: xandra 0.20 needs Elixir 1.17 (it uses Duration), so the test matrix drops Elixir 1.15 and 1.16. Dialyzer and the rootless Podman job move from Elixir 1.16 / OTP 26.2 to Elixir 1.17 / OTP 27.2.

Supersedes #276.

Notes for review

• hackney 4.9 caps buffered response bodies at 512 MiB. testcontainers only buffers image pull progress and container logs, so this should not matter.
• The uniq pin stays. mix.exs still declares elixir: "~> 1.13", and uniq 0.6.3 fails to compile on Elixir 1.15. If we raise the minimum to 1.17, the pin can go too.
• Requiring hackney 4.9 is a change users will notice. It is worth a line in the next release notes.

Testing

On Elixir 1.18.5 / OTP 27.3:

• mix format --check-formatted, mix compile --warnings-as-errors, mix credo --strict and mix dialyzer all pass.
• mix hex.audit reports no advisories.
• 194 tests, 0 failures. That covers the connection and TLS tests, generic container, network, copy and put file, pull policy, wait strategies, Docker auth, and the postgres, mysql, redis, cassandra and mongo containers.

Not run locally: kafka, emqx, ceph, minio, selenium, toxiproxy and the compose integration test. Their client libraries did not change, and the tests above cover the Docker API calls through hackney. Elixir 1.17 is covered by CI only.