From 2e62dc124b3fc877891a8a71b856fcff35c92f9c Mon Sep 17 00:00:00 2001
From: Luca Succi <luca.succi@stritzinger.com>
Date: Tue, 27 Oct 2026 15:51:05 +0100
Subject: [PATCH] Constrain Hackney to patched releases

---
 CHANGELOG.md | 4 ++++
 rebar.config | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa031f3..1ea84d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Security
+
+- Require Hackney 4.9.0 or later to prevent resolving a vulnerable release.
+
 ## [2.11.5] - 2026-10-26
 
 ### Changed
diff --git a/rebar.config b/rebar.config
index 8248c80..ae2267e 100644
--- a/rebar.config
+++ b/rebar.config
@@ -2,7 +2,7 @@
 {deps, [
     {mapz, "~> 2.2"},
     bbmustache,
-    hackney,
+    {hackney, ">= 4.9.0"},
     edifa,
     grisp_update_packager
 ]}.