Raise hackney 1.x floor to 1.24 with security rationale

hackney 1.24.0 is the least-vulnerable 1.x release (SSRF fixed in 1.21.0,
pool leak in 1.24.0), but four advisories affecting everything before 4.0.1
(CVE-2026-47071 high; CVE-2026-47075/47076 medium; CVE-2026-47069 low) were
never patched on the 1.x line. Document that in the changelog and the
StripityStripeHackney moduledoc; prefer 4.x when the dep tree allows.

Author: neilberkman

.github/workflows/ci.yml

@@ -82,7 +82,7 @@ jobs:
           otp-version: '27.3.4.14'
           elixir-version: '1.20.2'
 
-      # The main suite can never exercise the hackney ~> 1.17 branch because
+      # The main suite can never exercise the hackney ~> 1.24 branch because
       # the test-only stripity_stripe dep forces hackney 4.x resolution. This
       # standalone project pins hackney 1.x and smoke-tests the adapter.
       - name: Install dependencies

CHANGELOG.md

@@ -9,6 +9,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [1.2.2] - 2026-07-08
 
+### Security
+
+- Hackney floor raised from `~> 1.17` to `~> 1.24` (constraint is now
+  `~> 1.24 or ~> 4.0`). hackney 1.24.0 is the least-vulnerable 1.x release — it includes
+  the SSRF fix (1.21.0) and the connection-pool fix (1.24.0) — but four advisories
+  affecting every release before 4.0.1 (CVE-2026-47071 high; CVE-2026-47075 and
+  CVE-2026-47076 medium; CVE-2026-47069 low) were never patched on the 1.x line. The 1.x
+  branch exists only so PaperTiger can coexist with dependency trees pinned to hackney 1.x
+  by other packages; prefer hackney 4.x whenever your tree allows it.
+
 ### Fixed
 
 - Corrected the 1.2.1 release notes: the `PaperTiger.StripityStripeHackney` adapter does

integration/hackney_1x_smoke/mix.exs

@@ -15,13 +15,13 @@ defmodule Hackney1xSmoke.MixProject do
     [extra_applications: [:logger]]
   end
 
-  # Pinning hackney to the 1.x line forces resolution down the `~> 1.17`
+  # Pinning hackney to the 1.x line forces resolution down the `~> 1.24`
   # branch of paper_tiger's constraint — the branch the main repo can never
   # exercise because its test-only stripity_stripe dep requires hackney 4.x.
   defp deps do
     [
       {:paper_tiger, path: "../.."},
-      {:hackney, "~> 1.17"}
+      {:hackney, "~> 1.24"}
     ]
   end
 end

lib/paper_tiger/stripity_stripe_hackney.ex

@@ -48,6 +48,15 @@ defmodule PaperTiger.StripityStripeHackney do
           # LiveView's Stripe calls use the same sandbox!
         end
       end
+
+  ## Security Note
+
+  This adapter is a thin passthrough over `:hackney.request/5` and works on both the
+  hackney 1.x and 4.x lines. PaperTiger accepts `~> 1.24 or ~> 4.0` so it can coexist
+  with dependency trees pinned to hackney 1.x by other packages, but be aware that four
+  security advisories affecting every hackney release before 4.0.1 (including
+  CVE-2026-47071, high severity) were never patched on the 1.x line. Prefer hackney 4.x
+  whenever your dependency tree allows it.
   """
 
   @compile {:no_warn_undefined, :hackney}

mix.exs

@@ -72,8 +72,11 @@ defmodule PaperTiger.MixProject do
       {:jason, "~> 1.4"},
 
       # Optional: hackney for stripity_stripe sandbox integration
-      # Users of PaperTiger.StripityStripeHackney must have hackney available
-      {:hackney, "~> 1.17 or ~> 4.0", optional: true},
+      # Users of PaperTiger.StripityStripeHackney must have hackney available.
+      # Floor is 1.24: the least-vulnerable 1.x release (SSRF fixed in 1.21.0,
+      # pool leak in 1.24.0). Four advisories affecting all of 1.x were only
+      # ever fixed in 4.0.1 — prefer hackney 4.x when your dep tree allows it.
+      {:hackney, "~> 1.24 or ~> 4.0", optional: true},
 
       # Testing/dev
       {:bypass, "~> 2.1", only: :test},