build(deps): bump hackney from 4.5.2 to 4.6.0

[dependabot]

Bumps hackney from 4.5.2 to 4.6.0.

Release notes

Sourced from hackney's releases.

4.6.0

Added

• set_owner/2 now works while a response body is streaming, in both the synchronous and the async path. It used to return {error, invalid_state} once the body had started. This lets a short lived worker run a request and hand the still streaming response to a longer lived process before it exits, without stopping the connection.
• connect/4 accepts a binary host, restoring the 1.x behavior. A binary is converted to a string, so callers passing a binary host no longer fail.

Fixed

• A non-reusable connection (flagged no_reuse for proxy tunnels, SSL upgrades or a disabled pool, or answered with Connection: close) is now closed and its process stopped when a synchronous request completes, instead of parking in connected forever. With a long lived owner nothing stopped it, so one hackney_conn process leaked per request until the node ran out of memory (#902). The sync and async reuse decision now share the same check, which also stops a no_reuse pooled connection on the async path.

Changelog

Sourced from hackney's changelog.

4.6.0 - 2026-07-15

Added

• set_owner/2 now works while a response body is streaming, in both the synchronous and the async path. It used to return {error, invalid_state} once the body had started. This lets a short lived worker run a request and hand the still streaming response to a longer lived process before it exits, without stopping the connection.
• connect/4 accepts a binary host, restoring the 1.x behavior. A binary is converted to a string, so callers passing a binary host no longer fail.

Fixed

• A non-reusable connection (flagged no_reuse for proxy tunnels, SSL upgrades or a disabled pool, or answered with Connection: close) is now closed and its process stopped when a synchronous request completes, instead of parking in connected forever. With a long lived owner nothing stopped it, so one hackney_conn process leaked per request until the node ran out of memory (#902). The sync and async reuse decision now share the same check, which also stops a no_reuse pooled connection on the async path.

Commits

• 42058d1 Release 4.6.0
• 2f6d15b Merge pull request #908 from benoitc/proto/unified-finish-request
• 750869c Stop non-reusable connections when a request completes
• 398edbd Merge pull request #906 from TBK145/patch-1
• 08a0393 Merge connect/4 clauses under one spec so it compiles
• 6430334 Merge pull request #904 from benoitc/feature/set-owner-mid-stream
• 24bbf44 Overload connect function to accept binary host
• 89eb0f6 Add regression test for set_owner API in unchanged states
• a0c5e5e Allow set_owner while a response body is streaming
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)