chore(deps): bump hackney from 1.25.0 to 3.1.0

[dependabot]

Bumps hackney from 1.25.0 to 3.1.0.

Release notes

Sourced from hackney's releases.

3.1.0

Refactor

• Replace QUIC NIF with pure Erlang implementation. HTTP/3 now works with zero external dependencies - no CMake, Go, or C compiler needed. Just rebar3 compile.

Removed

• Remove c_src/ directory containing lsquic, BoringSSL, and NIF code (~1.3M lines of C)
• Remove do_cmake.sh and do_quic.sh build scripts

Added

• Add hackney_qpack.erl for QPACK header compression (RFC 9204)

Changed

• hackney_quic:is_available/0 now always returns true (pure Erlang is always available)
• Update documentation to reflect no C dependencies

Dependencies

• Add quic ~>0.5.1 (pure Erlang QUIC implementation)

3.0.3

Bug Fixes

• Restore function-based streaming body support (#821). Functions passed to send_body/2 now work correctly for iterative body streaming, supporting both stateless fun() -> {ok, Data} | eof and stateful fun(State) -> {ok, Data, NewState} | eof forms.

CI

• Fix FreeBSD CI job by adding pcre2 package to resolve git linker error

3.0.2

Bug Fixes

• Add default Content-Type: application/octet-stream header when sending a body without explicit Content-Type (#823). This restores 1.x behavior and follows RFC 7231 recommendations.

Dependencies

• Bump certifi to 2.16.0 (#824)

Changelog

Sourced from hackney's changelog.

3.1.0 - 2026-02-17

Refactor

• Replace QUIC NIF with pure Erlang implementation. HTTP/3 now works with zero external dependencies - no CMake, Go, or C compiler needed. Just rebar3 compile.

Removed

• Remove c_src/ directory containing lsquic, BoringSSL, and NIF code (~1.3M lines of C)
• Remove do_cmake.sh and do_quic.sh build scripts

Added

• Add hackney_qpack.erl for QPACK header compression (RFC 9204)

Changed

• hackney_quic:is_available/0 now always returns true (pure Erlang is always available)
• Update documentation to reflect no C dependencies

3.0.3 - 2026-02-15

Bug Fixes

• Restore function-based streaming body support (#821). Functions passed to send_body/2 now work correctly for iterative body streaming, supporting both stateless fun() -> {ok, Data} | eof and stateful fun(State) -> {ok, Data, NewState} | eof forms.

CI

• Fix FreeBSD CI job by adding pcre2 package to resolve git linker error

3.0.2 - 2026-02-02

Bug Fixes

• Add default Content-Type: application/octet-stream header when sending a body without explicit Content-Type (#823). This restores 1.x behavior and follows RFC 7231 recommendations.

Dependencies

• Bump certifi to 2.16.0 (#824)

3.0.1 - 2026-01-28

Bug Fixes

• Fix dialyzer warning in follow_redirect by removing dead code branch that checked is_pid() on a value that was always binary
• Store final redirect location in connection process state so it can be retrieved via hackney:location/1

... (truncated)

Commits

• 281c4dd release: version 3.1.0
• cebfd91 refactor: replace QUIC NIF with pure Erlang implementation (#827)
• 9cb26a6 release: version 3.0.3
• b9cbb01 Merge pull request #826 from benoitc/fix/function-streaming-body-821
• 4481c04 ci: add pcre2 package to FreeBSD job to fix git linker error
• 5836122 fix: restore function-based streaming body support (#821)
• 6579348 docs: fix typo gunicorn -> hackney in README
• 168132d docs: add sponsorship support section to README
• 5c035d9 docs: remove professional support section from README
• 1b6f536 release: version 3.0.2
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #165.