1.21.0 (2026-08-01)

Features

• add support for the HTTP QUERY method (RFC 10008) (#896) (c3b7bf5)

Bug Fixes

• ci: bump release workflow to OTP 28.5 (#888) (aa22331)
• ci: bump test matrix to OTP 28.5 (#899) (279f8bc)
• handle atom header keys in FollowRedirects header filtering (#898) (a3d6c94)
• silence compiler warnings on Elixir 1.20.1 (#892) (863d836)

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the
application before assuming we did not introduce any breaking changes.
Also, be aware of the security vulnerabilities we have fixed in this release.
Some of them may cause some unexpected behavior from the middleware depending
on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

1.18.1 (2026-05-14)

Bug Fixes

• path-params: raise on missing required path parameter values (#874) (a1dd44b)

1.18.0 (2026-05-14)

Features

• openapi: add response wrapper macro (#872) (f824d67)
• openapi: split header and cookie params (#865) (898bd1a)
• path-params: separate definitions from values (#860) (3639c9a)
• path-params: support precompiled path templates (#859) (a8878a0)
• query-params: separate definitions from values (#862) (08f4d87)
• query: support API-specific query serialization (#843) (9b95efb)
• support OpenAPI-friendly cookie params (#857) (25bcf3c)
• support OpenAPI-friendly header params (#853) (2ec5539)
• support OpenAPI-friendly path params (#851) (0837672)
• support OpenAPI-friendly query params (#852) (7a1b582)
• support OpenAPI-friendly query strings (#858) (a979142)

Bug Fixes

• gun: keep timeout-wrapped streams readable (#847) (8a8ba74)
• mint: avoid crashes on HTTP/2 request resets (#846) (6a42469)

1.17.0 (2026-04-18)

Features

• Add :metadata option to Logger middleware (#829) (38e209a)
• add assigns and private fields to Tesla.Env (#836) (b8b622c)
• client: add put_middleware/2, replace_middleware!/3, update_middleware!/3, and insert_middleware!/4 (#840) (fa755c9)
• client: add update_middleware/2 to transform middleware list (#523) (0689e64)
• logger: emit url.template from KeepRequest preserved URL (#839) (544e1d7)
• logger: semantic OTel metadata and legacy mode (#838) (aae0866)

Bug Fixes

• avoid soft-deprecated warning logs when compiling tesla itself (#834) (ab82264)
• dialyzer spec for mock opts (#831) (440ec4e)
• enhance response handling in Mint adapter (#803) (a672177)
• include caller module name in use Tesla deprecation warning (#832) (b8fb158)
• mint: avoid active-mode message races without breaking reused connections (#812) (d812f54)

1.16.0 (2026-01-01)

Features

• add strict policy option for enforcing base URL (#817) (e476093)
• support function streams in multipart handling (#801) (dd8b206), closes #648

Bug Fixes

• DecompressResponse middleware for multiple encodings and keep updated content-length header (#809) (288699e)
• Handle breaking change in Finch.stream API (#813) (ce5ea80)
• Handle errors in streaming responses (#819) (e7806bf)
• Use Version module to check finch version (#814) (56f9568)

1.15.3 (2025-07-30)

Bug Fixes

• Avoid crash then gzip-decompressing empty body (#796) (5bc9b82)