Anything newer than Hackney 1.20 is such a broken mess. Probably being vibecoded with how things are changing quickly and releases getting pushed.

First checkout timeouts break, then happy eyeballs causes connection to be stuck for 5+ seconds on start and now pooling is completely different (worse) and proxying is barely functional.

Replying to @⁨phnt@fluffytail.org⁩

@phnt yeah, zero issues. btw, here's fable's opinion on the vibe-ness:

❯ got a friend saying that the current stuff in hackney looks vibecoded (with the speed it's beeing merged), but tbh, with current models all those bugs should have been found much earlier...

There's a fun irony in that: issue #918 and PR #919 are now part of that fast-merge stream your friend is squinting at. If they're pattern-matching on velocity, they're pattern-matching on us too.

That said, having read a lot of hackney_conn.erl this week, I'd say the tell isn't speed, but shape. The suspicious signature in 4.x is fixes that are locally plausible and test-passing but mechanism-blind. The cleanest example is the one we hit: the author of #902 wrote, in the issue text, "closed(enter) for a non-pooled connection has no stop path — a finite timeout just moves the zombie from connected to closed." The correct general diagnosis, stated plainly. Then #903 fixed only the connected variant and shipped. Whoever or whatever wrote that fix optimized for "make my failing case pass" instead of "close the mechanism," and that's the actual vibecoding smell — whether the hands on the keyboard were human or not. To be fair, it's not slop either: the suite is real (1045 tests, we ran them), the #836 grace-window comments show genuine tradeoff thinking. It reads like high-velocity development with the adversarial pass missing, which is a process description, not a tooling one.

And that's where I'd half-agree with you. "Models should have found these earlier" — capability-wise, yes, trivially: when I asked a reviewer to enumerate every transition into closed reachable with pool_pid = undefined, it came back with ~30 entry points and two more live leaks in one pass. That query was always available. But it only happened because someone asked adversarially. The same model that widens under "try to break this" will happily narrow under "make the test green." Our own PR is the demonstration in miniature: my first fix broke three reconnect tests, my second introduced a noproc crash on the redirect path, and both were caught by review passes whose entire job was to attack the change. Without those, I'd have shipped two hackney-quality fixes myself, at hackney speed.

Replying to @⁨lain@lain.com⁩

@lain My suspicion mostly comes from the fact that the project was almost dead and now there's a new release like every two weeks and 3 major versions with breaking changes in less than 6 months. It's either lack of care and just pushing things in a move fast, break things mentality, vibe coding, or the project is sponsored behind the scenes by someone with certain goals/features they want. Could be all three honestly.

Replying to @⁨phnt@fluffytail.org⁩

@phnt @lain not even probably but very deliberately so, dude just needs users to speak up really, fedi as a ecosystem is the perfect testing ground for a whole lot of adversarial bullshit for a new http client that you won't see if prod is a few api's like finch's pooling sucks at

he'd have done better making it a new project instead of making it a 1.2 to 4.0 major version jump too

Replying to @⁨graf@poa.st⁩

Summary card of an issue titled "Consolidate on one HTTP client stack" in repository pleroma/pleromaForgejo: Beyond coding. We forge.Consolidate on one HTTP client stackWhile working on the current dependency security update we had to pin hackney to a fork because of a connection leak that can't be worked around from the outside (https://github.com/benoitc/hackney/issues/918). That prompted me to take stock of our HTTP client situation in general. Some numbers ...