From 75585b3f2b633e00632c06212df182ba5481c667 Mon Sep 17 00:00:00 2001
From: janwillemvd <jan-willem@qdentity.nl>
Date: Fri, 10 Jul 2026 07:48:27 +0200
Subject: [PATCH] Relax tesla constraint to ~> 1.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous `>= 1.4.0 and <= 1.12.0` cap pinned downstream consumers to
tesla 1.12.0, which is affected by several security advisories (auth
header leak on redirect, atom exhaustion, decompression bomb, etc. —
first patched in tesla 1.18.3).

`~> 1.4` (i.e. `>= 1.4.0 and < 2.0.0`) keeps excontainers' real lower
bound and lets consumers pick up 1.18.3+ and any future 1.x, while still
guarding against a breaking tesla 2.0 (excontainers uses the soft-
deprecated `use Tesla.Builder`, which 2.0 will remove).

Verified: excontainers compiles cleanly against tesla 1.20.0.
---
 mix.exs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mix.exs b/mix.exs
index f95a469..fb35ec1 100644
--- a/mix.exs
+++ b/mix.exs
@@ -49,7 +49,7 @@ defmodule Excontainers.MixProject do
 
       {:hackney, "~> 1.16"},
       {:jason, ">= 1.0.0"},
-      {:tesla, ">= 1.4.0 and <= 1.12.0"},
+      {:tesla, "~> 1.4"},
       {:gestalt, "~> 1.0"},
       {:excoveralls, "~> 0.13", only: :test},
       {:ex_doc, ">= 0.0.0", only: :dev, runtime: false},