Bump tesla from 1.17.0 to 1.20.0

[dependabot]

Bumps tesla from 1.17.0 to 1.20.0.

Release notes

Sourced from tesla's releases.

v1.20.0

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

v1.19.0

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

v1.18.3

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

v1.18.2

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

v1.18.1

1.18.1 (2026-05-14)

... (truncated)

Changelog

Sourced from tesla's changelog.

1.20.0 (2026-06-05)

Features

• support {:form,data} tagged body tuples (#886) (b1b3b80)

1.19.0 (2026-06-04)

Features

• finch-adapter: Finch adapter will pass through all supported options (#879) (7609328)
• form-urlencoded: support nested bodies via :brackets option (#878) (f7142e8)

1.18.3 (2026-06-02)

Important {: .error}

Please be careful using :hackney it is recommended to actually test the application before assuming we did not introduce any breaking changes. Also, be aware of the security vulnerabilities we have fixed in this release. Some of them may cause some unexpected behavior from the middleware depending on the assumptions made by the caller.

Features

• hackney: support hackney 4.x (#880) (c91639b)

Security CVE

• CVE-2026-48598 - Multipart part smuggling via unescaped content-disposition values
• CVE-2026-48597 - Atom exhaustion via untrusted URL scheme
• CVE-2026-48596 - CRLF injection in request Content-Type header via add_content_type_param
• CVE-2026-48595 - Authorization header leaks on cross-origin redirect via case-sensitive filtering
• CVE-2026-48594 - Decompression bomb on response body

1.18.2 (2026-05-15)

Bug Fixes

• builder: include :assigns and :private in request option type (#876) (f5834c1)

1.18.1 (2026-05-14)

Bug Fixes

• path-params: raise on missing required path parameter values (#874) (a1dd44b)

... (truncated)

Commits

• 901ce60 chore(master): release 1.20.0 (#887)
• b1b3b80 feat: support {:form,data} tagged body tuples (#886)
• 603ea34 chore(master): release 1.19.0 (#885)
• 7609328 feat(finch-adapter): Finch adapter will pass through all supported options (#...
• f7142e8 feat(form-urlencoded): support nested bodies via :brackets option (#878)
• 2d3c800 chore(ci): bump release workflow to Elixir 1.19 / OTP 28 (#884)
• 2eb7a78 chore(master): release 1.18.3 (#883)
• 3a369b8 chore: release 1.18.3
• 340f75b Merge commit from fork
• db963db Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)