[chevinbrown]

GitHub release downloads can now fail on OTP 29.0.6 with {:header_too_long, {:max, 10240}} before reaching the release asset. The initial redirect carries a large Content-Security-Policy header: the responses inspected on October 23 had a 9,217-byte CSP and roughly 10.9 KiB of headers in total, exceeding :httpc's 10 KiB default.

Set max_header_size: 65_536 in the :httpc request options, allowing these redirects while keeping a finite response-header limit. This is a one-line production change; TLS verification, redirect handling, and artifact checksum verification retain their existing behavior.

The observed CSP enumerates the new storage hosts in GitHub's October 22 Actions blob-storage announcement. This appears to explain the growth, although the announcement itself does not document a CSP change. The same large CSP was present on downloads from unrelated release repositories.

Validation:

• Extended the existing NIF download/extraction test with a 302 response carrying a 12 KiB header. On OTP 29.0.6 it fails before this change with {:header_too_long, {:max, 10240}} and passes afterward, retaining checksum and extraction coverage.
• Added coverage that responses exceeding 64 KiB are still rejected. This test is skipped on older inets releases without the header-limit option.
• Full suite on OTP 29.0.6 / Elixir 1.20.4: 78 passed.
• Full suite on OTP 29.0.1 / Elixir 1.20.4: 77 passed, 1 skipped. Older :httpc versions ignore the unrecognized option and may log that it was ignored. OTP 26 was not run locally.
• mix format --check-formatted and MIX_ENV=test mix compile --warnings-as-errors pass.
• A live release download succeeds with the 64 KiB limit and matches the checksum shipped in the consuming Hex package.

[brettbeatty]

Just for reference, the Phoenix Tailwind package had to do the same thing, bumping the limit instead to 32_768
phoenixframework/tailwind#142

[chevinbrown]

Just for reference, the Phoenix Tailwind package had to do the same thing, bumping the limit instead to 32_768 phoenixframework/tailwind#142

Thanks for the quick response. Feel free to close if you have a more proper solution!

[philss]

Thanks for the PR!

It looks good to me. I should release tomorrow or Sunday, but I will let you know.

[themiguelamador]

Independently reproduced and verified, for what it helps: on Elixir 1.20.4 / OTP 29.1.1 with rustler_precompiled 0.9.0, cold downloads of mdex_native 0.2.7 and y_ex 0.11.0 fail with {:header_too_long, {:max, 10240}} (first-hop headers 10,880 / 10,859 bytes). With this one-line change applied locally, the same cold deps.compile downloads both from GitHub Releases and succeeds. Details and workarounds in #114. A patch release would unblock every package that fetches from GitHub Releases. Thanks for the fix!

[philss]

@chevinbrown this is now released in v0.10.1 please give it a try. Once again, thank you!

@themiguelamador thanks for the workaround instructions!