Update cowlib to 2.12.0

[carrascoacd]

Context

Gun 2.0 has been released. As a consequence, the dependency resolution when using https://github.com/elixir-grpc/grpc is broken.

In order to remove the temporal fork of gun and use the official gun library, we want to make sure that:

1. gun depends on cowlib 2.12.0
2. cowboy depends on cowlib 2.12.0
3. grpc depends indirectly on on cowlib 2.12.0

@essen @polvalente, this is related to https://github.com/elixir-grpc/grpc/pull/301/files

[polvalente]

This is also related to #1596

[essen]

Yes but that won't work in the long run, I can't really make a new Cowboy release every time there's a Gun release and vice versa.

Just to be clear, the error ultimately comes from Mix which doesn't allow mismatching dependency versions, right? So we would need the rebar.config file (and Hex metadata) to have the loosy version instead of the strict version. I was thinking of adding a way to override the version in the Erlang.mk configuration and both Rebar and Mix would then get the loose version. But that's only assuming Mix uses the rebar.config for Cowboy.

[carrascoacd]

@essen There is another approach that could be simpler, why don't we relax the dependencies? ie using ~> 2.12. It will allow you to use from 2.12.0 to 2.99.x. If you use Semver, you shouldn't need to care about minor and bugfix versions. In fact, you want to have them as soon as possible.

[essen]

See my previous comment.

[carrascoacd]

I don't get you, sorry. According to the doc you can do it:

For convenience reasons (and because hex.pm mandates semver) hex dependencies can be specified using semver-like syntax:

{deps,[
  rebar,                   % fetches latest known version, ignoring pre-releases
  {rebar, "~> 2.0.0"},     % >= 2.0.0 and < 2.1.0`
  {rebar, "~> 2.1.2"},     % >= 2.1.2 and < 2.2.0`
  {rebar, "~> 2.1.3-dev"}` % >= 2.1.3-dev and < 2.2.0`
  {rebar, "~> 2.0"}`       % >= 2.0.0 and < 3.0.0`
  {rebar, "~> 2.1"}`       % >= 2.1.0 and < 3.0.0`
]}.

https://rebar3.org/docs/configuration/dependencies/

[carrascoacd]

In any case @essen 😁. Since adding lazy dependency is not a requirement, we can merge this and think about how to improve it later if you prefer. Does it make sense?

[essen]

I'm not using Rebar, but Erlang.mk. So when Erlang.mk generates the rebar.config for compatibility I am saying it should have an option to override the version. Before I make a new Cowboy version I want to have that done.

I do not want the Erlang.mk version to be fuzzy as only the strict versions were tested and that's all I can guarantee works.

[jbernardo95]

cowlib has been update on master btw, see 4958af5

We just need a new cowboy release, which is blocked by an otp bug, see #1610

[essen]

I've had to release Cowboy 2.10.0 for OTP-26 compatibility. I will also make a new Gun version for the same reason, so your issue will be gone for now, but a more long term solution will likely not be done before Cowboy 3.0 (so let's keep this PR open or open a new ticket). I'll ping when Gun is updated.

[essen]

OK there's a ticket already so I'm closing this. Expect a new Gun release soon.

[essen]

I have released Gun 2.0.1. Gun and Cowboy should now depend on the same Cowlib version.