chore(deps): bump arangox from 0.7.0 to 0.8.0

[dependabot]

Bumps arangox from 0.7.0 to 0.8.0.

Release notes

Sourced from arangox's releases.

v0.8.0

HTTP via Mint is now the default transport for ArangoDB 3.12 and later. VelocyStream and active failover remain supported as explicit opt-ins for ArangoDB 3.11, the last server release that speaks them.

This release is breaking throughout. The full list is in CHANGELOG.md; below are the changes that need action on upgrade.

Breaking changes

• The default client is Arangox.MintClient over HTTP. ArangoDB removed VelocyStream in 3.12, so Arangox.VelocyClient must be selected explicitly (client: Arangox.VelocyClient) and needs a 3.11 server.
• TLS certificates are verified by default — peer verification, hostname checks, the system trust store — and TLS below 1.2 is refused. A server with an untrusted certificate now fails until you supply trust material via ssl_opts: [cacertfile: ...] or opt out with ssl_opts: [verify: :verify_none].
• A pool configured with :auth refuses to start when its endpoints are cleartext (http://) and not on this machine. Loopback is exempt; opt in with allow_cleartext_auth: true.
• Headers are lists of {name, value} string tuples, at the :headers start option and on every request. Maps are no longer accepted. Nothing is merged, deduplicated, renamed or re-cased, and a request header no longer replaces a same-named pool header — both are sent. Response headers are the same shape.
• Stream transactions are handle-based. Arangox.begin_transaction/2 returns an %Arangox.Transaction{}; requests join it with the per-request transaction: option, which accepts only the handle struct.
• Every client failure is an %Arangox.Error{} with :reason populated, and connect failures are returned rather than raised.
• Every request runs under an absolute deadline fixed when the caller enters the pool, so time spent queueing counts against :timeout. A timed-out request disconnects its connection instead of returning it to the pool, and a fully written request is never retried automatically.
• :pool_size defaults to 10 rather than db_connection's 1. HTTP/1.1 carries one request per connection at a time, so the pool size is the driver's concurrency.
• :json_library and :vst_maxsize are per-pool start options. The application-config forms still work and warn once per pool; they will be removed in the next release.
• Requires Elixir 1.15+ on OTP 26+. The OTP floor is enforced at compile time, because OTP 26 is where :ssl began verifying peers by default.

Enhancements

• A resource API: 230 operations across 22 Arangox.API.* modules, derived from ArangoDB's own API description at 3.12.10 and maintained as owned source. The connection is the first argument and path parameters follow it; the database, headers and every per-request option are options. A call

... (truncated)

Changelog

Sourced from arangox's changelog.

v0.8.0 (2026-08-12)

HTTP via Mint is now the default transport for ArangoDB 3.12 and later; VelocyStream and active failover remain supported as explicit opt-ins for ArangoDB 3.11, which is the last server release that speaks them.

• Breaking changes
  • The default client is Arangox.MintClient over HTTP. ArangoDB removed VelocyStream in 3.12, so Arangox.VelocyClient must now be selected explicitly (client: Arangox.VelocyClient) and needs a 3.11 server. The Gun client remains available as Arangox.GunClient.
  • TLS certificates are verified by default (verify_peer, hostname checks, system trust store), and TLS below 1.2 is refused. Connecting to a server with an untrusted certificate now fails until you supply trust material via ssl_opts: [cacertfile: ...] or opt out with ssl_opts: [verify: :verify_none].
  • A pool configured with :auth refuses to start when its endpoints are cleartext (http://) and not on this machine, because the credentials would be readable in transit. Loopback endpoints are exempt; opt in explicitly with allow_cleartext_auth: true.
  • Every client failure is an %Arangox.Error{} with :reason populated — HTTP status, ArangoDB errorNum, and an atom reason derived from it. Connect failures are returned, never raised.
  • Stream transactions are handle-based. Arangox.begin_transaction/2 returns an %Arangox.Transaction{} handle; requests join it with the per-request transaction: option. The option accepts only the handle struct, never a bare identifier binary.
  • DBConnection.prepare/2 for AQL is refused: ArangoDB has no prepared statements. The AQL plan cache (ArangoDB 3.12.4+) is an explicit opt-in via use_plan_cache: true, with Arangox.plan_cache/1 and Arangox.clear_plan_cache/1 to manage it.
  • Every request runs under an absolute deadline established when the caller enters the pool, so time spent queueing counts against :timeout. A timed-out request disconnects its connection instead of returning it to the pool, and a fully written request is never retried automatically.
  • :json_library and :vst_maxsize are per-pool start options. The application-config forms still work and warn once per pool; they will be removed in the next release.
  • :pool_size defaults to 10 rather than db_connection's 1. HTTP/1.1 carries one request per connection at a time, so the pool size is the driver's concurrency and a default of 1 serializes an application.
  • The :database option (per pool and per request) is validated: names that would alter the request path (/, ?, #, %, control characters) are refused, and extended names (spaces, unicode) are percent-encoded on HTTP paths.
  • Leader redirects (active failover, 3.11) are only followed when the advertised endpoint passes an admission policy; anything else requires an explicit :endpoint_mapper. Unknown start options log a warning.
  • Headers are lists of {name, value} string tuples; maps are no longer accepted, at the :headers start option or on a request. The wire order

... (truncated)

Commits

• e71c793 docs: render the changelog and license, and fix a link that only worked on Gi...
• 4f6b2fb Modernize the driver for ArangoDB 3.12 (0.8.0) (#10)
• 695272f about time I put my real name here...
• 57aade8 failover is disabled in 3.12, tag resilient_single in docker compose accordingly
• fc4fbb2 add hex badge to readme
• 5c3d9ae fix dialyzer warning in connection.ex
• 82427e6 update CI badge to new github action workflow; update env versions in readme ...
• 6fd4cd3 create mix test workflow with github action
• 72554f5 update changelog
• 467ce7b fix error in changelog
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d4b7c775-3e7f-4697-aab8-977fb021a1de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}