Re-vendor Mint with set_window_size/3, call it from Conn

Refactored the Mint HTTP/2 connection-window patch from a narrow
`:connection_window_size` connect option into a proper public API,
`Mint.HTTP2.set_window_size(conn, target, new_size)`, that supports
both `:connection` and `{:request, ref}` and can be called at any point
after connect. Tracks the receive window in a new `receive_window_size`
field (connection and stream); grow-only; validated to `1..2^31-1`.

This is the function shape that fills a longstanding, well-known gap in
Mint's public API — upstream issue #357 (2022, closed) asked for exactly
this, #432 (2024, still open) is a related enhancement. Ready to submit
upstream as a PR.

On the hex side:

  * Re-vendor from the integration branch (ericmj/hex-vendor-integration)
    which has PR #478 (Elixir 1.12), PR #479 (HTTP/1 1xx handling) and
    the new set_window_size/3 commit all stacked.
  * `Conn.do_connect` now calls `Hex.Mint.HTTP2.set_window_size(conn,
    :connection, 8_000_000)` immediately after a successful HTTP/2 connect.
    No-op on HTTP/1. TCP ordering guarantees the WINDOW_UPDATE reaches the
    server before any request HEADERS, so there's no extra RTT.
  * `:client_settings: [initial_window_size: 8_000_000]` still handles the
    per-stream initial window via SETTINGS.
  * Update `scripts/vendor_mint.sh` comment block to point at the
    integration branch and list all three upstream Mint patches with
    branch links.

Author: ericmj

lib/hex/http/pool/conn.ex

@@ -140,48 +140,65 @@ defmodule Hex.HTTP.Pool.Conn do
 
   ## Connect / reconnect
 
+  @receive_window_size 8_000_000
+
   defp do_connect(%{key: {scheme, host, port, _inet}, connect_opts: opts} = state) do
     # Negotiate HTTP/2 via ALPN when the server supports it; fall back to
     # HTTP/1. Benchmarked against real hex.pm + repo.hex.pm — with the HTTP/2
-    # window bumps below, both protocols are equivalent on `mix deps.get`
-    # wall time, and HTTP/2 uses slightly less CPU (fewer TLS handshakes).
-    #
-    # HTTP/2 window tuning: default per-stream and connection-level windows
-    # are only 64 KB (spec minimum), which stalls large-body downloads
-    # (hex tarballs) every 64 KB waiting for a WINDOW_UPDATE RTT. Bump both
-    # to 8 MB. `connection_window_size` is a local Mint patch; see HEX PATCH
-    # in lib/hex/mint/http2.ex.
+    # window bumps applied below, both protocols are equivalent on
+    # `mix deps.get` wall time, and HTTP/2 uses slightly less CPU (fewer
+    # TLS handshakes).
     opts =
       Keyword.merge(
         [
           protocols: [:http1, :http2],
-          client_settings: [initial_window_size: 8_000_000],
-          connection_window_size: 8_000_000
+          # Per-stream initial window (SETTINGS). The connection-level window
+          # is bumped via set_window_size/3 immediately below.
+          client_settings: [initial_window_size: @receive_window_size]
         ],
         opts
       )
 
     case MintHTTP.connect(scheme, host, port, opts) do
       {:ok, conn} ->
-        protocol = MintHTTP.protocol(conn)
-        capacity = compute_capacity(conn, protocol)
-        GenServer.cast(state.host_pid, {:conn_ready, self(), protocol, capacity})
-
-        {:noreply,
-         %{
-           state
-           | conn: conn,
-             protocol: protocol,
-             capacity: capacity,
-             ready: true,
-             backoff_ms: 0
-         }}
+        case maybe_bump_connection_window(conn) do
+          {:ok, conn} ->
+            protocol = MintHTTP.protocol(conn)
+            capacity = compute_capacity(conn, protocol)
+            GenServer.cast(state.host_pid, {:conn_ready, self(), protocol, capacity})
+
+            {:noreply,
+             %{
+               state
+               | conn: conn,
+                 protocol: protocol,
+                 capacity: capacity,
+                 ready: true,
+                 backoff_ms: 0
+             }}
+
+          {:error, _conn, reason} ->
+            schedule_reconnect(reason, %{state | conn: nil, ready: false})
+        end
 
       {:error, reason} ->
         schedule_reconnect(reason, %{state | conn: nil, ready: false})
     end
   end
 
+  # HTTP/2 default per-connection receive window is 64 KB (RFC 7540 §5.2.2),
+  # not tunable via SETTINGS. Hex tarballs are routinely multi-MB and we run
+  # them in parallel sharing one HTTP/2 connection, so without bumping this
+  # the server pauses every ~64 KB waiting for a `WINDOW_UPDATE` round-trip.
+  # HTTP/1 has no concept of a receive window so this is a no-op there —
+  # `set_window_size/3` is only on `Hex.Mint.HTTP2`.
+  defp maybe_bump_connection_window(conn) do
+    case MintHTTP.protocol(conn) do
+      :http2 -> Hex.Mint.HTTP2.set_window_size(conn, :connection, @receive_window_size)
+      :http1 -> {:ok, conn}
+    end
+  end
+
   defp close_and_reconnect(state) do
     if state.conn, do: safe_close(state.conn)
     schedule_reconnect(:closed, %{state | conn: nil, ready: false})

lib/hex/mint/core/conn.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.Core.Conn do
   @moduledoc false

lib/hex/mint/core/headers.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.Core.Headers do
   @moduledoc false

lib/hex/mint/core/transport.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.Core.Transport do
   @moduledoc false

lib/hex/mint/core/transport/ssl.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.Core.Transport.SSL do
   @moduledoc false
@@ -603,14 +603,18 @@ defmodule Hex.Mint.Core.Transport.SSL do
   end
 
   defp get_cacertfile(path) do
-    case :persistent_term.get({:hex_mint, {:cacertfile, path}}, :error) do
-      {:ok, cacerts} ->
-        cacerts
-
-      :error ->
-        cacerts = decode_cacertfile(path)
-        :persistent_term.put({:hex_mint, {:cacertfile, path}}, {:ok, cacerts})
-        cacerts
+    if Application.get_env(:mint, :persistent_term) do
+      case :persistent_term.get({:hex_mint, {:cacertfile, path}}, :error) do
+        {:ok, cacerts} ->
+          cacerts
+
+        :error ->
+          cacerts = decode_cacertfile(path)
+          :persistent_term.put({:hex_mint, {:cacertfile, path}}, {:ok, cacerts})
+          cacerts
+      end
+    else
+      decode_cacertfile(path)
     end
   end
 

lib/hex/mint/core/transport/tcp.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.Core.Transport.TCP do
   @moduledoc false

lib/hex/mint/core/util.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.Core.Util do
   @moduledoc false

lib/hex/mint/http.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.HTTP do
   _ = """

lib/hex/mint/http1.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.HTTP1 do
   _ = """
@@ -744,9 +744,9 @@ defmodule Hex.Mint.HTTP1 do
     {:ok, conn, responses}
   end
 
-  # HEX PATCH: informational (1xx) response finished parsing — do NOT emit
-  # :done and do NOT pop the request. Reset the response-side fields and
-  # continue parsing; the final response arrives on the same request ref.
+  # Informational (1xx) responses have no body and must not finalize the
+  # request; the final response follows on the same request ref. Reset the
+  # request's response-side fields and continue parsing without popping it.
   defp decode_body(:informational, conn, data, _request_ref, responses) do
     request = %{
       conn.request
@@ -785,7 +785,7 @@ defmodule Hex.Mint.HTTP1 do
         {:ok, conn, responses}
 
       length <= byte_size(data) ->
-        {body, rest} = :erlang.split_binary(data, length)
+        <<body::binary-size(^length), rest::binary>> = data
         {conn, responses} = add_body(conn, body, responses)
         conn = request_done(conn)
         responses = [{:done, request_ref} | responses]
@@ -859,7 +859,7 @@ defmodule Hex.Mint.HTTP1 do
         {:ok, conn, responses}
 
       length <= byte_size(data) ->
-        {body, rest} = :erlang.split_binary(data, length)
+        <<body::binary-size(^length), rest::binary>> = data
         {conn, responses} = add_body(conn, body, responses)
         conn = put_in(conn.request.body, {:chunked, :crlf})
         decode_body({:chunked, :crlf}, conn, rest, request_ref, responses)
@@ -1004,10 +1004,6 @@ defmodule Hex.Mint.HTTP1 do
       status == 101 ->
         {:ok, :single}
 
-      # HEX PATCH: 1xx informational responses don't have a body and must not
-      # finalize the request — the final response follows on the same ref.
-      # Upstream Mint bundles them with HEAD/204/304 (see :none clause below),
-      # which pops the request and breaks the real response. Split 1xx out.
       status in 100..199 ->
         {:ok, :informational}
 

lib/hex/mint/http1/parse.ex

@@ -1,4 +1,4 @@
-# Vendored from mint v1.7.1 (f7f0313), do not edit manually
+# Vendored from mint v1.7.1 (74471c9), do not edit manually
 
 defmodule Hex.Mint.HTTP1.Parse do
   @moduledoc false