Update tests for OTP-25+

11 files changed, 424 insertions, 162 deletions

diff --git a/erlang.mk b/erlang.mk
index 174b87e..e8492ae 100644
--- a/erlang.mk
+++ b/erlang.mk
@@ -17,7 +17,7 @@
 ERLANG_MK_FILENAME := $(realpath $(lastword $(MAKEFILE_LIST)))
 export ERLANG_MK_FILENAME
 
-ERLANG_MK_VERSION = 2020.03.05-27-gc8f8ff0-dirty
+ERLANG_MK_VERSION = 94718f7
 ERLANG_MK_WITHOUT = 
 
 # Make 3.81 and 3.82 are deprecated.
@@ -955,10 +955,10 @@ pkg_cr_commit = master
 
 PACKAGES += cuttlefish
 pkg_cuttlefish_name = cuttlefish
-pkg_cuttlefish_description = never lose your childlike sense of wonder baby cuttlefish, promise me?
-pkg_cuttlefish_homepage = https://github.com/basho/cuttlefish
+pkg_cuttlefish_description = cuttlefish configuration abstraction
+pkg_cuttlefish_homepage = https://github.com/Kyorai/cuttlefish
 pkg_cuttlefish_fetch = git
-pkg_cuttlefish_repo = https://github.com/basho/cuttlefish
+pkg_cuttlefish_repo = https://github.com/Kyorai/cuttlefish
 pkg_cuttlefish_commit = master
 
 PACKAGES += damocles
@@ -2735,7 +2735,7 @@ pkg_mochiweb_description = MochiWeb is an Erlang library for building lightweigh
 pkg_mochiweb_homepage = https://github.com/mochi/mochiweb
 pkg_mochiweb_fetch = git
 pkg_mochiweb_repo = https://github.com/mochi/mochiweb
-pkg_mochiweb_commit = master
+pkg_mochiweb_commit = main
 
 PACKAGES += mochiweb_xpath
 pkg_mochiweb_xpath_name = mochiweb_xpath
@@ -2823,7 +2823,7 @@ pkg_mysql_description = MySQL client library for Erlang/OTP
 pkg_mysql_homepage = https://github.com/mysql-otp/mysql-otp
 pkg_mysql_fetch = git
 pkg_mysql_repo = https://github.com/mysql-otp/mysql-otp
-pkg_mysql_commit = 1.5.1
+pkg_mysql_commit = 1.7.0
 
 PACKAGES += n2o
 pkg_n2o_name = n2o
@@ -3391,7 +3391,7 @@ pkg_relx_description = Sane, simple release creation for Erlang
 pkg_relx_homepage = https://github.com/erlware/relx
 pkg_relx_fetch = git
 pkg_relx_repo = https://github.com/erlware/relx
-pkg_relx_commit = master
+pkg_relx_commit = main
 
 PACKAGES += resource_discovery
 pkg_resource_discovery_name = resource_discovery
@@ -4334,17 +4334,6 @@ export REBAR_DEPS_DIR
 REBAR_GIT ?= https://github.com/rebar/rebar
 REBAR_COMMIT ?= 576e12171ab8d69b048b827b92aa65d067deea01
 
-HEX_CORE_GIT ?= https://github.com/hexpm/hex_core
-HEX_CORE_COMMIT ?= v0.7.0
-
-PACKAGES += hex_core
-pkg_hex_core_name = hex_core
-pkg_hex_core_description = Reference implementation of Hex specifications
-pkg_hex_core_homepage = $(HEX_CORE_GIT)
-pkg_hex_core_fetch = git
-pkg_hex_core_repo = $(HEX_CORE_GIT)
-pkg_hex_core_commit = $(HEX_CORE_COMMIT)
-
 # External "early" plugins (see core/plugins.mk for regular plugins).
 # They both use the core_dep_plugin macro.
 
@@ -4703,8 +4692,19 @@ define dep_autopatch_rebar.erl
 		case file:consult("$(call core_native_path,$(DEPS_DIR)/$1/rebar.lock)") of
 			{ok, Lock} ->
 				io:format("~p~n", [Lock]),
-				case lists:keyfind("1.1.0", 1, Lock) of
-					{_, LockPkgs} ->
+				LockPkgs = case lists:keyfind("1.2.0", 1, Lock) of
+					{_, LP} ->
+						LP;
+					_ ->
+						case lists:keyfind("1.1.0", 1, Lock) of
+							{_, LP} ->
+								LP;
+							_ ->
+								false
+						end
+				end,
+				if
+					is_list(LockPkgs) ->
 						io:format("~p~n", [LockPkgs]),
 						case lists:keyfind(atom_to_binary(N, latin1), 1, LockPkgs) of
 							{_, {pkg, _, Vsn}, _} ->
@@ -4713,7 +4713,7 @@ define dep_autopatch_rebar.erl
 							_ ->
 								false
 						end;
-					_ ->
+					true ->
 						false
 				end;
 			_ ->
@@ -4959,9 +4959,12 @@ endef
 define dep_autopatch_appsrc_script.erl
 	AppSrc = "$(call core_native_path,$(DEPS_DIR)/$1/src/$1.app.src)",
 	AppSrcScript = AppSrc ++ ".script",
-	{ok, Conf0} = file:consult(AppSrc),
+	Conf1 = case file:consult(AppSrc) of
+		{ok, Conf0} -> Conf0;
+		{error, enoent} -> []
+	end,
 	Bindings0 = erl_eval:new_bindings(),
-	Bindings1 = erl_eval:add_binding('CONFIG', Conf0, Bindings0),
+	Bindings1 = erl_eval:add_binding('CONFIG', Conf1, Bindings0),
 	Bindings = erl_eval:add_binding('SCRIPT', AppSrcScript, Bindings1),
 	Conf = case file:script(AppSrcScript, Bindings) of
 		{ok, [C]} -> C;
@@ -5027,28 +5030,12 @@ define dep_fetch_ln
 	ln -s $(call dep_repo,$(1)) $(DEPS_DIR)/$(call dep_name,$(1));
 endef
 
-# @todo Handle errors.
-define dep_fetch_hex.erl
-	{ok, _} = application:ensure_all_started(ssl),
-	{ok, _} = application:ensure_all_started(inets),
-	Config = hex_core:default_config(),
-	{ok, {200, #{}, Tarball}} = hex_repo:get_tarball(Config, <<"$(strip $3)">>, <<"$(strip $2)">>),
-	{ok, #{}} = hex_tarball:unpack(Tarball, "$(DEPS_DIR)/$1"),
-	halt(0)
-endef
-
 # Hex only has a package version. No need to look in the Erlang.mk packages.
 define dep_fetch_hex
-	if [ ! -e $(DEPS_DIR)/hex_core ]; then \
-		echo "Error: Dependency hex_core missing. BUILD_DEPS += hex_core to fix." >&2; \
-		exit 81; \
-	fi; \
-	if [ ! -e $(DEPS_DIR)/hex_core/ebin/dep_built ]; then \
-		$(MAKE) -C $(DEPS_DIR)/hex_core IS_DEP=1; \
-		touch $(DEPS_DIR)/hex_core/ebin/dep_built; \
-	fi; \
-	$(call erlang,$(call dep_fetch_hex.erl,$1,$(word 2,$(dep_$1)),\
-		$(if $(word 3,$(dep_$1)),$(word 3,$(dep_$1)),$1)));
+	mkdir -p $(ERLANG_MK_TMP)/hex $(DEPS_DIR)/$1; \
+	$(call core_http_get,$(ERLANG_MK_TMP)/hex/$1.tar,\
+		https://repo.hex.pm/tarballs/$(if $(word 3,$(dep_$1)),$(word 3,$(dep_$1)),$1)-$(strip $(word 2,$(dep_$1))).tar); \
+	tar -xOf $(ERLANG_MK_TMP)/hex/$1.tar contents.tar.gz | tar -C $(DEPS_DIR)/$1 -xzf -;
 endef
 
 define dep_fetch_fail
@@ -5845,6 +5832,8 @@ endef
 
 define bs_relx_config
 {release, {$p_release, "1"}, [$p, sasl, runtime_tools]}.
+{dev_mode, false}.
+{include_erts, true}.
 {extended_start_script, true}.
 {sys_config, "config/sys.config"}.
 {vm_args, "config/vm.args"}.
@@ -6201,6 +6190,8 @@ endif
 	$(verbose) mkdir config/
 	$(verbose) $(call core_render,bs_sys_config,config/sys.config)
 	$(verbose) $(call core_render,bs_vm_args,config/vm.args)
+	$(verbose) awk '/^include erlang.mk/ && !ins {print "BUILD_DEPS += relx";ins=1};{print}' Makefile > Makefile.bak
+	$(verbose) mv Makefile.bak Makefile
 
 new-app:
 ifndef in
@@ -6294,9 +6285,9 @@ ifeq ($(PLATFORM),msys2)
 	CXXFLAGS ?= -O3 -finline-functions -Wall
 else ifeq ($(PLATFORM),darwin)
 	CC ?= cc
-	CFLAGS ?= -O3 -std=c99 -arch x86_64 -Wall -Wmissing-prototypes
-	CXXFLAGS ?= -O3 -arch x86_64 -Wall
-	LDFLAGS ?= -arch x86_64 -flat_namespace -undefined suppress
+	CFLAGS ?= -O3 -std=c99 -Wall -Wmissing-prototypes
+	CXXFLAGS ?= -O3 -Wall
+	LDFLAGS ?= -flat_namespace -undefined suppress
 else ifeq ($(PLATFORM),freebsd)
 	CC ?= cc
 	CFLAGS ?= -O3 -std=c99 -finline-functions -Wall -Wmissing-prototypes
@@ -6738,7 +6729,7 @@ export DIALYZER_PLT
 
 PLT_APPS ?=
 DIALYZER_DIRS ?= --src -r $(wildcard src) $(ALL_APPS_DIRS)
-DIALYZER_OPTS ?= -Werror_handling -Wrace_conditions -Wunmatched_returns # -Wunderspecs
+DIALYZER_OPTS ?= -Werror_handling -Wunmatched_returns # -Wunderspecs
 DIALYZER_PLT_OPTS ?=
 
 # Core targets.
@@ -7017,6 +7008,17 @@ endif
 # Copyright (c) 2020, Loïc Hoguin <[email protected]>
 # This file is part of erlang.mk and subject to the terms of the ISC License.
 
+HEX_CORE_GIT ?= https://github.com/hexpm/hex_core
+HEX_CORE_COMMIT ?= v0.7.0
+
+PACKAGES += hex_core
+pkg_hex_core_name = hex_core
+pkg_hex_core_description = Reference implementation of Hex specifications
+pkg_hex_core_homepage = $(HEX_CORE_GIT)
+pkg_hex_core_fetch = git
+pkg_hex_core_repo = $(HEX_CORE_GIT)
+pkg_hex_core_commit = $(HEX_CORE_COMMIT)
+
 # We automatically depend on hex_core when the project isn't already.
 $(if $(filter hex_core,$(DEPS) $(BUILD_DEPS) $(DOC_DEPS) $(REL_DEPS) $(TEST_DEPS)),,\
 	$(eval $(call dep_target,hex_core)))
@@ -7054,8 +7056,6 @@ define hex_user_create.erl
 	end
 endef
 
-# @todo OK when asking for password and there's a $ character it doesn't work.
-
 # The $(info ) call inserts a new line after the password prompt.
 hex-user-create: hex-core
 	$(if $(HEX_USERNAME),,$(eval HEX_USERNAME := $(shell read -p "Username: " username; echo $$username)))
@@ -7097,20 +7097,19 @@ hex-key-add: hex-core
 HEX_TARBALL_EXTRA_METADATA ?=
 
 # @todo Check that we can += files
-# @todo Probably better if we sort the core_find results.
 HEX_TARBALL_FILES ?= \
 	$(wildcard early-plugins.mk) \
 	$(wildcard ebin/$(PROJECT).app) \
 	$(wildcard ebin/$(PROJECT).appup) \
 	$(wildcard $(notdir $(ERLANG_MK_FILENAME))) \
-	$(call core_find,include/,*.hrl) \
+	$(sort $(call core_find,include/,*.hrl)) \
 	$(wildcard LICENSE*) \
 	$(wildcard Makefile) \
 	$(wildcard plugins.mk) \
-	$(call core_find,priv/,*) \
+	$(sort $(call core_find,priv/,*)) \
 	$(wildcard README*) \
 	$(wildcard rebar.config) \
-	$(call core_find,src/,*)
+	$(sort $(call core_find,src/,*))
 
 HEX_TARBALL_OUTPUT_FILE ?= $(ERLANG_MK_TMP)/$(PROJECT).tar
 
@@ -7290,6 +7289,59 @@ hex-release-unretire: hex-core
 	$(gen_verbose) $(call erlang,$(call hex_release_unretire.erl,$(HEX_SECRET),\
 		$(if $(HEX_VERSION),$(HEX_VERSION),$(PROJECT_VERSION))))
 
+HEX_DOCS_DOC_DIR ?= doc/
+HEX_DOCS_TARBALL_FILES ?= $(sort $(call core_find,$(HEX_DOCS_DOC_DIR),*))
+HEX_DOCS_TARBALL_OUTPUT_FILE ?= $(ERLANG_MK_TMP)/$(PROJECT)-docs.tar.gz
+
+$(HEX_DOCS_TARBALL_OUTPUT_FILE): hex-core app docs
+	$(hex_tar_verbose) tar czf $(HEX_DOCS_TARBALL_OUTPUT_FILE) -C $(HEX_DOCS_DOC_DIR) \
+		$(HEX_DOCS_TARBALL_FILES:$(HEX_DOCS_DOC_DIR)%=%)
+
+hex-docs-tarball-create: $(HEX_DOCS_TARBALL_OUTPUT_FILE)
+
+define hex_docs_publish.erl
+	{ok, _} = application:ensure_all_started(ssl),
+	{ok, _} = application:ensure_all_started(inets),
+	Config = $(hex_config.erl),
+	ConfigF = Config#{api_key => <<"$(strip $1)">>},
+	{ok, Tarball} = file:read_file("$(strip $(HEX_DOCS_TARBALL_OUTPUT_FILE))"),
+	case hex_api:post(ConfigF,
+			["packages", "$(strip $(PROJECT))", "releases", "$(strip $(PROJECT_VERSION))", "docs"],
+			{"application/octet-stream", Tarball}) of
+		{ok, {Status, _, _}} when Status >= 200, Status < 300 ->
+			io:format("Docs published~n"),
+			halt(0);
+		{ok, {Status, _, Errors}} ->
+			io:format("Error ~b: ~0p~n", [Status, Errors]),
+			halt(88)
+	end
+endef
+
+hex-docs-publish: hex-core hex-docs-tarball-create
+	$(if $(HEX_SECRET),,$(eval HEX_SECRET := $(shell stty -echo; read -p "Secret: " secret; stty echo; echo $$secret) $(info )))
+	$(gen_verbose) $(call erlang,$(call hex_docs_publish.erl,$(HEX_SECRET)))
+
+define hex_docs_delete.erl
+	{ok, _} = application:ensure_all_started(ssl),
+	{ok, _} = application:ensure_all_started(inets),
+	Config = $(hex_config.erl),
+	ConfigF = Config#{api_key => <<"$(strip $1)">>},
+	case hex_api:delete(ConfigF,
+			["packages", "$(strip $(PROJECT))", "releases", "$(strip $2)", "docs"]) of
+		{ok, {Status, _, _}} when Status >= 200, Status < 300 ->
+			io:format("Docs removed~n"),
+			halt(0);
+		{ok, {Status, _, Errors}} ->
+			io:format("Error ~b: ~0p~n", [Status, Errors]),
+			halt(89)
+	end
+endef
+
+hex-docs-delete: hex-core
+	$(if $(HEX_SECRET),,$(eval HEX_SECRET := $(shell stty -echo; read -p "Secret: " secret; stty echo; echo $$secret) $(info )))
+	$(gen_verbose) $(call erlang,$(call hex_docs_delete.erl,$(HEX_SECRET),\
+		$(if $(HEX_VERSION),$(HEX_VERSION),$(PROJECT_VERSION))))
+
 # Copyright (c) 2015-2017, Loïc Hoguin <[email protected]>
 # This file is part of erlang.mk and subject to the terms of the ISC License.
 
@@ -7415,15 +7467,13 @@ endif
 # Copyright (c) 2013-2016, Loïc Hoguin <[email protected]>
 # This file is part of erlang.mk and subject to the terms of the ISC License.
 
+ifeq ($(filter relx,$(BUILD_DEPS) $(DEPS) $(REL_DEPS)),relx)
 .PHONY: relx-rel relx-relup distclean-relx-rel run
 
 # Configuration.
 
-RELX ?= $(ERLANG_MK_TMP)/relx
 RELX_CONFIG ?= $(CURDIR)/relx.config
 
-RELX_URL ?= https://erlang.mk/res/relx-v3.27.0
-RELX_OPTS ?=
 RELX_OUTPUT_DIR ?= _rel
 RELX_REL_EXT ?=
 RELX_TAR ?= 1
@@ -7432,12 +7482,6 @@ ifdef SFX
 	RELX_TAR = 1
 endif
 
-ifeq ($(firstword $(RELX_OPTS)),-o)
-	RELX_OUTPUT_DIR = $(word 2,$(RELX_OPTS))
-else
-	RELX_OPTS += -o $(RELX_OUTPUT_DIR)
-endif
-
 # Core targets.
 
 ifeq ($(IS_DEP),)
@@ -7452,21 +7496,59 @@ distclean:: distclean-relx-rel
 
 # Plugin-specific targets.
 
-$(RELX): | $(ERLANG_MK_TMP)
-	$(gen_verbose) $(call core_http_get,$(RELX),$(RELX_URL))
-	$(verbose) chmod +x $(RELX)
+define relx_release.erl
+	{ok, Config} = file:consult("$(call core_native_path,$(RELX_CONFIG))"),
+	{release, {Name, Vsn0}, _} = lists:keyfind(release, 1, Config),
+	Vsn = case Vsn0 of
+		{cmd, Cmd} -> os:cmd(Cmd);
+		semver -> "";
+		{semver, _} -> "";
+		VsnStr -> Vsn0
+	end,
+	{ok, _} = relx:build_release(#{name => Name, vsn => Vsn}, Config),
+	halt(0).
+endef
+
+define relx_tar.erl
+	{ok, Config} = file:consult("$(call core_native_path,$(RELX_CONFIG))"),
+	{release, {Name, Vsn0}, _} = lists:keyfind(release, 1, Config),
+	Vsn = case Vsn0 of
+		{cmd, Cmd} -> os:cmd(Cmd);
+		semver -> "";
+		{semver, _} -> "";
+		VsnStr -> Vsn0
+	end,
+	{ok, _} = relx:build_tar(#{name => Name, vsn => Vsn}, Config),
+	halt(0).
+endef
+
+define relx_relup.erl
+	{ok, Config} = file:consult("$(call core_native_path,$(RELX_CONFIG))"),
+	{release, {Name, Vsn0}, _} = lists:keyfind(release, 1, Config),
+	Vsn = case Vsn0 of
+		{cmd, Cmd} -> os:cmd(Cmd);
+		semver -> "";
+		{semver, _} -> "";
+		VsnStr -> Vsn0
+	end,
+	{ok, _} = relx:build_relup(Name, Vsn, undefined, Config ++ [{output_dir, "$(RELX_OUTPUT_DIR)"}]),
+	halt(0).
+endef
 
-relx-rel: $(RELX) rel-deps app
-	$(verbose) $(RELX) $(if $(filter 1,$V),-V 3) -c $(RELX_CONFIG) $(RELX_OPTS) release
+relx-rel: rel-deps app
+	$(call erlang,$(call relx_release.erl),-pa ebin/)
 	$(verbose) $(MAKE) relx-post-rel
 ifeq ($(RELX_TAR),1)
-	$(verbose) $(RELX) $(if $(filter 1,$V),-V 3) -c $(RELX_CONFIG) $(RELX_OPTS) tar
+	$(call erlang,$(call relx_tar.erl),-pa ebin/)
 endif
 
-relx-relup: $(RELX) rel-deps app
-	$(verbose) $(RELX) $(if $(filter 1,$V),-V 3) -c $(RELX_CONFIG) $(RELX_OPTS) release
+relx-relup: rel-deps app
+	$(call erlang,$(call relx_release.erl),-pa ebin/)
 	$(MAKE) relx-post-rel
-	$(verbose) $(RELX) $(if $(filter 1,$V),-V 3) -c $(RELX_CONFIG) $(RELX_OPTS) relup $(if $(filter 1,$(RELX_TAR)),tar)
+	$(call erlang,$(call relx_relup.erl),-pa ebin/)
+ifeq ($(RELX_TAR),1)
+	$(call erlang,$(call relx_tar.erl),-pa ebin/)
+endif
 
 distclean-relx-rel:
 	$(gen_verbose) rm -rf $(RELX_OUTPUT_DIR)
@@ -7523,6 +7605,7 @@ help::
 		"  run         Compile the project, build the release and run it"
 
 endif
+endif
 
 # Copyright (c) 2015-2016, Loïc Hoguin <[email protected]>
 # Copyright (c) 2014, M Robert Martin <[email protected]>
@@ -7694,45 +7777,224 @@ triq: test-build cover-data-dir
 endif
 endif
 
-# Copyright (c) 2016, Loïc Hoguin <[email protected]>
-# Copyright (c) 2015, Erlang Solutions Ltd.
+# Copyright (c) 2022, Loïc Hoguin <[email protected]>
 # This file is part of erlang.mk and subject to the terms of the ISC License.
 
-.PHONY: xref distclean-xref
+.PHONY: xref
 
 # Configuration.
 
-ifeq ($(XREF_CONFIG),)
-	XREFR_ARGS :=
-else
-	XREFR_ARGS := -c $(XREF_CONFIG)
-endif
+# We do not use locals_not_used or deprecated_function_calls
+# because the compiler will error out by default in those
+# cases with Erlang.mk. Deprecated functions may make sense
+# in some cases but few libraries define them. We do not
+# use exports_not_used by default because it hinders more
+# than it helps library projects such as Cowboy. Finally,
+# undefined_functions provides little that undefined_function_calls
+# doesn't already provide, so it's not enabled by default.
+XREF_CHECKS ?= [undefined_function_calls]
+
+# Instead of predefined checks a query can be evaluated
+# using the Xref DSL. The $q variable is used in that case.
+
+# The scope is a list of keywords that correspond to
+# application directories, being essentially an easy way
+# to configure which applications to analyze. With:
+#
+# - app:  .
+# - apps: $(ALL_APPS_DIRS)
+# - deps: $(ALL_DEPS_DIRS)
+# - otp:  Built-in Erlang/OTP applications.
+#
+# The default is conservative (app) and will not be
+# appropriate for all types of queries (for example
+# application_call requires adding all applications
+# that might be called or they will not be found).
+XREF_SCOPE ?= app # apps deps otp
+
+# If the above is not enough, additional application
+# directories can be configured.
+XREF_EXTRA_APP_DIRS ?=
 
-XREFR ?= $(CURDIR)/xrefr
-export XREFR
+# As well as additional non-application directories.
+XREF_EXTRA_DIRS ?=
 
-XREFR_URL ?= https://github.com/inaka/xref_runner/releases/download/1.1.0/xrefr
+# Erlang.mk supports -ignore_xref([...]) with forms
+# {M, F, A} | {F, A} | M, the latter ignoring whole
+# modules. Ignores can also be provided project-wide.
+XREF_IGNORE ?= []
+
+# All callbacks may be ignored. Erlang.mk will ignore
+# them automatically for exports_not_used (unless it
+# is explicitly disabled by the user).
+XREF_IGNORE_CALLBACKS ?=
 
 # Core targets.
 
 help::
 	$(verbose) printf '%s\n' '' \
 		'Xref targets:' \
-		'  xref        Run Xrefr using $$XREF_CONFIG as config file if defined'
-
-distclean:: distclean-xref
+		'  xref         Analyze the project using Xref' \
+		'  xref q=QUERY Evaluate an Xref query'
 
 # Plugin-specific targets.
 
-$(XREFR):
-	$(gen_verbose) $(call core_http_get,$(XREFR),$(XREFR_URL))
-	$(verbose) chmod +x $(XREFR)
-
-xref: deps app $(XREFR)
-	$(gen_verbose) $(XREFR) $(XREFR_ARGS)
+define xref.erl
+	{ok, Xref} = xref:start([]),
+	Scope = [$(call comma_list,$(XREF_SCOPE))],
+	AppDirs0 = [$(call comma_list,$(foreach d,$(XREF_EXTRA_APP_DIRS),"$d"))],
+	AppDirs1 = case lists:member(otp, Scope) of
+		false -> AppDirs0;
+		true ->
+			RootDir = code:root_dir(),
+			AppDirs0 ++ [filename:dirname(P) || P <- code:get_path(), lists:prefix(RootDir, P)]
+	end,
+	AppDirs2 = case lists:member(deps, Scope) of
+		false -> AppDirs1;
+		true -> [$(call comma_list,$(foreach d,$(ALL_DEPS_DIRS),"$d"))] ++ AppDirs1
+	end,
+	AppDirs3 = case lists:member(apps, Scope) of
+		false -> AppDirs2;
+		true -> [$(call comma_list,$(foreach d,$(ALL_APPS_DIRS),"$d"))] ++ AppDirs2
+	end,
+	AppDirs = case lists:member(app, Scope) of
+		false -> AppDirs3;
+		true -> ["../$(notdir $(CURDIR))"|AppDirs3]
+	end,
+	[{ok, _} = xref:add_application(Xref, AppDir, [{builtins, true}]) || AppDir <- AppDirs],
+	ExtraDirs = [$(call comma_list,$(foreach d,$(XREF_EXTRA_DIRS),"$d"))],
+	[{ok, _} = xref:add_directory(Xref, ExtraDir, [{builtins, true}]) || ExtraDir <- ExtraDirs],
+	ok = xref:set_library_path(Xref, code:get_path() -- (["ebin", "."] ++ AppDirs ++ ExtraDirs)),
+	Checks = case {$1, is_list($2)} of
+		{check, true} -> $2;
+		{check, false} -> [$2];
+		{query, _} -> [$2]
+	end,
+	FinalRes = [begin
+		IsInformational = case $1 of
+			query -> true;
+			check ->
+				is_tuple(Check) andalso
+					lists:member(element(1, Check),
+						[call, use, module_call, module_use, application_call, application_use])
+		end,
+		{ok, Res0} = case $1 of
+			check -> xref:analyze(Xref, Check);
+			query -> xref:q(Xref, Check)
+		end,
+		Res = case IsInformational of
+			true -> Res0;
+			false ->
+				lists:filter(fun(R) ->
+					{Mod, InMFA, MFA} = case R of
+						{InMFA0 = {M, _, _}, MFA0} -> {M, InMFA0, MFA0};
+						{M, _, _} -> {M, R, R}
+					end,
+					Attrs = try
+						Mod:module_info(attributes)
+					catch error:undef ->
+						[]
+					end,
+					InlineIgnores = lists:flatten([
+						[case V of
+							M when is_atom(M) -> {M, '_', '_'};
+							{F, A} -> {Mod, F, A};
+							_ -> V
+						end || V <- Values]
+					|| {ignore_xref, Values} <- Attrs]),
+					BuiltinIgnores = [
+						{eunit_test, wrapper_test_exported_, 0}
+					],
+					DoCallbackIgnores = case {Check, "$(strip $(XREF_IGNORE_CALLBACKS))"} of
+						{exports_not_used, ""} -> true;
+						{_, "0"} -> false;
+						_ -> true
+					end,
+					CallbackIgnores = case DoCallbackIgnores of
+						false -> [];
+						true ->
+							Behaviors = lists:flatten([
+								[BL || {behavior, BL} <- Attrs],
+								[BL || {behaviour, BL} <- Attrs]
+							]),
+							[{Mod, CF, CA} || B <- Behaviors, {CF, CA} <- B:behaviour_info(callbacks)]
+					end,
+					WideIgnores = if
+						is_list($(XREF_IGNORE)) ->
+							[if is_atom(I) -> {I, '_', '_'}; true -> I end
+								|| I <- $(XREF_IGNORE)];
+						true -> [$(XREF_IGNORE)]
+					end,
+					Ignores = InlineIgnores ++ BuiltinIgnores ++ CallbackIgnores ++ WideIgnores,
+					not (lists:member(InMFA, Ignores)
+					orelse lists:member(MFA, Ignores)
+					orelse lists:member({Mod, '_', '_'}, Ignores))
+				end, Res0)
+		end,
+		case Res of
+			[] -> ok;
+			_ when IsInformational ->
+				case Check of
+					{call, {CM, CF, CA}} ->
+						io:format("Functions that ~s:~s/~b calls:~n", [CM, CF, CA]);
+					{use, {CM, CF, CA}} ->
+						io:format("Function ~s:~s/~b is called by:~n", [CM, CF, CA]);
+					{module_call, CMod} ->
+						io:format("Modules that ~s calls:~n", [CMod]);
+					{module_use, CMod} ->
+						io:format("Module ~s is used by:~n", [CMod]);
+					{application_call, CApp} ->
+						io:format("Applications that ~s calls:~n", [CApp]);
+					{application_use, CApp} ->
+						io:format("Application ~s is used by:~n", [CApp]);
+					_ when $1 =:= query ->
+						io:format("Query ~s returned:~n", [Check])
+				end,
+				[case R of
+					{{InM, InF, InA}, {M, F, A}} ->
+						io:format("- ~s:~s/~b called by ~s:~s/~b~n",
+							[M, F, A, InM, InF, InA]);
+					{M, F, A} ->
+						io:format("- ~s:~s/~b~n", [M, F, A]);
+					ModOrApp ->
+						io:format("- ~s~n", [ModOrApp])
+				end || R <- Res],
+				ok;
+			_ ->
+				[case {Check, R} of
+					{undefined_function_calls, {{InM, InF, InA}, {M, F, A}}} ->
+						io:format("Undefined function ~s:~s/~b called by ~s:~s/~b~n",
+							[M, F, A, InM, InF, InA]);
+					{undefined_functions, {M, F, A}} ->
+						io:format("Undefined function ~s:~s/~b~n", [M, F, A]);
+					{locals_not_used, {M, F, A}} ->
+						io:format("Unused local function ~s:~s/~b~n", [M, F, A]);
+					{exports_not_used, {M, F, A}} ->
+						io:format("Unused exported function ~s:~s/~b~n", [M, F, A]);
+					{deprecated_function_calls, {{InM, InF, InA}, {M, F, A}}} ->
+						io:format("Deprecated function ~s:~s/~b called by ~s:~s/~b~n",
+							[M, F, A, InM, InF, InA]);
+					{deprecated_functions, {M, F, A}} ->
+						io:format("Deprecated function ~s:~s/~b~n", [M, F, A]);
+					_ ->
+						io:format("~p: ~p~n", [Check, R])
+				end || R <- Res],
+				error
+		end
+	end || Check <- Checks],
+	stopped = xref:stop(Xref),
+	case lists:usort(FinalRes) of
+		[ok] -> halt(0);
+		_ -> halt(1)
+	end
+endef
 
-distclean-xref:
-	$(gen_verbose) rm -rf $(XREFR)
+xref: deps app
+ifdef q
+	$(verbose) $(call erlang,$(call xref.erl,query,"$q"),-pa ebin/)
+else
+	$(verbose) $(call erlang,$(call xref.erl,check,$(XREF_CHECKS)),-pa ebin/)
+endif
 
 # Copyright (c) 2016, Loïc Hoguin <[email protected]>
 # Copyright (c) 2015, Viktor Söderqvist <[email protected]>
diff --git a/test/event_SUITE.erl b/test/event_SUITE.erl
index abd217d..ac8f1fc 100644
--- a/test/event_SUITE.erl
+++ b/test/event_SUITE.erl
@@ -214,7 +214,7 @@ tls_handshake_end_error(Config) ->
 		event_handler => {?MODULE, self()},
 		protocols => [config(name, config(tc_group_properties, Config))],
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	},
 	{ok, Pid} = gun:open("localhost", OriginPort, Opts),
 	#{
@@ -256,7 +256,7 @@ tls_handshake_start_tcp_connect_tls(Config) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	ReplyTo = self(),
 	#{
@@ -290,7 +290,7 @@ tls_handshake_end_error_tcp_connect_tls(Config) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	ReplyTo = self(),
 	#{
@@ -324,7 +324,7 @@ tls_handshake_end_ok_tcp_connect_tls(Config) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	ReplyTo = self(),
 	#{
@@ -351,7 +351,7 @@ tls_handshake_start_tls_connect_tls(Config) ->
 		event_handler => {?MODULE, self()},
 		protocols => [Protocol],
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, Protocol} = gun:await_up(ConnPid),
 	tunnel_SUITE:do_handshake_completed(Protocol, ProxyPid),
@@ -361,7 +361,7 @@ tls_handshake_start_tls_connect_tls(Config) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	ReplyTo = self(),
 	#{
@@ -388,7 +388,7 @@ tls_handshake_end_error_tls_connect_tls(Config) ->
 		event_handler => {?MODULE, self()},
 		protocols => [Protocol],
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, Protocol} = gun:await_up(ConnPid),
 	tunnel_SUITE:do_handshake_completed(Protocol, ProxyPid),
@@ -398,7 +398,7 @@ tls_handshake_end_error_tls_connect_tls(Config) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	ReplyTo = self(),
 	#{
@@ -425,7 +425,7 @@ tls_handshake_end_ok_tls_connect_tls(Config) ->
 		event_handler => {?MODULE, self()},
 		protocols => [Protocol],
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, Protocol} = gun:await_up(ConnPid),
 	tunnel_SUITE:do_handshake_completed(Protocol, ProxyPid),
@@ -435,7 +435,7 @@ tls_handshake_end_ok_tls_connect_tls(Config) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	ReplyTo = self(),
 	#{
@@ -1793,7 +1793,7 @@ do_protocol_changed_tls_connect(Config, OriginProtocol) ->
 		event_handler => {?MODULE, self()},
 		protocols => [ProxyProtocol],
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, ProxyProtocol} = gun:await_up(ConnPid),
 	tunnel_SUITE:do_handshake_completed(ProxyProtocol, ProxyPid),
@@ -1801,7 +1801,7 @@ do_protocol_changed_tls_connect(Config, OriginProtocol) ->
 		host => "localhost",
 		port => OriginPort,
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [OriginProtocol]
 	}),
 	#{
@@ -2031,7 +2031,7 @@ do_gun_open_tls(Config) ->
 		http2_opts => #{notify_settings_changed => true},
 		protocols => [config(name, config(tc_group_properties, Config))],
 		transport => tls,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	},
 	{ok, Pid} = gun:open("localhost", OriginPort, Opts),
 	{ok, Pid, OriginPort}.
diff --git a/test/gun_SUITE.erl b/test/gun_SUITE.erl
index 9112c5d..6501355 100644
--- a/test/gun_SUITE.erl
+++ b/test/gun_SUITE.erl
@@ -461,14 +461,14 @@ server_name_indication_custom(_) ->
 	doc("Ensure a custom server_name_indication is accepted."),
 	do_server_name_indication("localhost", net_adm:localhost(), #{
 		tls_opts => [
-			{verify, verify_none},
+			{verify, verify_none}, {versions, ['tlsv1.2']},
 			{server_name_indication, net_adm:localhost()}]
 	}).
 
 server_name_indication_default(_) ->
 	doc("Ensure a default server_name_indication is accepted."),
 	do_server_name_indication(net_adm:localhost(), net_adm:localhost(), #{
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}).
 
 do_server_name_indication(Host, Expected, GunOpts) ->
diff --git a/test/raw_SUITE.erl b/test/raw_SUITE.erl
index ac64efb..67fa542 100644
--- a/test/raw_SUITE.erl
+++ b/test/raw_SUITE.erl
@@ -40,7 +40,7 @@ do_direct_raw(OriginTransport) ->
 	{ok, OriginPid, OriginPort} = init_origin(OriginTransport, raw, fun do_echo/3),
 	{ok, ConnPid} = gun:open("localhost", OriginPort, #{
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [raw]
 	}),
 	{ok, raw} = gun:await_up(ConnPid),
@@ -79,12 +79,12 @@ do_socks5_raw(OriginTransport, ProxyTransport) ->
 	{ok, ProxyPid, ProxyPort} = socks_SUITE:do_proxy_start(ProxyTransport, none),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [{socks, #{
 			host => "localhost",
 			port => OriginPort,
 			transport => OriginTransport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [raw]
 		}}]
 	}),
@@ -135,14 +135,14 @@ do_connect_raw(OriginTransport, ProxyTransport) ->
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, http} = gun:await_up(ConnPid),
 	StreamRef = gun:connect(ConnPid, #{
 		host => "localhost",
 		port => OriginPort,
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [raw]
 	}),
 	{request, <<"CONNECT">>, Authority, 'HTTP/1.1', _} = receive_from(ProxyPid),
@@ -216,7 +216,7 @@ do_http11_upgrade_raw(OriginTransport) ->
 		end),
 	{ok, ConnPid} = gun:open("localhost", OriginPort, #{
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, http} = gun:await_up(ConnPid),
 	handshake_completed = receive_from(OriginPid),
@@ -288,7 +288,7 @@ do_http2_connect_raw(OriginTransport, ProxyScheme, ProxyTransport) ->
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http2]
 	}),
 	{ok, http2} = gun:await_up(ConnPid),
diff --git a/test/rfc6265bis_SUITE.erl b/test/rfc6265bis_SUITE.erl
index f9f93b4..5c66c53 100644
--- a/test/rfc6265bis_SUITE.erl
+++ b/test/rfc6265bis_SUITE.erl
@@ -94,7 +94,7 @@ do_informational_set_cookie(Config, Boolean) ->
 	Protocol = config(protocol, Config),
 	{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [{Protocol, #{cookie_ignore_informational => Boolean}}],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -128,7 +128,7 @@ set_cookie_connect_tcp(Config) ->
 		host => "localhost",
 		port => config(port, Config),
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol]
 	}),
 	{response, fin, 200, _} = gun:await(ConnPid, StreamRef1),
@@ -152,7 +152,7 @@ set_cookie_connect_tls(Config) ->
 	{ok, ProxyPid, ProxyPort} = event_SUITE:do_proxy_start(Protocol, tls),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -162,7 +162,7 @@ set_cookie_connect_tls(Config) ->
 		host => "localhost",
 		port => config(port, Config),
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol]
 	}),
 	{response, fin, 200, _} = gun:await(ConnPid, StreamRef1),
@@ -449,7 +449,7 @@ do_wpt_domain_test(Config, TestCase) ->
 	Protocol = config(protocol, Config),
 	{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -520,7 +520,7 @@ wpt_path_default(Config) ->
 	Protocol = config(protocol, Config),
 	{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -567,7 +567,7 @@ wpt_path_match(Config) ->
 		ct:log("Positive test: ~s", [P]),
 		{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 			transport => config(transport, Config),
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [Protocol],
 			cookie_store => gun_cookies_list:init()
 		}),
@@ -587,7 +587,7 @@ wpt_path_match(Config) ->
 		ct:log("Negative test: ~s", [P]),
 		{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 			transport => config(transport, Config),
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [Protocol],
 			cookie_store => gun_cookies_list:init()
 		}),
@@ -680,7 +680,7 @@ do_wpt_prefix_common(Config, TestCase, Expected, Name) ->
 	ct:log("Test case: ~s~nCookie must be set? ~s", [TestCase, Expected]),
 	{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -733,7 +733,7 @@ do_wpt_secure_common(Config, TestCase) ->
 	Protocol = config(protocol, Config),
 	{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -770,7 +770,7 @@ do_wpt_secure_ws_common(Config) ->
 	Protocol = config(protocol, Config),
 	{ok, ConnPid1} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
@@ -783,7 +783,7 @@ do_wpt_secure_ws_common(Config) ->
 	gun:close(ConnPid1),
 	{ok, ConnPid2} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => CookieStore
 	}),
@@ -912,7 +912,7 @@ do_wpt_set_test(TestPath, Name, Cookie, Expected, DefaultPath, Config) ->
 	Protocol = config(protocol, Config),
 	{ok, ConnPid} = gun:open("localhost", config(port, Config), #{
 		transport => config(transport, Config),
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol],
 		cookie_store => gun_cookies_list:init()
 	}),
diff --git a/test/rfc7230_SUITE.erl b/test/rfc7230_SUITE.erl
index b0ad323..b7c29e4 100644
--- a/test/rfc7230_SUITE.erl
+++ b/test/rfc7230_SUITE.erl
@@ -59,7 +59,7 @@ do_host_port(Transport, DefaultPort, HostHeaderPort) ->
 	{ok, OriginPid, OriginPort} = init_origin(Transport, http),
 	{ok, ConnPid} = gun:open("localhost", OriginPort, #{
 		transport => Transport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, http} = gun:await_up(ConnPid),
 	%% Change the origin's port in the state to trigger the default port behavior.
diff --git a/test/rfc7231_SUITE.erl b/test/rfc7231_SUITE.erl
index e07ec04..c274ecb 100644
--- a/test/rfc7231_SUITE.erl
+++ b/test/rfc7231_SUITE.erl
@@ -148,14 +148,14 @@ do_connect_http(OriginScheme, OriginTransport, ProxyTransport) ->
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, http} = gun:await_up(ConnPid),
 	StreamRef = gun:connect(ConnPid, #{
 		host => "localhost",
 		port => OriginPort,
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{request, <<"CONNECT">>, Authority, 'HTTP/1.1', _} = receive_from(ProxyPid),
 	{response, fin, 200, _} = gun:await(ConnPid, StreamRef),
@@ -207,14 +207,14 @@ do_connect_h2(OriginScheme, OriginTransport, ProxyTransport) ->
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, http} = gun:await_up(ConnPid),
 	StreamRef = gun:connect(ConnPid, #{
 		host => "localhost",
 		port => OriginPort,
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http2]
 	}),
 	{request, <<"CONNECT">>, Authority, 'HTTP/1.1', _} = receive_from(ProxyPid),
@@ -256,7 +256,7 @@ do_connect_through_multiple_proxies(OriginScheme, OriginTransport, ProxiesTransp
 	{ok, Proxy2Pid, Proxy2Port} = do_proxy_start(ProxiesTransport),
 	{ok, ConnPid} = gun:open("localhost", Proxy1Port, #{
 		transport => ProxiesTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{ok, http} = gun:await_up(ConnPid),
 	Authority1 = iolist_to_binary(["localhost:", integer_to_binary(Proxy2Port)]),
@@ -264,7 +264,7 @@ do_connect_through_multiple_proxies(OriginScheme, OriginTransport, ProxiesTransp
 		host => "localhost",
 		port => Proxy2Port,
 		transport => ProxiesTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	{request, <<"CONNECT">>, Authority1, 'HTTP/1.1', _} = receive_from(Proxy1Pid),
 	{response, fin, 200, _} = gun:await(ConnPid, StreamRef1),
@@ -274,7 +274,7 @@ do_connect_through_multiple_proxies(OriginScheme, OriginTransport, ProxiesTransp
 		host => "localhost",
 		port => OriginPort,
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}, [], #{tunnel => StreamRef1}),
 	{request, <<"CONNECT">>, Authority2, 'HTTP/1.1', _} = receive_from(Proxy2Pid),
 	{response, fin, 200, _} = gun:await(ConnPid, StreamRef2),
diff --git a/test/rfc7540_SUITE.erl b/test/rfc7540_SUITE.erl
index 2423f24..159d036 100644
--- a/test/rfc7540_SUITE.erl
+++ b/test/rfc7540_SUITE.erl
@@ -214,7 +214,7 @@ do_authority_port(Transport0, DefaultPort, AuthorityHeaderPort) ->
 	end),
 	{ok, ConnPid} = gun:open("localhost", OriginPort, #{
 		transport => Transport0,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http2]
 	}),
 	{ok, http2} = gun:await_up(ConnPid),
@@ -508,7 +508,7 @@ do_connect_http(OriginScheme, OriginTransport, OriginProtocol, ProxyScheme, Prox
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http2]
 	}),
 	{ok, http2} = gun:await_up(ConnPid),
@@ -517,7 +517,7 @@ do_connect_http(OriginScheme, OriginTransport, OriginProtocol, ProxyScheme, Prox
 		host => "localhost",
 		port => OriginPort,
 		transport => OriginTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [OriginProtocol]
 	}),
 	{request, #{
@@ -613,7 +613,7 @@ do_connect_cowboy(_OriginScheme, OriginTransport, OriginProtocol, _ProxyScheme,
 		Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 		{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 			transport => ProxyTransport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [http2]
 		}),
 		{ok, http2} = gun:await_up(ConnPid),
@@ -622,7 +622,7 @@ do_connect_cowboy(_OriginScheme, OriginTransport, OriginProtocol, _ProxyScheme,
 			host => "localhost",
 			port => OriginPort,
 			transport => OriginTransport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [OriginProtocol]
 		}),
 		{request, #{
@@ -710,7 +710,7 @@ do_connect_via_multiple_proxies(OriginTransport, OriginProtocol,
 		%% First proxy.
 		{ok, ConnPid} = gun:open("localhost", Proxy1Port, #{
 			transport => Proxy1Transport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [http2]
 		}),
 		{ok, http2} = gun:await_up(ConnPid),
@@ -720,7 +720,7 @@ do_connect_via_multiple_proxies(OriginTransport, OriginProtocol,
 			host => "localhost",
 			port => Proxy2Port,
 			transport => Proxy2Transport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [Proxy2Protocol]
 		}, []),
 		Authority1 = iolist_to_binary(["localhost:", integer_to_binary(Proxy2Port)]),
@@ -735,7 +735,7 @@ do_connect_via_multiple_proxies(OriginTransport, OriginProtocol,
 			host => "localhost",
 			port => OriginPort,
 			transport => OriginTransport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [OriginProtocol]
 		}, [], #{tunnel => StreamRef1}),
 		Authority2 = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
diff --git a/test/socks_SUITE.erl b/test/socks_SUITE.erl
index b536b36..9ec0ef1 100644
--- a/test/socks_SUITE.erl
+++ b/test/socks_SUITE.erl
@@ -214,13 +214,13 @@ do_socks5(OriginScheme, OriginTransport, OriginProtocol, ProxyTransport, SocksAu
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", ProxyPort, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [{socks, #{
 			auth => [SocksAuth],
 			host => "localhost",
 			port => OriginPort,
 			transport => OriginTransport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [OriginProtocol]
 		}}]
 	}),
@@ -291,17 +291,17 @@ do_socks5_through_multiple_proxies(OriginScheme, OriginTransport, ProxyTransport
 	Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]),
 	{ok, ConnPid} = gun:open("localhost", Proxy1Port, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [{socks, #{
 			host => "localhost",
 			port => Proxy2Port,
 			transport => ProxyTransport,
-			tls_opts => [{verify, verify_none}],
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 			protocols => [{socks, #{
 				host => "localhost",
 				port => OriginPort,
 				transport => OriginTransport,
-				tls_opts => [{verify, verify_none}]
+				tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 			}}]
 		}}]
 	}),
@@ -371,7 +371,7 @@ do_socks5_through_connect_proxy(OriginScheme, OriginTransport, ProxyTransport) -
 	{ok, Proxy2Pid, Proxy2Port} = do_proxy_start(ProxyTransport, none),
 	{ok, ConnPid} = gun:open("localhost", Proxy1Port, #{
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}]
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 	}),
 	%% We receive a gun_up first. This is the HTTP proxy.
 	{ok, http} = gun:await_up(ConnPid),
@@ -380,12 +380,12 @@ do_socks5_through_connect_proxy(OriginScheme, OriginTransport, ProxyTransport) -
 		host => "localhost",
 		port => Proxy2Port,
 		transport => ProxyTransport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [{socks, #{
 			host => "localhost",
 			port => OriginPort,
 			transport => OriginTransport,
-			tls_opts => [{verify, verify_none}]
+			tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}]
 		}}]
 	}),
 	{request, <<"CONNECT">>, Authority1, 'HTTP/1.1', _} = receive_from(Proxy1Pid),
diff --git a/test/sse_SUITE.erl b/test/sse_SUITE.erl
index 93b1acb..7d8d28f 100644
--- a/test/sse_SUITE.erl
+++ b/test/sse_SUITE.erl
@@ -41,7 +41,7 @@ init_routes() -> [
 http_clock(Config) ->
 	{ok, Pid} = gun:open("localhost", config(port, Config), #{
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http],
 		http_opts => #{content_handlers => [gun_sse_h, gun_data_h]}
 	}),
@@ -51,7 +51,7 @@ http_clock(Config) ->
 http2_clock(Config) ->
 	{ok, Pid} = gun:open("localhost", config(port, Config), #{
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http2],
 		http2_opts => #{content_handlers => [gun_sse_h, gun_data_h]}
 	}),
@@ -61,7 +61,7 @@ http2_clock(Config) ->
 http_clock_close(Config) ->
 	{ok, Pid} = gun:open("localhost", config(port, Config), #{
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http],
 		http_opts => #{
 			content_handlers => [gun_sse_h, gun_data_h],
@@ -107,7 +107,7 @@ event_loop(Pid, Ref, N) ->
 lone_id(Config) ->
 	{ok, Pid} = gun:open("localhost", config(port, Config), #{
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http],
 		http_opts => #{content_handlers => [gun_sse_h, gun_data_h]}
 	}),
@@ -135,7 +135,7 @@ lone_id(Config) ->
 with_mime_param(Config) ->
 	{ok, Pid} = gun:open("localhost", config(port, Config), #{
 		transport => tls,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [http],
 		http_opts => #{content_handlers => [gun_sse_h, gun_data_h]}
 	}),
diff --git a/test/tunnel_SUITE.erl b/test/tunnel_SUITE.erl
index 9027af2..084dfd8 100644
--- a/test/tunnel_SUITE.erl
+++ b/test/tunnel_SUITE.erl
@@ -831,7 +831,7 @@ do_proxy1(State=#st{proxy1=Type, proxy1_pid=Proxy1Pid, proxy1_port=Port}) ->
 	{Transport, Protocol} = do_type(Type),
 	{ok, ConnPid} = gun:open("localhost", Port, #{
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [case Protocol of
 			socks ->
 				{Protocol, do_proxy2_socks_opts(State)};
@@ -849,7 +849,7 @@ do_proxy2_socks_opts(State=#st{proxy2=Type, proxy2_port=Port}) ->
 		host => "localhost",
 		port => Port,
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [case Protocol of
 			socks ->
 				{Protocol, do_origin_socks_opts(State)};
@@ -864,7 +864,7 @@ do_origin_socks_opts(#st{origin=Type, origin_port=Port}) ->
 		host => "localhost",
 		port => Port,
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol]
 	}.
 
@@ -882,7 +882,7 @@ do_proxy2(State=#st{proxy2=Type, proxy2_pid=Proxy2Pid, proxy2_port=Port}, ConnPi
 		host => "localhost",
 		port => Port,
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [case Protocol of
 			socks ->
 				{Protocol, do_origin_socks_opts(State)};
@@ -909,7 +909,7 @@ do_origin(#st{origin=Type, origin_port=Port}, ConnPid, StreamRef1) ->
 		host => "localhost",
 		port => Port,
 		transport => Transport,
-		tls_opts => [{verify, verify_none}],
+		tls_opts => [{verify, verify_none}, {versions, ['tlsv1.2']}],
 		protocols => [Protocol]
 	}, [], #{tunnel => StreamRef1}),
 	{response, fin, 200, _} = gun:await(ConnPid, StreamRef2),