chore(deps): bump httpx2 from 2.5.0 to 2.12.0

[dependabot]

Bumps httpx2 from 2.5.0 to 2.12.0.

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

2.10.0 (August 9th, 2026)

Added

• Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
• Add max_event_size to cap SSE event buffering. (#1071)
• Add RFC 9110 status code constants. (#1069)
• Add support for Python 3.15. (#1090)

Changed

• Improve SSE chunk buffering performance. (#1117)
• Skip cookie extraction for responses without Set-Cookie headers. (#1107)
• Return str | None instead of Any from Headers.get. (#1121)

Fixed

... (truncated)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head product diff. Coverage is a separate gate.

Changed files

• pyproject.toml — repository behavior
• requirements.txt — repository behavior

Changed behavior

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: pyproject.toml"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: pyproject.toml"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: requirements.txt"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: requirements.txt"]
  R2 --> V2["required checks"]

Loading

Findings

No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.

• Head SHA: 8ff8cbb405e08cc10a29ff3830e2770665952600
• Workflow run: 34287451995
• Workflow attempt: 1
• Coverage gate: failure

Review outcome

Coverage is a gate, not the review. This body reviews the changed product files.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Repository file: pyproject.toml"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Repository file: pyproject.toml"]
  R1 --> V1["required checks"]
  Evidence --> S2["Repository file: requirements.txt"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Repository file: requirements.txt"]
  R2 --> V2["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8ff8cbb405e08cc10a29ff3830e2770665952600
• Workflow run: 34287451995
• Workflow attempt: 1
• Gate result: COVERAGE_BLOCKED
• Coverage gate: failure
• Model pool: unknown
• Verdict: COVERAGE_BLOCKED
• Formal review: chore(deps): bump httpx2 from 2.5.0 to 2.12.0 #550 (review)

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

[seonghobae]

Fleet repair finding on current dependency lane.

The 2.12.0 declaration is necessary, but this PR was false-GREEN at 8ff8cbb405e08cc10a29ff3830e2770665952600: pyproject.toml and requirements.txt declared httpx2==2.12.0, while canonical requirements-lock.txt still installed httpx2==2.5.0 and httpcore2==2.5.0. This matters because repository CI and the Dockerfile install requirements-lock.txt with --require-hashes, then install the project editable with --no-deps; the old CI therefore exercised 2.5.0 rather than the declared 2.12.0. Protected-main Trivy also reports the 2.5.0 vulnerability set, including the bounded-decompression issue fixed in 2.12.0.

RED was added first at e44021d9cd290a380b1febc2c3705072956f0011: tests/test_dependency_lock_contract.py reads the exact runtime pin from requirements.txt and requires the installed httpx2 version to match. Under the current hash-locked CI install this is expected to fail as 2.5.0 != 2.12.0; no predecessor GREEN is accepted for this head.

Minimal GREEN: regenerate requirements-lock.txt from the checked-in command so it contains the 2.12.0 lockstep (httpx2==2.12.0, httpcore2==2.12.0) and valid hashes/transitives, then require exact-head CI, Security/Trivy, SAST, fuzz and CodeQL plus independent post-last-push review. Do not weaken --require-hashes, suppress Trivy, or install a second mutable overlay. PR is Draft until the lock and exact-head evidence agree.

[seonghobae]

Hosted RED is now real on exact head 9fdb3be273421a8b1599db8774766eed9f81190b. The first test-only commit used pytest function style, but this repository's canonical CI runs python -m unittest discover -s tests -v, so that first generation did not execute the new test; I corrected the harness instead of treating it as evidence. Current DependencyLockContractTests is discovered by unittest. Python 3.10 job 102469288034 installs the canonical hash lock (httpcore2==2.5.0, httpx2==2.5.0) and then fails exactly at test_installed_httpx2_matches_declared_runtime_pin: AssertionError: '2.5.0' != '2.12.0'. Python 3.11 is also terminal RED on the same exact head. This is the causal acceptance test, not a generic failing check.

Keep Draft. Minimal GREEN remains regeneration of the canonical requirements-lock.txt with valid hashes/transitives for the declared 2.12.0 runtime (including lockstep httpcore2==2.12.0), followed by fresh exact-head CI/Security/SAST/fuzz/CodeQL and post-last-push independent review. No hash-lock weakening, scanner suppression, mutable overlay, or predecessor-GREEN transfer.

[seonghobae]

@jules Please implement the checked-in causal RED on the current exact head 9fdb3be273421a8b1599db8774766eed9f81190b as an ordinary descendant, without rewriting history.

Repository authority is explicit: requirements-lock.txt is generated with pip-compile --allow-unsafe --generate-hashes --output-file=requirements-lock.txt --pip-args='--platform manylinux2014_x86_64 --implementation cp --python-version 3.10 --abi cp310 --only-binary=:all:' requirements.txt; CI and Docker install that file under --require-hashes. Current exact-head CI run 34352600705, Python 3.10 job 102469288034, therefore installs httpcore2==2.5.0 and httpx2==2.5.0 and fails the focused unittest with AssertionError: '2.5.0' != '2.12.0' after 633 other tests pass.

Run the checked-in canonical lock generator with Python 3.12 and commit the generated requirements-lock.txt. Keep tests/test_dependency_lock_contract.py. The authoritative upstream 2.12.0 package contract requires httpcore2==2.12.0, anyio>=4.10, truststore>=0.10, idna>=3.18, and typing_extensions>=4.5.0 on Python <3.13; httpcore2 requires truststore>=0.10 and h11>=0.16. The current lock already has anyio 4.14.1, truststore 0.10.4, idna 3.18, typing-extensions 4.16.0 and h11 0.16.0, so preserve unrelated resolved versions unless the canonical resolver causally changes them. Expected lockstep wheel identities for verification are httpx2 2.12.0 SHA256 cc8b6eecb8661c146b8f89a60e97456ee086e91a784ed31ac450c3a9e613dd36 and httpcore2 2.12.0 SHA256 7e04258ce01013d7d615e5b910a3b27fac937d7a95038227e79652b4ba3b4ceb; do not hand-write or guess generated hashes.

GREEN requires exact-head Python 3.10/3.11/3.12 CI to install and exercise 2.12.0, plus repository Security/Trivy, SAST, fuzz, CodeQL and post-last-push independent review. Do not weaken --require-hashes, suppress scanners, add a mutable overlay, use a source-neutral retrigger, force-push, or destructively rebase. Keep Draft until the exact-head evidence is terminal.