Bump httpx2 from 2.10.0 to 2.12.0

[dependabot]

Bumps httpx2 from 2.10.0 to 2.12.0.

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• See full diff in compare view

[claude]

LGTM — a mechanical Dependabot lockfile-only bump (httpx2/httpcore2 2.5.0 → 2.12.0) with no pyproject or source changes, exactly the shape the dependency policy sanctions.

What was reviewed:

• Confirmed pyproject's httpx2>=2.5.0 floor is untouched and the new resolution-markers split partitions the version/platform space without gaps or overlaps.
• The new transitive httpx2-jsfetch and the anyio/httpcore2/truststore exclusions are gated to sys_platform == 'emscripten', which no CI matrix leg or dev workflow runs on; a bare-transport httpx2 on emscripten 3.10/3.11 is upstream metadata, not a lockfile defect.
• Checked the absence of backports.zstd in the lock: uv resolves from published wheel metadata, so its absence means it's an optional extra upstream, and the pre-commit uv.lock consistency check plus hash-verified uv sync in CI would catch any hand-edited entry.

Extended reasoning...

Overview

The diff touches exactly one file, /home/claude/python-sdk/uv.lock, in a single Dependabot commit. It bumps the locked httpx2 and httpcore2 from 2.5.0 to 2.12.0, adds emscripten-conditional markers to httpx2's dependencies (anyio, httpcore2, truststore excluded on sys_platform == 'emscripten'), adds the new transitive package httpx2-jsfetch 1.0 (only for Python >= 3.12 on emscripten), and splits the top-level resolution-markers block into three branches. The declared requirement in pyproject.toml remains httpx2>=2.5.0, so this is purely a refresh of the tested-against versions — the shape the repository's dependency policy explicitly sanctions for Dependabot lockfile bumps.

Security risks

The main risk class for a lockfile bump is a poisoned or substituted package entry. I checked what can be verified statically: every entry has a matching sdist+wheel pair hosted on files.pythonhosted.org with filenames that match the declared name and version, plausible sizes and upload times consistent with the release dates in the changelog, and the registry is pypi.org for all of them. Direct hash verification against PyPI was not possible in this sandbox (network commands were denied by the permission system), but uv verifies lockfile hashes at install time, so any hash that does not match the real registry artifact would fail uv sync on the first CI run rather than silently installing something else. The new httpx2-jsfetch dependency is the notable addition, but it is a transitive dependency declared by httpx2's own wheel metadata (matching the upstream 2.10.0 changelog entry adding Pyodide/emscripten support), and its marker gate means it is never installed on any environment this SDK develops or tests on.

Level of scrutiny

Low-to-moderate scrutiny is appropriate: lockfile-only Dependabot bumps are mechanical, but a minor-version jump spanning several releases (2.5 → 2.12) warrants checking that the resolution changes cannot break the CI matrix. I verified the three resolution-marker branches partition the space completely and disjointly (>= 3.14; 3.12–3.13 on emscripten; everything else below 3.14), and that all new marker conditions involve sys_platform == 'emscripten', which no leg of the 3.10–3.14 × {ubuntu, windows} × {locked, lowest-direct} matrix exercises. The two candidate issues investigated during the hunt (emscripten 3.10/3.11 losing both transports, and the missing backports.zstd) both trace to upstream httpx2 metadata rather than anything this lockfile could have gotten wrong: uv resolves mechanically from published wheel metadata, and the pre-commit uv.lock consistency check would flag any hand-edited dependency list.

Other factors

The bug hunt exited on dry_streak with zero findings. The PR timeline contains only the Dependabot commit — no prior reviews, objections, or unresolved threads. Any behavioral regression the new httpx2 introduced at runtime (e.g., new deprecation warnings) would fail CI outright, since pytest runs with warnings-as-errors and 100% coverage enforcement across the full matrix. Given the mechanical nature of the change, the policy explicitly blessing this exact kind of bump, and CI's hash verification providing the final integrity check I could not perform locally, this does not need a human's attention.

[Kludex]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

I checked the branch locally and git merge origin/main is already Already up to date, so there isn’t a remaining merge conflict to resolve in the current PR state. Current head: 4b21c4d.

[claude]

LGTM, straightforward lockfile bump of httpx2/httpcore2 from 2.10.0 to 2.12.0 after the rebase onto the merged httpcore2 2.10.0 bump.

What was reviewed:

• The only changes are version, sdist/wheel URL, sha256, size and upload-time fields for the two [[package]] entries; dependency lists for both are unchanged.
• pyproject.toml is untouched, so the published httpx2>=2.5.0 floor is unchanged and 2.12.0 satisfies every specifier = ">=2.5.0" entry in the lock.
• The release notes' backports.zstd change does not appear as a new dependency in the lock, so it is confined to an extra this SDK does not use.

Extended reasoning...

The change touches only uv.lock, moving the httpx2 and httpcore2 package entries from 2.10.0 to 2.12.0 with updated artifact URLs, hashes, sizes and timestamps; no source, test, or pyproject.toml lines change. It touches no security-sensitive surface. The diff is a 6-line mechanical Dependabot refresh with unchanged dependency lists and no CODEOWNERS file in the repository, and the new commit is a rebase onto the already-merged httpcore2 2.10.0 bump, which is why this qualifies for approval rather than a human look. Lock consistency could not be re-run in this sandbox, but the pre-commit uv.lock check and the locked/lowest-direct CI matrix cover that.