Skip to content

chore(deps): bump httpx2 from 2.5.0 to 2.10.0 - #405

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/httpx2-2.10.0
Closed

chore(deps): bump httpx2 from 2.5.0 to 2.10.0#405
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/httpx2-2.10.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps httpx2 from 2.5.0 to 2.10.0.

Release notes

Sourced from httpx2's releases.

v2.10.0

Highlights

🚀 Performance and memory improvements

  • Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (pydantic/httpx2#1127).
  • SSE parsing is up to 35x faster on highly fragmented streams (pydantic/httpx2#1117).
  • Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (pydantic/httpx2#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (pydantic/httpx2#1119, pydantic/httpx2#1114). Thanks @​hoodmane!

httpx2

Added

Changed

Fixed

httpcore2

Added

Changed

Fixed

🙏 New Contributors

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.10.0 (August 9th, 2026)

Added

  • Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
  • Add max_event_size to cap SSE event buffering. (#1071)
  • Add RFC 9110 status code constants. (#1069)
  • Add support for Python 3.15. (#1090)

Changed

  • Improve SSE chunk buffering performance. (#1117)
  • Skip cookie extraction for responses without Set-Cookie headers. (#1107)
  • Return str | None instead of Any from Headers.get. (#1121)

Fixed

  • Enforce the WebSocket max message size across fragmented messages. (#1085)
  • Ignore unsolicited and duplicate WebSocket Pong frames. (#1122)

2.9.1 (July 24th, 2026)

Fixed

  • Alias httpcore imports to httpcore2 in alias_httpx(). (#1082)

2.9.0 (July 23rd, 2026)

Added

  • Add alias_httpx(), letting applications make import httpx resolve to httpx2 process-wide. (#1077)

2.8.0 (July 23rd, 2026)

No changes since 2.7.0. Version bumped to stay in lockstep with httpcore2.

2.7.0 (July 14th, 2026)

Changed

  • Update the vendored httpx-ws to upstream v0.9.0. (#1067)

2.6.0 (July 14th, 2026)

Added

  • Add native WebSocket support by vendoring httpx-ws, installable with httpx2[ws]. (#1042)
  • Add support for the QUERY HTTP method via httpx2.query() and client.query(). (#1055)

... (truncated)

Commits
  • a966320 Version 2.10.0 (#1129)
  • dee1d1a Return str | None instead of Any from Headers.get (#1121)
  • dec24ad Use httpx2-jsfetch on Emscripten (#1119)
  • 454b8b2 Ignore unsolicited and duplicate Pong frames (#1122)
  • cbfc0e0 Improve SSE chunk buffering performance (#1117)
  • ad141d8 Refactor SSE parser coordination (#1118)
  • e0b0124 Make _client depend on the _transports package instead of its submodules ...
  • e52f963 Skip dependencies not needed on Emscripten (#1114)
  • 5d9eedc Add max_event_size to cap SSE event buffering (#1071)
  • 55fad71 Bump the python-packages group across 1 directory with 15 updates (#1112)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 76b0713506ab078ab31123326232cb54f6eb6a0a.

  • Head SHA: 76b0713506ab078ab31123326232cb54f6eb6a0a

  • Workflow run: 31641043272

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: 643b3d7dda2b4913bbe08179dd5be8f278a75b95
  • Workflow run: 31905415539
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 643b3d7dda2b4913bbe08179dd5be8f278a75b95.

  • Head SHA: 643b3d7dda2b4913bbe08179dd5be8f278a75b95

  • Workflow run: 31905415539

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

Copy link
Copy Markdown
Contributor

@dependabot recreate

Bumps [httpx2](https://github.com/pydantic/httpx2) from 2.5.0 to 2.10.0.
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.5.0...v2.10.0)

---
updated-dependencies:
- dependency-name: httpx2
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/main/httpx2-2.10.0 branch from 76b0713 to 643b3d7 Compare August 15, 2026 13:40

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

  • Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

  • Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

  • Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

  • Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

  • Result: REQUEST_CHANGES

  • Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 643b3d7dda2b4913bbe08179dd5be8f278a75b95.

  • Head SHA: 643b3d7dda2b4913bbe08179dd5be8f278a75b95

  • Workflow run: 31905415539

  • Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]
Loading

@opencode-agent opencode-agent Bot added area: api API, protocol, event, or external contract area: dependencies Dependency or lockfile maintenance priority: medium Normal-priority or P2 work status: needs-review Open pull request requiring current-head review or checks type: maintenance Maintenance, build, dependency, or operational upkeep labels Aug 22, 2026

Copy link
Copy Markdown
Contributor

Current dependency ownership has moved past this older-base 2.10.0 bump. Canonical successor #558 (21824f77e9ee4c26c42bb1f21f00eaa3ae21fb6d, protected base 47c6fd27...) removes unused httpx2/httpcore2 completely; fresh source/test search and current-head CodeRabbit re-review found no supported consumer. #558 exact-head Security/CI/SAST/fuzz are GREEN, so the valid objective here—remove exposure to vulnerable 2.5.0—is fully satisfied by the narrower dependency-removal contract without importing unused 2.10.0 behavior.

No #405 result transfers to #558 and #558 is still Draft pending central CodeQL settlement and independent review. Closing #405 is verified-successor consolidation, not a merge/acceptance claim.

@seonghobae seonghobae closed this Sep 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/main/httpx2-2.10.0 branch September 11, 2026 18:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: api API, protocol, event, or external contract area: dependencies Dependency or lockfile maintenance maintenance priority: medium Normal-priority or P2 work status: needs-review Open pull request requiring current-head review or checks type: maintenance Maintenance, build, dependency, or operational upkeep

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant