[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
httpx2 (changelog)	==2.13.1 → ==2.16.0

---

Release Notes

pydantic/httpx2 (httpx2)

v2.16.0

Compare Source

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#​1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#​1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#​1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#​1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Compare Source

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#​1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#​1253).

httpcore2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#​1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Compare Source

Highlights

🐍 Python 3.11+ required

httpx2 and httpcore2 no longer support Python 3.10 (#​1274). There are no other changes in this release.

httpx2

Removed

• Drop support for Python 3.10 (#​1274).

httpcore2

Removed

• Drop support for Python 3.10 (#​1274).

Full Changelog: pydantic/httpx2@v2.14.0...v2.15.0

v2.14.0

Compare Source

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#​1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#​1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#​1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#​1217), and writing after a peer closes TLS without close_notify raises WriteError (#​1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#​1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#​1233).

httpx2

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#​1165).
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#​1267).

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#​1165).

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#​1267).
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#​1130).
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#​1233).
• Stop the sync WebSocket session from hanging on exit when its event queue is full (#​1123).

httpcore2

Fixed

• Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#​1262).
• Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#​1217).
• Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#​1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.