From ff4529380d7e38c683e05887c1d89baf0d76cc75 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 06:32:13 +0000
Subject: [PATCH] chore(deps): bump httpx2 from 2.10.0 to 2.12.0 in /libs/cli
 (#8863)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [httpx2](https://github.com/pydantic/httpx2) from 2.10.0 to
2.12.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/releases">httpx2's
releases</a>.</em></p>
<blockquote>
<h2>v2.12.0</h2>
<h2>Highlights</h2>
<h3>🛡️ Bounded response decompression</h3>
<p><code>httpx2</code> now decodes <code>gzip</code>,
<code>deflate</code>, Brotli, and Zstandard responses incrementally.
Each decode step emits at most 1 MiB, so streaming a highly compressed
response no longer requires materializing an entire inflated network
chunk in memory (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1126">pydantic/httpx2#1126</a>).</p>
<h3>📦 Shared Zstandard API</h3>
<p>Python 3.13 and earlier now use <code>backports.zstd</code>, which
provides the same bounded incremental decompression API as
<code>compression.zstd</code> on Python 3.14 and later (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1146">pydantic/httpx2#1146</a>).</p>
<h2>httpx2</h2>
<h3>Changed</h3>
<ul>
<li>Use <code>backports.zstd</code> for Zstandard decoding on Python
3.13 and earlier by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1146">pydantic/httpx2#1146</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Bound peak memory while streaming compressed responses and close
response streams when decoding fails by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1126">pydantic/httpx2#1126</a></li>
</ul>
<h2>httpcore2</h2>
<p>No changes since <code>2.11.0</code>. Version bumped to stay in
lockstep with <code>httpx2</code>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0">https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0</a></p>
<h2>v2.11.0</h2>
<h2>Highlights</h2>
<h3>🌐 Public origin API</h3>
<p><code>httpx2</code> now includes an immutable and hashable
<code>Origin</code> value object, available through
<code>URL.origin</code>. It provides normalized scheme, host, and
effective port comparisons without including URL paths, queries,
fragments, or credentials (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1134">pydantic/httpx2#1134</a>).</p>
<h3>🛠️ Request compatibility and validation</h3>
<ul>
<li>Explicit <code>Transfer-Encoding</code> headers now take precedence
over body-derived <code>Content-Length</code> headers (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1137">pydantic/httpx2#1137</a>).</li>
<li>Deprecated status code aliases are available again (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1135">pydantic/httpx2#1135</a>).</li>
<li>Multipart part headers are validated before serialization (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1142">pydantic/httpx2#1142</a>).</li>
</ul>
<h2>httpx2</h2>
<h3>Added</h3>
<ul>
<li>Add the public <code>Origin</code> value object and
<code>URL.origin</code> property by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1134">pydantic/httpx2#1134</a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra by
<a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1141">pydantic/httpx2#1141</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md">httpx2's
changelog</a>.</em></p>
<blockquote>
<h2>2.12.0 (August 18th, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Use <code>backports.zstd</code> for Zstandard decoding on Python
3.13 and earlier.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1146">#1146</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Bound peak memory while streaming compressed responses and close
response streams when decoding fails.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1126">#1126</a>)</li>
</ul>
<h2>2.11.0 (August 18th, 2026)</h2>
<h3>Added</h3>
<ul>
<li>Add the public <code>Origin</code> value object and
<code>URL.origin</code> property for normalized,
hashable origin comparisons. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1134">#1134</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1141">#1141</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Restore deprecated status code aliases. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1135">#1135</a>)</li>
<li>Extract HTTP/2 release notes from changelog headings correctly. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1136">#1136</a>)</li>
<li>Respect explicit <code>Transfer-Encoding</code> headers and expose
buffered request body lengths to WSGI applications.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1137">#1137</a>)</li>
<li>Validate multipart part header names and values before
serialization.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1142">#1142</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/httpx2/commit/71ae23be5448f859c2b4e21d9972ddfa7b8d759d"><code>71ae23b</code></a>
Version 2.12.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1147">#1147</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8"><code>4fd0c70</code></a>
Decode compressed response bodies incrementally (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1126">#1126</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/d588e528a11eb20323031ee571fadc668bb81b3f"><code>d588e52</code></a>
Use <code>backports.zstd</code> on Python 3.13 and earlier (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1146">#1146</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/344589da2a992f7e5a0c25c68cc78c25ec6d70bd"><code>344589d</code></a>
Version 2.11.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1143">#1143</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/de96d810ee4e309d118982fe7084a46a2bcd600d"><code>de96d81</code></a>
Validate multipart part headers (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1142">#1142</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/51c32698ce029140cb69a26921d017e3edda80fa"><code>51c3269</code></a>
Require brotli 1.2.0 in the brotli extra (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1141">#1141</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab"><code>829b93a</code></a>
Respect explicit Transfer-Encoding headers (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1137">#1137</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/4fa6c8ee96fb79035c6820e4f44a10b6262d9c9f"><code>4fa6c8e</code></a>
Fix changelog extraction regex for H2 release headings (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1136">#1136</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/8a6f37063514ee2a2601607c20be72667fdfa3be"><code>8a6f370</code></a>
Restore deprecated status code aliases (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1135">#1135</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/d03f1ec6a1a323f951a8c21cd14f9c02f2d1e855"><code>d03f1ec</code></a>
Add public Origin API (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1134">#1134</a>)</li>
<li>See full diff in <a
href="https://github.com/pydantic/httpx2/compare/v2.10.0...v2.12.0">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
---
 libs/cli/uv.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/libs/cli/uv.lock b/libs/cli/uv.lock
index ebed26f4f..64c03484c 100644
--- a/libs/cli/uv.lock
+++ b/libs/cli/uv.lock
@@ -737,15 +737,15 @@ wheels = [
 
 [[package]]
 name = "httpcore2"
-version = "2.10.0"
+version = "2.12.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "h11" },
     { name = "truststore" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a9/83/a896fc59940fc5a6e2aff3a4be1d92fa890112936803b331cae75a993c34/httpcore2-2.10.0.tar.gz", hash = "sha256:13c0cc3d1919d4f28457f60cd2c2abe04113a8af184ccf1142811beba936f9dc", size = 67427, upload-time = "2026-08-09T09:11:32.123Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/be/ad/f4f0e57345f1870f3e8cb624e058d7eca6e5a27d33bcc3311d9b618734cd/httpcore2-2.12.0.tar.gz", hash = "sha256:9293522bba0aa7c4c8e9e3f040c16575bd8868e155a77fa30c7a9085a5eae648", size = 67548, upload-time = "2026-08-18T13:22:08.211Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/4f/d149104195a35e2853a2fc203a8e3477747e58c80e17dda686dace174383/httpcore2-2.10.0-py3-none-any.whl", hash = "sha256:7df06cfb34070cae4f7c89be69dc1095eca138e9704ceffb98d25c1912ab6f01", size = 83000, upload-time = "2026-08-09T09:11:29.555Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/74/d370e55600d9bcfa0d9794b0166126d49291a3d2b20c268fc98c453a4948/httpcore2-2.12.0-py3-none-any.whl", hash = "sha256:7e04258ce01013d7d615e5b910a3b27fac937d7a95038227e79652b4ba3b4ceb", size = 83074, upload-time = "2026-08-18T13:22:05.854Z" },
 ]
 
 [[package]]
@@ -803,7 +803,7 @@ wheels = [
 
 [[package]]
 name = "httpx2"
-version = "2.10.0"
+version = "2.12.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio", marker = "sys_platform != 'emscripten'" },
@@ -813,9 +813,9 @@ dependencies = [
     { name = "truststore", marker = "sys_platform != 'emscripten'" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/bd/3d/f9a8c07a3884f3e5b26205e8436a18b3af61c5d53192c3bea235574dbbec/httpx2-2.10.0.tar.gz", hash = "sha256:8741d7329fe2c7885fc9ceb61c8217acfb87a85f75723714b89ebf7ad7196338", size = 98749, upload-time = "2026-08-09T09:11:33.24Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7f/f8/579a8b51e42e38ee32647df9f08aa25643ae788e275cc625b199829c4671/httpx2-2.12.0.tar.gz", hash = "sha256:7631fe9887a8a2275f4a2540e053aa670fcc50742864a9ae7c66e609fdcf12cf", size = 100040, upload-time = "2026-08-18T13:22:09.086Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/b9/6d/a637d52449d98a6892d9a4dc0262587afdb6a66f201871842dce5a97b1c1/httpx2-2.10.0-py3-none-any.whl", hash = "sha256:5e3194a432701e1cc6f69a8b1b2fa199ef907013fede8d9a09a2c5b7b8141a18", size = 94355, upload-time = "2026-08-09T09:11:30.882Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/95/411ba65569158e862368917aaf56597f3e5fa3b91b0502919638465a08f3/httpx2-2.12.0-py3-none-any.whl", hash = "sha256:cc8b6eecb8661c146b8f89a60e97456ee086e91a784ed31ac450c3a9e613dd36", size = 95427, upload-time = "2026-08-18T13:22:06.834Z" },
 ]
 
 [[package]]