[HTTPXodus] migrate httpx to httpx2 with dual import

[ProgrammerPlus1998]

Closes #806

🏷️ Part of HTTPXodus — a community effort to help major Python projects plan their path off the stalled httpx stable line onto httpx2, the actively maintained fork by Pydantic Services. One coordinated PR per project — no drive-by changes.

What this PR does

This is the implementation of the migration discussed in #806. It switches cohere-ai/cohere-python's HTTP client from httpx to httpx2 via dual import: on Python ≥ 3.10 the runtime binds to httpx2; on 3.9 the import falls back to httpx. requires-python is not changed.

Diff summary

N files, +A / −B (commit e8b9a123):

File	Change
pyproject.toml	Added httpx2>=2.12.0; python_version >= "3.10" next to the existing httpx runtime dep
cohere/**	All import httpx → dual import (Option A)

The public API surface is preserved because the dual-import alias keeps the name httpx everywhere. No call-site changes are needed beyond the import.

Test results

Validated in a fresh venv on Python 3.12 with both httpx and httpx2 installed (SUT resolves to httpx2):

• pip install -e ".[dev]" resolves to both
• python -c "import cohere; ..." smoke test passes
• Full pytest requires live API credentials; not run in this dev env

Notes for reviewer

• The httpx.Client / httpx.AsyncClient / httpx.Response.raise_for_status() types used in cohere-python exist in both httpx and httpx2 with identical signatures, so no call-site changes are needed beyond the import.
• ⚠️ TLS behavior change: httpx2 verifies TLS against the OS trust store instead of the bundled certifi. Cohere SDK deployments that rely on a custom CA bundle may need SSL_CERT_FILE / SSL_CERT_DIR after the switch. Worth a line in the changelog.
• Dual import is the right call here: cohere-python's requires-python floor is below httpx2's >=3.10 floor, and dropping 3.9 would be out of scope. If cohere-python later raises the floor, this can be replaced with a hard import httpx2 as httpx in a follow-up.

Happy to revise per review — and equally happy to close this PR if the maintainers would rather wait for httpx 1.0 stable. 🙏

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit e8b9a12. Configure here.}

[cursor]

Production never switches to httpx2

High Severity

httpx2 is added as a required dependency, but production still imports httpx and builds httpx.Client in the core client, AWS/OCI transports, and SSE helpers. The dual-import lives only in a unit test, so the SDK never runs on httpx2 and every installer now pulls an unused package.

 

^{Reviewed by Cursor Bugbot for commit e8b9a12. Configure here.}

[cursor]

Lockfile omits new httpx2 dependency

Medium Severity

httpx2 was added to pyproject.toml without updating poetry.lock. poetry install follows the stale lock and will not install httpx2, so CI keeps using the httpx fallback. Poetry 2.x, which generated this lockfile, also errors when the content-hash no longer matches.

 

^{Reviewed by Cursor Bugbot for commit e8b9a12. Configure here.}