v0.40.0 — httpx2 replaces httpx

httpx's last release was 0.28.1, in December 2024. Pydantic has since picked up stewardship as httpx2 — same original author, same design, BSD-3, actively maintained — and it is the supported path forward for a library that sits in the critical path of every HTTP-transport deployment. Timely security updates are the point.

What changed

Every import httpx becomes import httpx2, and the three dependency pins (http extra, cli extra, dev group) move from httpx>=0.24 to httpx2>=2.9.1.

This is an explicit source migration rather than httpx2's alias_httpx(), which can make import httpx resolve to httpx2 process-wide. That is an import hook, and a library others embed has no business installing one in its callers' interpreters.

httpx and httpcore are now absent from the lock entirely, rather than lingering as transitive dependencies.

Compatibility

The API is unchanged, and this was verified rather than assumed. Every symbol this package touches is present on httpx2 2.9.1 — Client, AsyncClient, Response, Request, Timeout, MockTransport, TimeoutException, ConnectError, HTTPStatusError, get/post/put/delete/options, WSGITransport, ASGITransport, BasicAuth, Auth — and Client still accepts base_url, follow_redirects, and transport. The suite passes unchanged at 4042 tests.

Breaking

Minor rather than patch: http_connect(client=...) is public, and its annotation is now httpx2.Client | _SyncTestClient | None. A caller passing an httpx.Client will fail the isinstance check rather than being quietly accepted. The two clients are distinct types; no amount of duck-typing makes a connection pool from one work in the other.

If you construct your own client to pass to http_connect, switch it to httpx2.Client.

Downstream

vgi-python follows in its own release. It depends on this package's http extra, so migrating it first would have left both clients installed.