dependabot[bot] opened a new pull request, #230: URL: https://github.com/apache/doris-mcp-server/pull/230
Bumps [httpx2](https://github.com/pydantic/httpx2) from 2.6.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/httpx2/releases";>httpx2's releases</a>.</em></p> <blockquote> <h2>v2.12.0</h2> <h2>Highlights</h2> <h3>🛡️ Bounded response decompression</h3> <p><code>httpx2</code> now decodes <code>gzip</code>, <code>deflate</code>, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (<a href="https://redirect.github.com/pydantic/httpx2/pull/1126";>pydantic/httpx2#1126</a>).</p> <h3>📦 Shared Zstandard API</h3> <p>Python 3.13 and earlier now use <code>backports.zstd</code>, which provides the same bounded incremental decompression API as <code>compression.zstd</code> on Python 3.14 and later (<a href="https://redirect.github.com/pydantic/httpx2/pull/1146";>pydantic/httpx2#1146</a>).</p> <h2>httpx2</h2> <h3>Changed</h3> <ul> <li>Use <code>backports.zstd</code> for Zstandard decoding on Python 3.13 and earlier by <a href="https://github.com/Kludex";><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1146";>pydantic/httpx2#1146</a></li> </ul> <h3>Fixed</h3> <ul> <li>Bound peak memory while streaming compressed responses and close response streams when decoding fails by <a href="https://github.com/Kludex";><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1126";>pydantic/httpx2#1126</a></li> </ul> <h2>httpcore2</h2> <p>No changes since <code>2.11.0</code>. Version bumped to stay in lockstep with <code>httpx2</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0";>https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0</a></p> <h2>v2.11.0</h2> <h2>Highlights</h2> <h3>🌐 Public origin API</h3> <p><code>httpx2</code> now includes an immutable and hashable <code>Origin</code> value object, available through <code>URL.origin</code>. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (<a href="https://redirect.github.com/pydantic/httpx2/pull/1134";>pydantic/httpx2#1134</a>).</p> <h3>🛠️ Request compatibility and validation</h3> <ul> <li>Explicit <code>Transfer-Encoding</code> headers now take precedence over body-derived <code>Content-Length</code> headers (<a href="https://redirect.github.com/pydantic/httpx2/pull/1137";>pydantic/httpx2#1137</a>).</li> <li>Deprecated status code aliases are available again (<a href="https://redirect.github.com/pydantic/httpx2/pull/1135";>pydantic/httpx2#1135</a>).</li> <li>Multipart part headers are validated before serialization (<a href="https://redirect.github.com/pydantic/httpx2/pull/1142";>pydantic/httpx2#1142</a>).</li> </ul> <h2>httpx2</h2> <h3>Added</h3> <ul> <li>Add the public <code>Origin</code> value object and <code>URL.origin</code> property by <a href="https://github.com/Kludex";><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1134";>pydantic/httpx2#1134</a></li> </ul> <h3>Changed</h3> <ul> <li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra by <a href="https://github.com/Kludex";><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1141";>pydantic/httpx2#1141</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md";>httpx2's changelog</a>.</em></p> <blockquote> <h2>2.12.0 (August 18th, 2026)</h2> <h3>Changed</h3> <ul> <li>Use <code>backports.zstd</code> for Zstandard decoding on Python 3.13 and earlier. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1146";>#1146</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Bound peak memory while streaming compressed responses and close response streams when decoding fails. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1126";>#1126</a>)</li> </ul> <h2>2.11.0 (August 18th, 2026)</h2> <h3>Added</h3> <ul> <li>Add the public <code>Origin</code> value object and <code>URL.origin</code> property for normalized, hashable origin comparisons. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1134";>#1134</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1141";>#1141</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Restore deprecated status code aliases. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1135";>#1135</a>)</li> <li>Extract HTTP/2 release notes from changelog headings correctly. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1136";>#1136</a>)</li> <li>Respect explicit <code>Transfer-Encoding</code> headers and expose buffered request body lengths to WSGI applications. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1137";>#1137</a>)</li> <li>Validate multipart part header names and values before serialization. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1142";>#1142</a>)</li> </ul> <h2>2.10.0 (August 9th, 2026)</h2> <h3>Added</h3> <ul> <li>Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript <code>fetch</code>-based transport defined in <code>httpx2-jsfetch</code>. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1119";>#1119</a>)</li> <li>Add <code>max_event_size</code> to cap SSE event buffering. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1071";>#1071</a>)</li> <li>Add RFC 9110 status code constants. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1069";>#1069</a>)</li> <li>Add support for Python 3.15. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1090";>#1090</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Improve SSE chunk buffering performance. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1117";>#1117</a>)</li> <li>Skip cookie extraction for responses without <code>Set-Cookie</code> headers. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1107";>#1107</a>)</li> <li>Return <code>str | None</code> instead of <code>Any</code> from <code>Headers.get</code>. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1121";>#1121</a>)</li> </ul> <h3>Fixed</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/httpx2/commit/71ae23be5448f859c2b4e21d9972ddfa7b8d759d";><code>71ae23b</code></a> Version 2.12.0 (<a href="https://redirect.github.com/pydantic/httpx2/issues/1147";>#1147</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8";><code>4fd0c70</code></a> Decode compressed response bodies incrementally (<a href="https://redirect.github.com/pydantic/httpx2/issues/1126";>#1126</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/d588e528a11eb20323031ee571fadc668bb81b3f";><code>d588e52</code></a> Use <code>backports.zstd</code> on Python 3.13 and earlier (<a href="https://redirect.github.com/pydantic/httpx2/issues/1146";>#1146</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/344589da2a992f7e5a0c25c68cc78c25ec6d70bd";><code>344589d</code></a> Version 2.11.0 (<a href="https://redirect.github.com/pydantic/httpx2/issues/1143";>#1143</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/de96d810ee4e309d118982fe7084a46a2bcd600d";><code>de96d81</code></a> Validate multipart part headers (<a href="https://redirect.github.com/pydantic/httpx2/issues/1142";>#1142</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/51c32698ce029140cb69a26921d017e3edda80fa";><code>51c3269</code></a> Require brotli 1.2.0 in the brotli extra (<a href="https://redirect.github.com/pydantic/httpx2/issues/1141";>#1141</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab";><code>829b93a</code></a> Respect explicit Transfer-Encoding headers (<a href="https://redirect.github.com/pydantic/httpx2/issues/1137";>#1137</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/4fa6c8ee96fb79035c6820e4f44a10b6262d9c9f";><code>4fa6c8e</code></a> Fix changelog extraction regex for H2 release headings (<a href="https://redirect.github.com/pydantic/httpx2/issues/1136";>#1136</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/8a6f37063514ee2a2601607c20be72667fdfa3be";><code>8a6f370</code></a> Restore deprecated status code aliases (<a href="https://redirect.github.com/pydantic/httpx2/issues/1135";>#1135</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/d03f1ec6a1a323f951a8c21cd14f9c02f2d1e855";><code>d03f1ec</code></a> Add public Origin API (<a href="https://redirect.github.com/pydantic/httpx2/issues/1134";>#1134</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/httpx2/compare/v2.6.0...v2.12.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/doris-mcp-server/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
