[dependabot]

Updates the requirements on httpx2 to permit the latest version.
Updates httpx2 to 2.16.0

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

Changelog

Sourced from httpx2's changelog.

2.16.0 (October 21st, 2026)

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain. (#1285)

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests. (#1284)

2.15.1 (October 19th, 2026)

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

• Drop support for Python 3.10. (#1274)

2.14.0 (October 18th, 2026)

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
• Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)

... (truncated)

Commits

• 6bfbf29 Prepare version 2.16.0 (#1286)
• a1e461e Look up only matching cookie domains when building the Cookie header (#1285)
• fc6ff89 Reuse the client cookie jar instead of copying it per request (#1284)
• 6dd59b9 Prepare version 2.15.1 (#1279)
• 7715bf0 Configure the default Linux SSL context once instead of per handshake (#1253)
• 6078596 Prepare version 2.15.0 (#1278)
• 5b26c25 Drop support for Python 3.10 (#1274)
• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• Additional commits viewable in compare view

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.72%. Comparing base (8daa8d4) to head (e3d3342).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1846      +/-   ##
==========================================
+ Coverage   79.91%   86.72%   +6.80%     
==========================================
  Files         264       33     -231     
  Lines       11650     1717    -9933     
  Branches     1684        0    -1684     
==========================================
- Hits         9310     1489    -7821     
+ Misses       2336      228    -2108     
+ Partials        4        0       -4     

Flag	Coverage Δ
ecr-viewer	?
ingestion	?
message-parser	?
orchestration	87.80% <ø> (ø)
trigger-code-reference	84.61% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.