[dependabot]

Updates the requirements on httpx2 to permit the latest version.

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

Changelog

Sourced from httpx2's changelog.

2.16.0 (October 21st, 2026)

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain. (#1285)

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests. (#1284)

2.15.1 (October 19th, 2026)

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

• Drop support for Python 3.10. (#1274)

2.14.0 (October 18th, 2026)

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
• Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)

... (truncated)

Commits

• 6bfbf29 Prepare version 2.16.0 (#1286)
• a1e461e Look up only matching cookie domains when building the Cookie header (#1285)
• fc6ff89 Reuse the client cookie jar instead of copying it per request (#1284)
• See full diff in compare view

[joncinque]

@dependabot rebase