v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (#1140, #1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in #1179

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart in #1140 and #1186
• Avoid nested async generator finalization errors when streamed responses are abandoned early in #1204

httpcore2

Changed

• Require Trio 0.34.0 or later for the trio extra in #1179

Fixed

• Avoid nested async generator finalization errors when streamed responses are abandoned early in #1204

Full Changelog: v2.12.0...v2.13.0

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @Kludex in #1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @Kludex in #1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (#1137).
• Deprecated status code aliases are available again (#1135).
• Multipart part headers are validated before serialization (#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @Kludex in #1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @Kludex in #1141

Fixed

• Restore deprecated status code aliases by @Kludex in #1135
• Extract HTTP/2 release notes from changelog headings correctly by @Kludex in #1136
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications by @Kludex in #1137
• Validate multipart part header names and values before serialization by @Kludex in #1142

httpcore2

Changed

• Cache sniffio availability instead of importing it on every synchronization call by @mbeijen in #1132

Full Changelog: v2.10.0...v2.11.0

v2.10.0

Highlights

🚀 Performance and memory improvements

• Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (#1127).
• SSE parsing is up to 35x faster on highly fragmented streams (#1117).
• Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (#1119, #1114). Thanks @hoodmane!

httpx2

Added

• Add support for running on WebAssembly / Emscripten via Pyodide by @hoodmane in #1119
• Add max_event_size to cap SSE event buffering by @Kludex in #1071
• Add RFC 9110 status code constants by @mbeijen in #1069
• Add support for Python 3.15 by @hugovk in #1090

Changed

• Improve SSE chunk buffering performance by @Kludex in #1117
• Skip cookie extraction without Set-Cookie by @Kludex in #1107
• Return str | None instead of Any from Headers.get by @ItsDrike in #1121

Fixed

• Enforce WebSocket max message size across fragments by @Kludex in #1085
• Ignore unsolicited and duplicate Pong frames by @Kludex in #1122

httpcore2

Added

• Add support for Python 3.15 by @hugovk in #1090

Changed

• Avoid quadratic copying when sending large HTTP/2 request bodies by @Kludex in #1127

Fixed

• Propagate the original exception instead of raising KeyError when an HTTP/2 stream fails by @yhay81 in #1093
• Start TLS for the wss scheme in SOCKS5 proxy connections by @Kludex in #1104

🙏 New Contributors

• @ccbest made their first contribution in #1096
• @dependabot[bot] made their first contribution in #1103
• @bagowix made their first contribution in #1111
• @aldbr made their first contribution in #1108
• @dsfaccini made their first contribution in #1110
• @yhay81 made their first contribution in #1093
• @laisbsc made their first contribution in #1092
• @hoodmane made their first contribution in #1114
• @ItsDrike made their first contribution in #1121

Full Changelog: v2.9.1...v2.10.0

v2.9.1

What's Changed

• Alias httpcore imports to httpcore2 in alias_httpx() by @Kludex in #1082

Full Changelog: v2.9.0...v2.9.1

v2.9.0

What's Changed

• Add alias_httpx() to alias httpx imports to httpx2 by @Kludex in #1077

Full Changelog: v2.8.0...v2.9.0

v2.8.0

What's Changed

• Eliminate multi-assignment churn in the connection pool by @Kludex in #1075

Full Changelog: v2.7.0...v2.8.0

v2.7.0

This release syncs the vendored WebSocket support with the latest httpx-ws, which was previously pinned to an outdated snapshot.

What's Changed

• Update vendored httpx-ws to upstream v0.9.0 by @Kludex in #1067

Full Changelog: v2.6.0...v2.7.0

v2.6.0

The main feature in this release is support for WebSockets! 🎉

from httpx2 import AsyncClient

async with httpx2.AsyncClient() as client:
    async with client.websocket("ws://localhost:8000/ws") as ws:
        await ws.send_text("Hello!")
        message = await ws.receive_text()

What's Changed

• Read _expire_at only once in has_expired() by @mbeijen in #1045
• Add native WebSocket support by vendoring httpx-ws by @Kludex in #1042
• Add QUERY method support (RFC 10008) by @Diegorro98 in #1055
• fix: clean up garbage connections on cancellation in AsyncConnectionPool by @mbeijen in #983
• Bump click lower bound to >=8.4 and drop upper bound by @drusc0 in #1040

New Contributors

• @achapkowski made their first contribution in #1058
• @hrnciar made their first contribution in #1054
• @Diegorro98 made their first contribution in #1055
• @drusc0 made their first contribution in #1041

Full Changelog: v2.5.0...v2.6.0

v2.5.0

What's Changed

• Allow IPv6 CIDR notation in no_proxy by @mbeijen in #967
• Propagate timeout through SOCKS5 handshake by @mbeijen in #1009
• Add native server-sent events support via client.sse() by @Kludex in #1046
• Support | and |= operators for Headers by @Kludex in #1047
• Suppress empty SSE keepalive events and accept case-insensitive content type by @Kludex in #1048
• Inline SSE header defaults using the Headers union operator by @Kludex in #1049

Full Changelog: v2.4.0...v2.5.0