httpx2 2.2.0__tar.gz → 2.4.0__tar.gz

{httpx2-2.2.0 → httpx2-2.4.0}/.gitignore

@@ -5,6 +5,7 @@
 __pycache__/
 htmlcov/
 site/
+.wrangler/
 *.egg-info/
 venv*/
 .python-version

{httpx2-2.2.0 → httpx2-2.4.0}/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.4.0 (June 11th, 2026)
+
+### Added
+
+* Add `HTTPXDeprecationWarning`, a `UserWarning` subclass shown by default so deprecations are visible without enabling warnings. ([#1029](https://github.com/pydantic/httpx2/pull/1029))
+
+### Changed
+
+* Limit the number of chained `Content-Encoding` decoders to 5. ([#1027](https://github.com/pydantic/httpx2/pull/1027))
+* Allow version 15 of `rich` in the `cli` extra. ([#1015](https://github.com/pydantic/httpx2/pull/1015))
+
+### Fixed
+
+* Parse an empty `Digest` auth realm without crashing. ([#1023](https://github.com/pydantic/httpx2/pull/1023))
+* Decode IDNA labels in non-leading host positions. ([#1018](https://github.com/pydantic/httpx2/pull/1018))
+
+## 2.3.0 (June 1st, 2026)
+
+### Changed
+
+* Use `truststore` instead of `certifi` for default SSL verification, loading the operating system's trust store. ([#209](https://github.com/pydantic/httpx2/pull/209))
+
+### Fixed
+
+* Raise when `verify` is a string path and a client-side `cert` is also provided to `create_ssl_context`. ([#990](https://github.com/pydantic/httpx2/pull/990))
+* Allow a `default_encoding` callable to return `None`. ([#951](https://github.com/pydantic/httpx2/pull/951))
+* Make the `zstd` import optional on Python 3.14. ([#1000](https://github.com/pydantic/httpx2/pull/1000))
+* Store elapsed time on the stream wrapper to avoid reference cycles. ([#948](https://github.com/pydantic/httpx2/pull/948))
+
 ## 2.2.0 (May 16th, 2026)
 
 ### Fixed
@@ -57,7 +86,7 @@ Historical entries below are from upstream `encode/httpx`.
 
 ## 0.28.0 (28th November, 2024)
 
-Be aware that the default *JSON request bodies now use a more compact representation*. This is generally considered a prefered style, tho may require updates to test suites.
+Be aware that the default *JSON request bodies now use a more compact representation*. This is generally considered a preferred style, tho may require updates to test suites.
 
 The 0.28 release includes a limited set of deprecations...
 
@@ -192,7 +221,7 @@ Our revised [SSL documentation](docs/advanced/ssl.md) covers how to implement th
 
 ### Removed
 
-* The `rfc3986` dependancy has been removed. (#2252)
+* The `rfc3986` dependency has been removed. (#2252)
 
 ## 0.23.3 (4th January, 2023)
 

{httpx2-2.2.0 → httpx2-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: httpx2
-Version: 2.2.0
+Version: 2.4.0
 Summary: The next generation HTTP client.
 Project-URL: Changelog, https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md
 Project-URL: Homepage, https://github.com/pydantic/httpx2
@@ -8,8 +8,9 @@ Project-URL: Source, https://github.com/pydantic/httpx2
 Author-email: Tom Christie <tom@tomchristie.com>
 Maintainer-email: "Pydantic Services Inc." <engineering@pydantic.dev>
 License-Expression: BSD-3-Clause
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Web Environment
+Classifier: Framework :: AnyIO
 Classifier: Framework :: AsyncIO
 Classifier: Framework :: Trio
 Classifier: Intended Audience :: Developers
@@ -25,16 +26,17 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.10
 Requires-Dist: anyio
-Requires-Dist: certifi
-Requires-Dist: httpcore2==2.2.0
-Requires-Dist: idna
+Requires-Dist: httpcore2==2.4.0
+Requires-Dist: idna>=3.18
+Requires-Dist: truststore>=0.10
+Requires-Dist: typing-extensions>=4.5.0; python_version < '3.13'
 Provides-Extra: brotli
 Requires-Dist: brotli; (platform_python_implementation == 'CPython') and extra == 'brotli'
 Requires-Dist: brotlicffi; (platform_python_implementation != 'CPython') and extra == 'brotli'
 Provides-Extra: cli
 Requires-Dist: click==8.*; extra == 'cli'
 Requires-Dist: pygments==2.*; extra == 'cli'
-Requires-Dist: rich<15,>=10; extra == 'cli'
+Requires-Dist: rich<16,>=10; extra == 'cli'
 Provides-Extra: http2
 Requires-Dist: h2<5,>=3; extra == 'http2'
 Provides-Extra: socks
@@ -52,7 +54,7 @@ Description-Content-Type: text/markdown
 <a href="https://pypi.org/project/httpx2/"><img src="https://badge.fury.io/py/httpx2.svg" alt="Package version"></a>
 </p>
 
-HTTPX2 is a fully featured HTTP client library for Python 3. It includes **an integrated command line client**, has support for both **HTTP/1.1 and HTTP/2**, and provides both **sync and async APIs**.
+HTTPX2 is a fully featured HTTP client library for Python. It includes **an integrated command line client**, has support for both **HTTP/1.1 and HTTP/2**, and provides both **sync and async APIs**.
 
 > [!NOTE]
 > HTTPX2 is a continuation of the wonderful work started by [@lovelydinosaur](https://github.com/lovelydinosaur) and the broader HTTPX community. We're enormously grateful for everything that has gone into HTTPX over the years - it has been a foundational piece of the modern Python ecosystem, and this project would not exist without it.
@@ -139,8 +141,6 @@ Or, to include the optional HTTP/2 support, use:
 pip install httpx2[http2]
 ```
 
-HTTPX2 requires Python 3.10+.
-
 ## Documentation
 
 Project documentation is available at [https://httpx2.pydantic.dev/](https://httpx2.pydantic.dev/).
@@ -164,7 +164,7 @@ The HTTPX2 project relies on these excellent libraries:
 * `httpcore2` - The underlying transport implementation for `httpx2`.
   * `h11` - HTTP/1.1 support.
 * `anyio` - Structured concurrency primitives, used to support both `asyncio` and `trio`.
-* `certifi` - SSL certificates.
+* `truststore` - SSL verification using the operating system's trust store.
 * `idna` - Internationalized domain name support.
 
 As well as these optional installs:
@@ -174,7 +174,7 @@ As well as these optional installs:
 * `rich` - Rich terminal support. *(Optional, with `httpx2[cli]`)*
 * `click` - Command line client support. *(Optional, with `httpx2[cli]`)*
 * `brotli` or `brotlicffi` - Decoding for "brotli" compressed responses. *(Optional, with `httpx2[brotli]`)*
-* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported natively via the stdlib [`compression.zstd`](https://docs.python.org/3/library/compression.zstd.html) module.)*
+* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported via the stdlib [`compression.zstd`](https://docs.python.org/3/library/compression.zstd.html) module when it is available; the `httpx2[zstd]` extra installs nothing there, so decoding falls back to `zstandard` only on 3.13 and below.)*
 
 A huge amount of credit is due to `requests` for the API layout that
 much of this work follows, as well as to `urllib3` for plenty of design
@@ -186,13 +186,19 @@ inspiration around the lower-level networking details.
 
 ## Release Information
 
-### Fixed
+### Added
 
-* Handle multi-frame zstd streams split across chunks. ([#946](https://github.com/pydantic/httpx2/pull/946))
+* Add `HTTPXDeprecationWarning`, a `UserWarning` subclass shown by default so deprecations are visible without enabling warnings. ([#1029](https://github.com/pydantic/httpx2/pull/1029))
 
 ### Changed
 
-* Lazily import the `_main` CLI module to speed up `import httpx2`. ([#947](https://github.com/pydantic/httpx2/pull/947))
+* Limit the number of chained `Content-Encoding` decoders to 5. ([#1027](https://github.com/pydantic/httpx2/pull/1027))
+* Allow version 15 of `rich` in the `cli` extra. ([#1015](https://github.com/pydantic/httpx2/pull/1015))
+
+### Fixed
+
+* Parse an empty `Digest` auth realm without crashing. ([#1023](https://github.com/pydantic/httpx2/pull/1023))
+* Decode IDNA labels in non-leading host positions. ([#1018](https://github.com/pydantic/httpx2/pull/1018))
 
 
 ---

{httpx2-2.2.0 → httpx2-2.4.0}/README.md

@@ -7,7 +7,7 @@
 <a href="https://pypi.org/project/httpx2/"><img src="https://badge.fury.io/py/httpx2.svg" alt="Package version"></a>
 </p>
 
-HTTPX2 is a fully featured HTTP client library for Python 3. It includes **an integrated command line client**, has support for both **HTTP/1.1 and HTTP/2**, and provides both **sync and async APIs**.
+HTTPX2 is a fully featured HTTP client library for Python. It includes **an integrated command line client**, has support for both **HTTP/1.1 and HTTP/2**, and provides both **sync and async APIs**.
 
 > [!NOTE]
 > HTTPX2 is a continuation of the wonderful work started by [@lovelydinosaur](https://github.com/lovelydinosaur) and the broader HTTPX community. We're enormously grateful for everything that has gone into HTTPX over the years - it has been a foundational piece of the modern Python ecosystem, and this project would not exist without it.
@@ -94,8 +94,6 @@ Or, to include the optional HTTP/2 support, use:
 pip install httpx2[http2]
 ```
 
-HTTPX2 requires Python 3.10+.
-
 ## Documentation
 
 Project documentation is available at [https://httpx2.pydantic.dev/](https://httpx2.pydantic.dev/).
@@ -119,7 +117,7 @@ The HTTPX2 project relies on these excellent libraries:
 * `httpcore2` - The underlying transport implementation for `httpx2`.
   * `h11` - HTTP/1.1 support.
 * `anyio` - Structured concurrency primitives, used to support both `asyncio` and `trio`.
-* `certifi` - SSL certificates.
+* `truststore` - SSL verification using the operating system's trust store.
 * `idna` - Internationalized domain name support.
 
 As well as these optional installs:
@@ -129,7 +127,7 @@ As well as these optional installs:
 * `rich` - Rich terminal support. *(Optional, with `httpx2[cli]`)*
 * `click` - Command line client support. *(Optional, with `httpx2[cli]`)*
 * `brotli` or `brotlicffi` - Decoding for "brotli" compressed responses. *(Optional, with `httpx2[brotli]`)*
-* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported natively via the stdlib [`compression.zstd`](https://docs.python.org/3/library/compression.zstd.html) module.)*
+* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported via the stdlib [`compression.zstd`](https://docs.python.org/3/library/compression.zstd.html) module when it is available; the `httpx2[zstd]` extra installs nothing there, so decoding falls back to `zstandard` only on 3.13 and below.)*
 
 A huge amount of credit is due to `requests` for the API layout that
 much of this work follows, as well as to `urllib3` for plenty of design

{httpx2-2.2.0 → httpx2-2.4.0}/httpx2/_api.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import typing
+from collections.abc import Generator
 from contextlib import contextmanager
 
 from ._client import Client
@@ -54,41 +55,28 @@ def request(
     verify: ssl.SSLContext | str | bool = True,
     trust_env: bool = True,
 ) -> Response:
-    """
-    Sends an HTTP request.
-
-    **Parameters:**
-
-    * **method** - HTTP method for the new `Request` object: `GET`, `OPTIONS`,
-    `HEAD`, `POST`, `PUT`, `PATCH`, or `DELETE`.
-    * **url** - URL for the new `Request` object.
-    * **params** - *(optional)* Query parameters to include in the URL, as a
-    string, dictionary, or sequence of two-tuples.
-    * **content** - *(optional)* Binary content to include in the body of the
-    request, as bytes or a byte iterator.
-    * **data** - *(optional)* Form data to include in the body of the request,
-    as a dictionary.
-    * **files** - *(optional)* A dictionary of upload files to include in the
-    body of the request.
-    * **json** - *(optional)* A JSON serializable object to include in the body
-    of the request.
-    * **headers** - *(optional)* Dictionary of HTTP headers to include in the
-    request.
-    * **cookies** - *(optional)* Dictionary of Cookie items to include in the
-    request.
-    * **auth** - *(optional)* An authentication class to use when sending the
-    request.
-    * **proxy** - *(optional)* A proxy URL where all the traffic should be routed.
-    * **timeout** - *(optional)* The timeout configuration to use when sending
-    the request.
-    * **follow_redirects** - *(optional)* Enables or disables HTTP redirects.
-    * **verify** - *(optional)* Either `True` to use an SSL context with the
-    default CA bundle, `False` to disable verification, or an instance of
-    `ssl.SSLContext` to use a custom context.
-    * **trust_env** - *(optional)* Enables or disables usage of environment
-    variables for configuration.
-
-    **Returns:** `Response`
+    """Sends an HTTP request.
+
+    Parameters:
+        method: HTTP method for the new `Request` object: `GET`, `OPTIONS`, `HEAD`, `POST`, `PUT`, `PATCH`, or `DELETE`.
+        url: URL for the new `Request` object.
+        params: *(optional)* Query parameters to include in the URL, as a string, dictionary, or sequence of two-tuples.
+        content: *(optional)* Binary content to include in the body of the request, as bytes or a byte iterator.
+        data: *(optional)* Form data to include in the body of the request, as a dictionary.
+        files: *(optional)* A dictionary of upload files to include in the body of the request.
+        json: *(optional)* A JSON serializable object to include in the body of the request.
+        headers: *(optional)* Dictionary of HTTP headers to include in the request.
+        cookies: *(optional)* Dictionary of Cookie items to include in the request.
+        auth: *(optional)* An authentication class to use when sending the request.
+        proxy: *(optional)* A proxy URL where all the traffic should be routed.
+        timeout: *(optional)* The timeout configuration to use when sending the request.
+        follow_redirects: *(optional)* Enables or disables HTTP redirects.
+        verify: *(optional)* Either `True` to use an SSL context with the default CA bundle, `False` to disable
+            verification, or an instance of `ssl.SSLContext` to use a custom context.
+        trust_env: *(optional)* Enables or disables usage of environment variables for configuration.
+
+    Returns:
+        The `Response` object.
 
     Usage:
 
@@ -138,7 +126,7 @@ def stream(
     follow_redirects: bool = False,
     verify: ssl.SSLContext | str | bool = True,
     trust_env: bool = True,
-) -> typing.Iterator[Response]:
+) -> Generator[Response]:
     """
     Alternative to `httpx2.request()` that streams the response body
     instead of loading it into memory at once.

{httpx2-2.2.0 → httpx2-2.4.0}/httpx2/_auth.py

@@ -10,9 +10,9 @@ from urllib.request import parse_http_list
 
 from ._exceptions import ProtocolError
 from ._models import Cookies, Request, Response
-from ._utils import to_bytes, to_str, unquote
+from ._utils import to_bytes, to_str
 
-if typing.TYPE_CHECKING:  # pragma: no cover
+if typing.TYPE_CHECKING:
     from hashlib import _Hash
 
 
@@ -225,7 +225,7 @@ class DigestAuth(Auth):
         header_dict: dict[str, str] = {}
         for field in parse_http_list(fields):
             key, value = field.strip().split("=", 1)
-            header_dict[key] = unquote(value)
+            header_dict[key] = value.strip('"')
 
         try:
             realm = header_dict["realm"].encode()

{httpx2-2.2.0 → httpx2-2.4.0}/httpx2/_client.py

@@ -6,6 +6,7 @@ import logging
 import time
 import typing
 import warnings
+from collections.abc import AsyncGenerator, Generator
 from contextlib import asynccontextmanager, contextmanager
 from types import TracebackType
 
@@ -132,43 +133,42 @@ class ClientState(enum.Enum):
 
 class BoundSyncStream(SyncByteStream):
     """
-    A byte stream that is bound to a given response instance, and that
-    ensures the `response.elapsed` is set once the response is closed.
+    A byte stream that tracks elapsed time for a response. Once closed, the
+    elapsed time is available via the `elapsed` attribute, and the response
+    can read it back from `response.stream.elapsed`.
     """
 
-    def __init__(self, stream: SyncByteStream, response: Response, start: float) -> None:
+    def __init__(self, stream: SyncByteStream, start: float) -> None:
         self._stream = stream
-        self._response = response
         self._start = start
+        self.elapsed: datetime.timedelta | None = None
 
     def __iter__(self) -> typing.Iterator[bytes]:
-        for chunk in self._stream:
-            yield chunk
+        yield from self._stream
 
     def close(self) -> None:
-        elapsed = time.perf_counter() - self._start
-        self._response.elapsed = datetime.timedelta(seconds=elapsed)
+        self.elapsed = datetime.timedelta(seconds=time.perf_counter() - self._start)
         self._stream.close()
 
 
 class BoundAsyncStream(AsyncByteStream):
     """
-    An async byte stream that is bound to a given response instance, and that
-    ensures the `response.elapsed` is set once the response is closed.
+    An async byte stream that tracks elapsed time for a response. Once closed,
+    the elapsed time is available via the `elapsed` attribute, and the response
+    can read it back from `response.stream.elapsed`.
     """
 
-    def __init__(self, stream: AsyncByteStream, response: Response, start: float) -> None:
+    def __init__(self, stream: AsyncByteStream, start: float) -> None:
         self._stream = stream
-        self._response = response
         self._start = start
+        self.elapsed: datetime.timedelta | None = None
 
     async def __aiter__(self) -> typing.AsyncIterator[bytes]:
         async for chunk in self._stream:
             yield chunk
 
     async def aclose(self) -> None:
-        elapsed = time.perf_counter() - self._start
-        self._response.elapsed = datetime.timedelta(seconds=elapsed)
+        self.elapsed = datetime.timedelta(seconds=time.perf_counter() - self._start)
         await self._stream.aclose()
 
 
@@ -189,7 +189,7 @@ class BaseClient:
         event_hooks: None | (typing.Mapping[str, list[EventHook]]) = None,
         base_url: URL | str = "",
         trust_env: bool = True,
-        default_encoding: str | typing.Callable[[bytes], str] = "utf-8",
+        default_encoding: str | typing.Callable[[bytes], str | None] = "utf-8",
     ) -> None:
         event_hooks = {} if event_hooks is None else event_hooks
 
@@ -628,7 +628,7 @@ class Client(BaseClient):
         event_hooks: None | (typing.Mapping[str, list[EventHook]]) = None,
         base_url: URL | str = "",
         transport: BaseTransport | None = None,
-        default_encoding: str | typing.Callable[[bytes], str] = "utf-8",
+        default_encoding: str | typing.Callable[[bytes], str | None] = "utf-8",
     ) -> None:
         super().__init__(
             auth=auth,
@@ -810,7 +810,7 @@ class Client(BaseClient):
         follow_redirects: bool | UseClientDefault = USE_CLIENT_DEFAULT,
         timeout: TimeoutTypes | UseClientDefault = USE_CLIENT_DEFAULT,
         extensions: RequestExtensions | None = None,
-    ) -> typing.Iterator[Response]:
+    ) -> Generator[Response]:
         """
         Alternative to `httpx2.request()` that streams the response body
         instead of loading it into memory at once.
@@ -977,7 +977,7 @@ class Client(BaseClient):
         assert isinstance(response.stream, SyncByteStream)
 
         response.request = request
-        response.stream = BoundSyncStream(response.stream, response=response, start=start)
+        response.stream = BoundSyncStream(response.stream, start=start)
         self.cookies.extract_cookies(response)
         response.default_encoding = self._default_encoding
 
@@ -1330,7 +1330,7 @@ class AsyncClient(BaseClient):
         base_url: URL | str = "",
         transport: AsyncBaseTransport | None = None,
         trust_env: bool = True,
-        default_encoding: str | typing.Callable[[bytes], str] = "utf-8",
+        default_encoding: str | typing.Callable[[bytes], str | None] = "utf-8",
     ) -> None:
         super().__init__(
             auth=auth,
@@ -1513,7 +1513,7 @@ class AsyncClient(BaseClient):
         follow_redirects: bool | UseClientDefault = USE_CLIENT_DEFAULT,
         timeout: TimeoutTypes | UseClientDefault = USE_CLIENT_DEFAULT,
         extensions: RequestExtensions | None = None,
-    ) -> typing.AsyncIterator[Response]:
+    ) -> AsyncGenerator[Response]:
         """
         Alternative to `httpx2.request()` that streams the response body
         instead of loading it into memory at once.
@@ -1680,7 +1680,7 @@ class AsyncClient(BaseClient):
 
         assert isinstance(response.stream, AsyncByteStream)
         response.request = request
-        response.stream = BoundAsyncStream(response.stream, response=response, start=start)
+        response.stream = BoundAsyncStream(response.stream, start=start)
         self.cookies.extract_cookies(response)
         response.default_encoding = self._default_encoding
 

{httpx2-2.2.0 → httpx2-2.4.0}/httpx2/_config.py

@@ -28,34 +28,40 @@ def create_ssl_context(
     import ssl
     import warnings
 
-    import certifi
+    import truststore
 
     if verify is True:
-        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: nocover
+        if trust_env and os.environ.get("SSL_CERT_FILE"):  # pragma: no cover
             ctx = ssl.create_default_context(cafile=os.environ["SSL_CERT_FILE"])
-        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: nocover
+        elif trust_env and os.environ.get("SSL_CERT_DIR"):  # pragma: no cover
             ctx = ssl.create_default_context(capath=os.environ["SSL_CERT_DIR"])
         else:
-            # Default case...
-            ctx = ssl.create_default_context(cafile=certifi.where())
+            # Default case: rely on the system trust store via `truststore`.
+            ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     elif verify is False:
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         ctx.check_hostname = False
         ctx.verify_mode = ssl.CERT_NONE
-    elif isinstance(verify, str):  # pragma: nocover
+    elif isinstance(verify, str):
+        if cert:
+            raise TypeError(
+                "`verify=<str>` cannot be combined with `cert=...`. "
+                "Build an `ssl.SSLContext` and pass it as `verify=<ctx>`, "
+                "using `.load_cert_chain()` to configure the certificate chain."
+            )
         message = (
             "`verify=<str>` is deprecated. "
             "Use `verify=ssl.create_default_context(cafile=...)` "
             "or `verify=ssl.create_default_context(capath=...)` instead."
         )
         warnings.warn(message, DeprecationWarning)
-        if os.path.isdir(verify):
+        if os.path.isdir(verify):  # pragma: no cover
             return ssl.create_default_context(capath=verify)
         return ssl.create_default_context(cafile=verify)
     else:
         ctx = verify
 
-    if cert:  # pragma: nocover
+    if cert:  # pragma: no cover
         message = (
             "`cert=...` is deprecated. Use `verify=<ssl_context>` instead,"
             "with `.load_cert_chain()` to configure the certificate chain."
@@ -83,6 +89,11 @@ class Timeout:
                                 # 5s timeout elsewhere.
     """
 
+    connect: float | None
+    read: float | None
+    write: float | None
+    pool: float | None
+
     def __init__(
         self,
         timeout: TimeoutTypes | UnsetType = UNSET,
@@ -98,10 +109,10 @@ class Timeout:
             assert read is UNSET
             assert write is UNSET
             assert pool is UNSET
-            self.connect = timeout.connect  # type: typing.Optional[float]
-            self.read = timeout.read  # type: typing.Optional[float]
-            self.write = timeout.write  # type: typing.Optional[float]
-            self.pool = timeout.pool  # type: typing.Optional[float]
+            self.connect = timeout.connect
+            self.read = timeout.read
+            self.write = timeout.write
+            self.pool = timeout.pool
         elif isinstance(timeout, tuple):
             # Passed as a tuple.
             self.connect = timeout[0]

{httpx2-2.2.0 → httpx2-2.4.0}/httpx2/_content.py

@@ -2,14 +2,10 @@ from __future__ import annotations
 
 import inspect
 import warnings
+from collections.abc import AsyncIterable, AsyncIterator, Iterable, Iterator, Mapping
 from json import dumps as json_dumps
 from typing import (
     Any,
-    AsyncIterable,
-    AsyncIterator,
-    Iterable,
-    Iterator,
-    Mapping,
 )
 from urllib.parse import urlencode
 
@@ -60,8 +56,7 @@ class IteratorByteStream(SyncByteStream):
                 chunk = self._stream.read(self.CHUNK_SIZE)
         else:
             # Otherwise iterate.
-            for part in self._stream:
-                yield part
+            yield from self._stream
 
 
 class AsyncIteratorByteStream(AsyncByteStream):
@@ -133,10 +128,8 @@ def encode_content(
     raise TypeError(f"Unexpected type for 'content', {type(content)!r}")
 
 
-def encode_urlencoded_data(
-    data: RequestData,
-) -> tuple[dict[str, str], ByteStream]:
-    plain_data = []
+def encode_urlencoded_data(data: RequestData) -> tuple[dict[str, str], ByteStream]:
+    plain_data: list[tuple[str, str]] = []
     for key, value in data.items():
         if isinstance(value, (list, tuple)):
             plain_data.extend([(key, primitive_value_to_str(item)) for item in value])

{httpx2-2.2.0 → httpx2-2.4.0}/httpx2/_decoders.py

@@ -29,9 +29,9 @@ except ImportError:  # pragma: no cover
 
 
 # Zstandard support is optional on Python <= 3.13.
-# On Python 3.14, the stdlib includes a built-in zstd implementation, so we can support
-# it without an extra dependency.
+# On Python 3.14+, the stdlib includes an optional built-in zstd implementation.
 if typing.TYPE_CHECKING:
+    # We keep checking Python version in the type checker path because try..except doesn't help type checkers.
     if sys.version_info >= (3, 14):
         from compression.zstd import ZstdDecompressor, ZstdError
     else:
@@ -39,20 +39,22 @@ if typing.TYPE_CHECKING:
 
         ZstdDecompressor = functools.partial(_ZstdDecompressor().decompressobj)
 
-    _zstandard_installed: bool = True
+    _zstandard_installed: bool = False
 else:  # pragma: no cover
-    if sys.version_info >= (3, 14):
+    _zstandard_installed = False
+    try:
         from compression.zstd import ZstdDecompressor, ZstdError
 
         _zstandard_installed = True
-    else:
+    # Either Python <3.14 or the distro doesn't have `compression.zstd`.
+    except ImportError:
         try:
             from zstandard import ZstdDecompressor as _ZstdDecompressor, ZstdError
 
             ZstdDecompressor = functools.partial(_ZstdDecompressor().decompressobj)
             _zstandard_installed = True
         except ImportError:
-            _zstandard_installed = False
+            pass
 
 
 class ContentDecoder:
@@ -181,11 +183,10 @@ class BrotliDecoder(ContentDecoder):
 
 
 class ZStandardDecoder(ContentDecoder):
-    """
-    Handle 'zstd' RFC 8878 decoding.
+    """Handle 'zstd' RFC 8878 decoding.
 
-    Requires `pip install zstandard`.
-    Can be installed as a dependency of httpx using `pip install httpx[zstd]`.
+    If running on Python 3.14+ or a distro that doesn't have the `compression.zstd` stdlib module, requires either:
+    `pip install zstandard` or `pip install httpx2[zstd]`.
     """
 
     # inspired by the ZstdDecoder implementation in urllib3
@@ -229,13 +230,18 @@ class MultiDecoder(ContentDecoder):
     Handle the case where multiple encodings have been applied.
     """
 
-    def __init__(self, children: typing.Sequence[ContentDecoder]) -> None:
+    max_decode_links: typing.ClassVar[int] = 5
+
+    def __init__(self, encodings: typing.Sequence[str]) -> None:
         """
-        'children' should be a sequence of decoders in the order in which
+        'encodings' should be the content codings in the order in which
         each was applied.
         """
+        codings = [encoding for encoding in encodings if encoding in SUPPORTED_DECODERS]
+        if len(codings) > self.max_decode_links:
+            raise DecodingError(f"Cannot apply more than {self.max_decode_links} content encodings.")
         # Note that we reverse the order for decoding.
-        self.children = list(reversed(children))
+        self.children: list[ContentDecoder] = [SUPPORTED_DECODERS[coding]() for coding in reversed(codings)]
 
     def decode(self, data: bytes) -> bytes:
         for child in self.children:
@@ -396,7 +402,7 @@ class LineDecoder:
         return lines
 
 
-SUPPORTED_DECODERS = {
+SUPPORTED_DECODERS: dict[str, type[ContentDecoder]] = {
     "identity": IdentityDecoder,
     "gzip": GZipDecoder,
     "deflate": DeflateDecoder,