PyPI · #130 most downloaded on PyPI

httpcore2

2.13.1222M downloads/mopydantic/httpx2 ↗New releases in your daily digest, changelog included.

A minimal low-level HTTP client.

Last release 11 days ago
23 Sep 2026
Ships fairly regularly
a new release about every 2 weeks
Nearly every release is documented
notes for 16 of 17 stable releases
Nothing withdrawn
no release was ever pulled
4 months old
18 releases · first in 2026

Release timeline

18 releases since 2026

2026

20262026

One column per month.

Releases

2.13.123 Sept 20263 sources agree
Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position ( #1214 ).
Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

🔐 Reliable proxy TLS and HTTP/2 negotiation

TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).

🧹 Clean WebSocket shutdown

The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).

httpx2

Fixed

Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).

Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2

Fixed

Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).

Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: v2.13.0...v2.13.1

From the same repository

pydantic/httpx2

httpx2PyPIThe next generation HTTP client.

2.13.014 Sept 2026

🔐 Reliable TLS verification controls

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (#1140, #1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (#1204).

httpx2

Changed

Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in #1179

Fixed

Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart in #1140 and #1186
Avoid nested async generator finalization errors when streamed responses are abandoned early in #1204

httpcore2

Changed

Require Trio 0.34.0 or later for the trio extra in #1179

Fixed

Avoid nested async generator finalization errors when streamed responses are abandoned early in #1204

Full Changelog: v2.12.0...v2.13.0

Open source →

Additional notes2 sources agree

Changed

Require Trio 0.34.0 or later for the trio extra. (#1179)

Fixed

Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)

Open source →

2.12.018 Aug 20263 sources agree

🛡️ Bounded response decompression

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (#1146).

httpx2

Changed

Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @Kludex in #1146

Fixed

Bound peak memory while streaming compressed responses and close response streams when decoding fails by @Kludex in #1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: v2.11.0...v2.12.0

Open source →

2.11.018 Aug 2026Deprecated3 sources agree

Deprecated status code aliases are available again ( #1135 ).

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (#1134).

🛠️ Request compatibility and validation

Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (#1137).
Deprecated status code aliases are available again (#1135).
Multipart part headers are validated before serialization (#1142).

httpx2

Added

Add the public Origin value object and URL.origin property by @Kludex in #1134

Changed

Require Brotli 1.2.0 or later for the brotli extra by @Kludex in #1141

Fixed

Restore deprecated status code aliases by @Kludex in #1135
Extract HTTP/2 release notes from changelog headings correctly by @Kludex in #1136
Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications by @Kludex in #1137
Validate multipart part header names and values before serialization by @Kludex in #1142

httpcore2

Changed

Cache sniffio availability instead of importing it on every synchronization call by @mbeijen in #1132

Full Changelog: v2.10.0...v2.11.0

Open source →

2.10.09 Aug 2026

🚀 Performance and memory improvements

Highlights

🚀 Performance and memory improvements

Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (#1127).
SSE parsing is up to 35x faster on highly fragmented streams (#1117).
Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (#1119, #1114). Thanks @hoodmane!

httpx2

Added

Add support for running on WebAssembly / Emscripten via Pyodide by @hoodmane in #1119
Add max_event_size to cap SSE event buffering by @Kludex in #1071
Add RFC 9110 status code constants by @mbeijen in #1069
Add support for Python 3.15 by @hugovk in #1090

Changed

Improve SSE chunk buffering performance by @Kludex in #1117
Skip cookie extraction without Set-Cookie by @Kludex in #1107
Return str | None instead of Any from Headers.get by @ItsDrike in #1121

Fixed

Enforce WebSocket max message size across fragments by @Kludex in #1085
Ignore unsolicited and duplicate Pong frames by @Kludex in #1122

httpcore2

Added

Add support for Python 3.15 by @hugovk in #1090

Changed

Avoid quadratic copying when sending large HTTP/2 request bodies by @Kludex in #1127

Fixed

Propagate the original exception instead of raising KeyError when an HTTP/2 stream fails by @yhay81 in #1093
Start TLS for the wss scheme in SOCKS5 proxy connections by @Kludex in #1104

🙏 New Contributors

@ccbest made their first contribution in #1096
@dependabot[bot] made their first contribution in #1103
@bagowix made their first contribution in #1111
@aldbr made their first contribution in #1108
@dsfaccini made their first contribution in #1110
@yhay81 made their first contribution in #1093
@laisbsc made their first contribution in #1092
@hoodmane made their first contribution in #1114
@ItsDrike made their first contribution in #1121

Full Changelog: v2.9.1...v2.10.0

Open source →

Additional notes2 sources agree

Added

Add support for Python 3.15. (#1090)

Changed

Avoid quadratic copying when sending large HTTP/2 request bodies. (#1127)

Fixed

Propagate the original exception instead of raising KeyError when an HTTP/2 stream fails. (#1093)
Start TLS for the wss scheme in SOCKS5 proxy connections. (#1104)

Open source →

2.9.124 Jul 2026

Alias httpcore imports to httpcore2 in alias_httpx() by @Kludex in #1082

What's Changed

Alias httpcore imports to httpcore2 in alias_httpx() by @Kludex in #1082

Full Changelog: v2.9.0...v2.9.1

Open source →

Additional notes2 sources agree

No changes since 2.9.0. Version bumped to stay in lockstep with httpx2.

Open source →

2.9.023 Jul 2026

Add alias_httpx() to alias httpx imports to httpx2 by @Kludex in #1077

What's Changed

Add alias_httpx() to alias httpx imports to httpx2 by @Kludex in #1077

Full Changelog: v2.8.0...v2.9.0

Open source →

Additional notes2 sources agree

No changes since 2.8.0. Version bumped to stay in lockstep with httpx2.

Open source →

2.7.014 Jul 2026

This release syncs the vendored WebSocket support with the latest httpx-ws, which was previously pinned to an outdated snapshot.

What's Changed

Update vendored httpx-ws to upstream v0.9.0 by @Kludex in #1067

Full Changelog: v2.6.0...v2.7.0

Open source →

Additional notes2 sources agree

No changes since 2.6.0. Version bumped to stay in lockstep with httpx2.

Open source →

2.6.014 Jul 2026

The main feature in this release is support for WebSockets! 🎉

from httpx2 import AsyncClient

async with httpx2.AsyncClient() as client:
    async with client.websocket("ws://localhost:8000/ws") as ws:
        await ws.send_text("Hello!")
        message = await ws.receive_text()

What's Changed

Read _expire_at only once in has_expired() by @mbeijen in #1045
Add native WebSocket support by vendoring httpx-ws by @Kludex in #1042
Add QUERY method support (RFC 10008) by @Diegorro98 in #1055
fix: clean up garbage connections on cancellation in AsyncConnectionPool by @mbeijen in #983
Bump click lower bound to >=8.4 and drop upper bound by @drusc0 in #1040

New Contributors

@achapkowski made their first contribution in #1058
@hrnciar made their first contribution in #1054
@Diegorro98 made their first contribution in #1055
@drusc0 made their first contribution in #1041

Full Changelog: v2.5.0...v2.6.0

Open source →

Additional notes2 sources agree

Fixed

Clean up garbage connections on cancellation in AsyncConnectionPool. (#983)
Read _expire_at only once in has_expired(). (#1045)

Open source →

2.5.025 Jun 2026

Allow IPv6 CIDR notation in no_proxy by @mbeijen in #967

What's Changed

Allow IPv6 CIDR notation in no_proxy by @mbeijen in #967
Propagate timeout through SOCKS5 handshake by @mbeijen in #1009
Add native server-sent events support via client.sse() by @Kludex in #1046
Support | and |= operators for Headers by @Kludex in #1047
Suppress empty SSE keepalive events and accept case-insensitive content type by @Kludex in #1048
Inline SSE header defaults using the Headers union operator by @Kludex in #1049

Full Changelog: v2.4.0...v2.5.0

Open source →

Additional notes2 sources agree

Fixed

Propagate the timeout through the SOCKS5 handshake. (#1009)

Open source →

2.4.011 Jun 2026Deprecated

Use a custom deprecation warning visible by default by @Kludex in #1029

What's Changed

Use RLock instead of Lock to prevent thread deadlock by @mbeijen in #1008
In the main description, replace “Python 3” with just “Python” by @musicinmybrain in #1011
Release HTTP/2 semaphore permit on NoAvailableStreamIDError by @mbeijen in #1012
Move HTTP/2 stream events cleanup inside _state_lock by @mbeijen in #1013
Allow version 15 of rich in httpx2’s cli extra by @musicinmybrain in #1015
Test with chardet 6.0.0.post1 by @musicinmybrain in #1017
Mark httpx2 and httpcore2 classifiers as Production/Stable by @Kludex in #1021
Parse empty Digest auth realm without crashing by @mbeijen in #1023
Decode IDNA labels in non-leading host positions by @mbeijen in #1018
Enable ruff UP rule by @Kludex in #1025
Limit chained Content-Encoding decoders to 5 by @Kludex in #1027
Use a custom deprecation warning visible by default by @Kludex in #1029
Make the code more strictly typed without changing the type checker by @Kludex in #1030
Version 2.4.0 by @Kludex in #1031

New Contributors

@musicinmybrain made their first contribution in #1011

Full Changelog: v2.3.0...v2.4.0

Open source →

Additional notes2 sources agree

Fixed

Move HTTP/2 stream events cleanup inside _state_lock. (#1013)
Release the HTTP/2 semaphore permit on NoAvailableStreamIDError. (#1012)
Use RLock instead of Lock to prevent a thread deadlock. (#1008)

Open source →

2.3.01 Jun 2026

Allow default_encoding callable to return None by @Kludex in https://github.com/pydantic/httpx2/pull/951

What's Changed

Allow default_encoding callable to return None by @Kludex in https://github.com/pydantic/httpx2/pull/951
perf: use memoryview in write() to avoid copies by @mbeijen in https://github.com/pydantic/httpx2/pull/954
perf: use anyio fast_acquire for Lock and Semaphore by @mbeijen in https://github.com/pydantic/httpx2/pull/970
Make zstd import optional on Python 3.14 by @Kludex in https://github.com/pydantic/httpx2/pull/1000
Switch from certifi to truststore for default SSL verification by @Kludex in https://github.com/pydantic/httpx2/pull/209
Switch httpcore2 from certifi to truststore for default SSL verification by @Kludex in https://github.com/pydantic/httpx2/pull/1002
Store elapsed time on stream wrapper to avoid reference cycles by @mbeijen in https://github.com/pydantic/httpx2/pull/948
perf: Rewrite _assign_requests_to_connections as a single-pass loop by @mbeijen in https://github.com/pydantic/httpx2/pull/974
create_ssl_context: raise when verify is a str and cert is provided by @mbeijen in https://github.com/pydantic/httpx2/pull/990

New Contributors

@hugovk made their first contribution in https://github.com/pydantic/httpx2/pull/960
@cclauss made their first contribution in https://github.com/pydantic/httpx2/pull/972
@lundberg made their first contribution in https://github.com/pydantic/httpx2/pull/978
@angryfoxx made their first contribution in https://github.com/pydantic/httpx2/pull/977

Full Changelog: https://github.com/pydantic/httpx2/compare/v2.2.0...v2.3.0

Open source →

Additional notes2 sources agree

Changed

Use truststore instead of certifi for default SSL verification, loading the operating system's trust store. (#1002)
Rewrite _assign_requests_to_connections as a single-pass loop. (#974)
Use anyio's fast_acquire for Lock and Semaphore. (#970)
Use memoryview in write() to avoid copies. (#954)

Open source →

2.2.017 May 2026

Handle multi-frame zstd streams split across chunks by @mbeijen in https://github.com/pydantic/httpx2/pull/946

What's Changed

Handle multi-frame zstd streams split across chunks by @mbeijen in https://github.com/pydantic/httpx2/pull/946
Do a lazy import of the _main CLI module by @mbeijen in https://github.com/pydantic/httpx2/pull/947

Full Changelog: https://github.com/pydantic/httpx2/compare/v2.1.0...v2.2.0

Open source →

Additional notes2 sources agree

No changes since 2.1.0. Version bumped to stay in lockstep with httpx2.

Open source →

2.1.015 May 2026

Drop Python 3.9 support, add Python 3.14 by @Kludex in https://github.com/pydantic/httpx2/pull/208

What's Changed

Drop Python 3.9 support, add Python 3.14 by @Kludex in https://github.com/pydantic/httpx2/pull/208
Use stdlib compression.zstd for Zstd decompression on Python 3.14+ by @Kludex in https://github.com/pydantic/httpx2/pull/932
Bundle LICENSE.md in httpx2 and httpcore2 sdists by @Kludex in https://github.com/pydantic/httpx2/pull/938
Wait for positive HTTP/2 flow-control credit when stream window goes negative by @mbeijen in https://github.com/pydantic/httpx2/pull/935

New Contributors

@hramezani made their first contribution in https://github.com/pydantic/httpx2/pull/931
@mbeijen made their first contribution in https://github.com/pydantic/httpx2/pull/936

Full Changelog: https://github.com/pydantic/httpx2/compare/v2.0.0...v2.1.0

Open source →

Additional notes2 sources agree

Removed

Drop support for Python 3.8 and 3.9. (#208)

Added

Add support for Python 3.14. (#208)
Bundle LICENSE.md in the sdist. (#938)

Fixed

Wait for positive flow-control credit when a peer's SETTINGS frame drives a stream's send window negative, instead of letting h2 raise LocalProtocolError. (#935)

Open source →

2.0.0b111 May 2026pre-release2 sources agree

First release of httpcore2, a fork of `httpcore` maintained by Pydantic. Forked from httpcore 1.0.9.

First release of httpcore2, a fork of httpcore maintained by Pydantic. Forked from httpcore 1.0.9.

Breaking changes

Renamed package: httpcore -> httpcore2. import httpcore becomes import httpcore2. No other public API changed.

Fixed

Fix max_keepalive_connections not being properly handled. (Inherited from upstream PR encode/httpcore#1000.)

Historical entries below are from upstream encode/httpcore.

Open source →

httpcore2

Release timeline

Releases

Highlights

📤 Accurate file upload lengths

🔐 Reliable proxy TLS and HTTP/2 negotiation

🧹 Clean WebSocket shutdown

httpx2

Fixed

httpcore2

Fixed

From the same repository

Highlights

🔐 Reliable TLS verification controls

🧹 Safer async stream cleanup

httpx2

Changed

Fixed

httpcore2

Changed

Fixed

Changed

Fixed

Highlights

🛡️ Bounded response decompression

📦 Shared Zstandard API

httpx2

Changed

Fixed

httpcore2

Highlights

🌐 Public origin API

🛠️ Request compatibility and validation

httpx2

Added

Changed

Fixed

httpcore2

Changed

Highlights

🚀 Performance and memory improvements

🕸️ WebAssembly / Emscripten support

httpx2

Added

Changed

Fixed

httpcore2

Added

Changed

Fixed

🙏 New Contributors

Added

Changed

Fixed

What's Changed

What's Changed

What's Changed

Changed

What's Changed

What's Changed

New Contributors

Fixed

What's Changed

Fixed

What's Changed

New Contributors

Fixed

What's Changed

New Contributors

Changed

What's Changed

What's Changed

New Contributors

Removed

Added

Fixed

Breaking changes

Fixed