[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
httpx2 (changelog)	==2.13.1 → ==2.14.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

pydantic/httpx2 (httpx2)

v2.14.0

Compare Source

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#​1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#​1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#​1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#​1217), and writing after a peer closes TLS without close_notify raises WriteError (#​1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#​1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#​1233).

httpx2

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#​1165).
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#​1267).

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#​1165).

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#​1267).
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#​1130).
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#​1233).
• Stop the sync WebSocket session from hanging on exit when its event queue is full (#​1123).

httpcore2

Fixed

• Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#​1262).
• Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#​1217).
• Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#​1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-20 01:19 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🟢 Approval recommended

The change is limited to one test dependency pin, with no identified blocking issues.

No open issues 🎉

What changed in this PR

Updates the OpenAI instrumentation’s test-only httpx2 dependency.

Changes:

• Bumps httpx2 from 2.13.1 to 2.14.0 in the latest-version test requirements.

File	Description
instrumentation/​opentelemetry-instrumentation-genai-openai/​tests/​requirements.latest.txt	Updates the httpx2 test dependency pin.

_{Review effort: Balanced}