chore(deps-dev): bump the dev-dependencies group with 2 updates

[dependabot]

Bumps the dev-dependencies group with 2 updates: httpx2 and pyproject-fmt.

Updates httpx2 from 2.10.0 to 2.12.0

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• See full diff in compare view

Updates pyproject-fmt from 2.27.0 to 2.28.1

Release notes

Sourced from pyproject-fmt's releases.

pyproject-fmt/2.28.1

Packaging

• The wheel declares its dependencies in the METADATA header, where an installer looks for them. (#444)

pyproject-fmt/2.28.0

Fixed

• A sub-table written under its own header reads in the same key order as the folded form. (#438)
• [tool.cibuildwheel] overrides keep their order once folded. (#437)
• [tool.coverage] keys follow the order the tool documents. (#436)

Documentation

• The docs build publishes llms.txt. (#432)

pyproject-fmt/2.27.1

Fixed

• project.version stays as written. It is the exact version published in the package metadata, and normalizing it rewrote what a release had already gone out as. (#431)

Commits

• 7592b93 Release pyproject-fmt 2.28.1 [skip ci]
• 02390a9 🐛 fix(build): write Requires-Dist into the METADATA header (#444)
• f4f09f6 build(deps): bump the github-actions group with 2 updates (#443)
• bd3336d 🔧 chore: batch dependency updates weekly on Tuesday (#442)
• 21e1ffd build(deps): bump the github-actions group with 2 updates (#440)
• e6b8bdf Release pyproject-fmt 2.28.0 [skip ci]
• 6c2bb2f 🧪 test(pyproject-fmt): cover scalar cibuildwheel sort keys (#439)
• 3283992 🐛 fix(common): order expanded sub-tables by their key order (#438)
• fc9a2e5 🐛 fix(pyproject-fmt): order collapsed cibuildwheel overrides (#437)
• e3c3ba8 🐛 fix(pyproject-fmt): apply the coverage key order as listed (#436)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report

File	Stmts	Miss	Cover
TOTAL	84	0	100%

Tests	Skipped	Failures	Errors	Time
63	0 💤	0 ❌	0 🔥	0.523s ⏱️

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.