refactor: migrate from httpx to httpx2

Replace legacy httpx with httpx2 across PDP resolvers (opa, authzen),
tools (integrity, catalog), and their tests. No dependency in the
locked tree requires httpx 1.x -- mcp 2.0.0 already depends on httpx2.

- Drop httpx and unused httpx[http2] extra; declare httpx2>=2.0.0
- Relock: removes httpx, httpcore, h2, hpack, hyperframe
- Fix stale pre-migration httpx.AsyncClient refs in
  test_client_coverage.py (missing import would NameError)
- Keep PLUGINS_HTTPX_* setting names for config compatibility

Author: jonpspri

cpex/framework/external/mcp/client.py

@@ -326,7 +326,7 @@ def _tls_httpx_client_factory(
                 auth: Optional authentication handler for HTTP requests.
 
             Returns:
-                Configured httpx AsyncClient with TLS settings applied.
+                Configured httpx2 AsyncClient with TLS settings applied.
 
             Raises:
                 PluginError: If TLS configuration fails.

cpex/framework/external/mcp/tls_utils.py

@@ -103,7 +103,7 @@ def create_ssl_context(tls_config: MCPClientTLSConfig, plugin_name: str) -> ssl.
         plugin_name: Name of the plugin (for error messages)
 
     Returns:
-        Configured SSLContext ready for use with httpx or other SSL connections
+        Configured SSLContext ready for use with httpx2 or other SSL connections
 
     Raises:
         PluginError: If SSL context configuration fails

cpex/framework/pdp/authzen.py

@@ -42,7 +42,7 @@
 import time
 from typing import Any
 
-import httpx
+import httpx2
 
 from cpex.framework.pdp.base import PdpError, PdpResolver, PdpResult
 
@@ -95,8 +95,8 @@ def __init__(
         """
         self._endpoint_template = endpoint
         self.fail_open = fail_open
-        self._client = httpx.AsyncClient(
-            timeout=httpx.Timeout(timeout_ms / 1000.0),
+        self._client = httpx2.AsyncClient(
+            timeout=httpx2.Timeout(timeout_ms / 1000.0),
             headers=headers or {},
         )
 
@@ -134,7 +134,7 @@ async def resolve(self, input_data: dict[str, Any]) -> PdpResult:
             response.raise_for_status()
             return self._parse_response(response.json(), latency_ms)
 
-        except httpx.TimeoutException as e:
+        except httpx2.TimeoutException as e:
             latency_ms = (time.monotonic() - start) * 1000
             logger.warning("AuthZen timeout after %.1fms: %s", latency_ms, endpoint)
             if self.fail_open:
@@ -149,7 +149,7 @@ async def resolve(self, input_data: dict[str, Any]) -> PdpResult:
                 cause=e,
             )
 
-        except httpx.HTTPStatusError as e:
+        except httpx2.HTTPStatusError as e:
             latency_ms = (time.monotonic() - start) * 1000
             logger.error(
                 "AuthZen HTTP %d from %s: %s",
@@ -169,7 +169,7 @@ async def resolve(self, input_data: dict[str, Any]) -> PdpResult:
                 cause=e,
             )
 
-        except httpx.HTTPError as e:
+        except httpx2.HTTPError as e:
             latency_ms = (time.monotonic() - start) * 1000
             logger.error("AuthZen connection error: %s", e)
             if self.fail_open:

cpex/framework/pdp/opa.py

@@ -38,7 +38,7 @@
 import time
 from typing import Any
 
-import httpx
+import httpx2
 
 from cpex.framework.pdp.base import PdpError, PdpResolver, PdpResult
 
@@ -92,8 +92,8 @@ def __init__(
         """
         self._endpoint_template = endpoint
         self.fail_open = fail_open
-        self._client = httpx.AsyncClient(
-            timeout=httpx.Timeout(timeout_ms / 1000.0),
+        self._client = httpx2.AsyncClient(
+            timeout=httpx2.Timeout(timeout_ms / 1000.0),
             headers=headers or {},
         )
 
@@ -133,7 +133,7 @@ async def resolve(self, input_data: dict[str, Any]) -> PdpResult:
             response.raise_for_status()
             return self._parse_response(response.json(), latency_ms)
 
-        except httpx.TimeoutException as e:
+        except httpx2.TimeoutException as e:
             latency_ms = (time.monotonic() - start) * 1000
             logger.warning("OPA timeout after %.1fms: %s", latency_ms, endpoint)
             if self.fail_open:
@@ -148,7 +148,7 @@ async def resolve(self, input_data: dict[str, Any]) -> PdpResult:
                 cause=e,
             )
 
-        except httpx.HTTPStatusError as e:
+        except httpx2.HTTPStatusError as e:
             latency_ms = (time.monotonic() - start) * 1000
             logger.error("OPA HTTP %d from %s", e.response.status_code, endpoint)
             if self.fail_open:
@@ -163,7 +163,7 @@ async def resolve(self, input_data: dict[str, Any]) -> PdpResult:
                 cause=e,
             )
 
-        except httpx.HTTPError as e:
+        except httpx2.HTTPError as e:
             latency_ms = (time.monotonic() - start) * 1000
             logger.error("OPA connection error: %s", e)
             if self.fail_open:

cpex/framework/settings.py

@@ -349,7 +349,7 @@ def empty_string_to_none(cls, value: Any) -> Any:
 
 
 class PluginsHttpClientSettings(BaseSettings):
-    """Lightweight settings for HTTP client (httpx) configuration."""
+    """Lightweight settings for HTTP client (httpx2) configuration."""
 
     skip_ssl_verify: bool = False
     httpx_max_connections: int = 200

cpex/tools/catalog.py

@@ -23,7 +23,7 @@
 from pathlib import Path
 from typing import Any, Optional
 
-import httpx
+import httpx2
 import yaml
 from github import Auth, Github
 from packaging.version import InvalidVersion, Version
@@ -292,7 +292,7 @@ def update_plugin_version_registry(self, manifest: PluginManifest, relpath: Path
             encoding="utf-8",
         )
 
-    def save_manifest_content(self, content: str, path, repo_url: httpx.URL):
+    def save_manifest_content(self, content: str, path, repo_url: httpx2.URL):
         """
         write the manifest content to the supplied path relative to the ouptut folder,
         injecting the monorepo.package_source value before saving the file.
@@ -333,11 +333,11 @@ def save_catalog_content(self, content: str, path):
         """
         self.save_content(self.catalog_folder, content, path)
 
-    def download_contents(self, git_url: str, headers, path: str, repo_url: httpx.URL):
+    def download_contents(self, git_url: str, headers, path: str, repo_url: httpx2.URL):
         """
         Download the contents of the file using the github REST API.
         """
-        result = httpx.get(git_url, headers=headers, timeout=30.0)
+        result = httpx2.get(git_url, headers=headers, timeout=30.0)
         if result.status_code == 200:
             js = result.json()
             b64_content = js["content"]
@@ -456,7 +456,7 @@ def _search_github_code(self, repo_path: str, member: str | None, headers) -> li
             return None
 
     def _transform_manifest_data(
-        self, manifest_content: dict, name: str, member: str | None, repo_url: httpx.URL
+        self, manifest_content: dict, name: str, member: str | None, repo_url: httpx2.URL
     ) -> dict:
         """Apply standard transformations to manifest data.
 
@@ -507,7 +507,7 @@ def _process_manifest_item(
         item: dict,
         name: str,
         member: str,
-        repo_url: httpx.URL,
+        repo_url: httpx2.URL,
         headers,
         relpath: Path,
         repo_path: str,
@@ -548,7 +548,7 @@ def _process_manifest_item(
         return True
 
     def _process_version_item(
-        self, item: dict, member: str, name: str, repo_url: httpx.URL, headers, relpath, repo_path, gh_repo
+        self, item: dict, member: str, name: str, repo_url: httpx2.URL, headers, relpath, repo_path, gh_repo
     ) -> None:
         """Find plugin-versions.json files relative to the supplied member folder,
         download and save the manifest, updating the monorepo's package_folder, package_source and repo_url attributes
@@ -566,7 +566,7 @@ def _process_version_item(
             return
         relpath.write_text(version_data, encoding="utf-8")
 
-    def find_and_save_plugin_versions_json(self, member: str, name: str, repo_url: httpx.URL, headers, gh_repo) -> None:
+    def find_and_save_plugin_versions_json(self, member: str, name: str, repo_url: httpx2.URL, headers, gh_repo) -> None:
         """Find plugin-versions.json files relative to the supplied member folder,
         download and save the manifest, updating the monorepo's package_folder, package_source and repo_url attributes
         Args:
@@ -590,7 +590,7 @@ def find_and_save_plugin_versions_json(self, member: str, name: str, repo_url: h
             self._process_version_item(item, member, name, repo_url, headers, relpath, repo_path, gh_repo)
 
     def find_and_save_plugin_manifest(
-        self, member: str, name: str, repo_url: httpx.URL, headers, gh_repo
+        self, member: str, name: str, repo_url: httpx2.URL, headers, gh_repo
     ) -> PluginManifest | None:
         """Find plugin-manifest*.yaml files relative to the supplied member folder,
         download and save the manifest, updating the monorepo's package_folder, package_source and repo_url attributes
@@ -620,7 +620,7 @@ def find_and_save_plugin_manifest(
 
         return None
 
-    def _process_pyproject(self, gh_repo, item, repo_url: httpx.URL, headers) -> None:
+    def _process_pyproject(self, gh_repo, item, repo_url: httpx2.URL, headers) -> None:
         """Process a single pyproject.toml file.
 
         Args:
@@ -672,7 +672,7 @@ def update_catalog_with_pyproject(self) -> bool:
         repo_cache: dict[str, Any] = {}
 
         for repo in self.monorepos:
-            repo_url = httpx.URL(repo.strip())
+            repo_url = httpx2.URL(repo.strip())
             repo_path = repo_url.path.removeprefix("/")
 
             try:

cpex/tools/integrity.py

@@ -36,7 +36,7 @@
 from pathlib import Path
 from typing import Optional
 
-import httpx
+import httpx2
 
 logger = logging.getLogger(__name__)
 
@@ -162,16 +162,16 @@ def fetch_pypi_package_hashes(
     logger.debug("Fetching package hashes from: %s", url)
 
     try:
-        with httpx.Client(timeout=timeout) as client:
+        with httpx2.Client(timeout=timeout) as client:
             response = client.get(url)
             response.raise_for_status()
             data = response.json()
 
-    except httpx.HTTPStatusError as e:
+    except httpx2.HTTPStatusError as e:
         if e.response.status_code == 404:
             raise RuntimeError(f"Package '{package_name}' not found on {'test.' if use_test else ''}PyPI") from e
         raise RuntimeError(f"Failed to fetch package metadata: {e}") from e
-    except httpx.RequestError as e:
+    except httpx2.RequestError as e:
         raise RuntimeError(f"Network error fetching package metadata: {e}") from e
     except Exception as e:
         raise RuntimeError(f"Unexpected error fetching package metadata: {e}") from e

pyproject.toml

@@ -23,8 +23,7 @@ maintainers = [
 requires-python = ">=3.11"
 dependencies = [
     "fastapi>=0.133.1",
-    "httpx>=0.28.1",
-    "httpx[http2]>=0.28.1",
+    "httpx2>=2.0.0",
     "jinja2>=3.1.6",
     "mcp>=2.0.0",
     "mcp-types>=2.0.0",

tests/unit/cpex/framework/external/mcp/test_client_coverage.py

@@ -7,6 +7,7 @@
 from unittest.mock import AsyncMock, MagicMock, patch
 
 # Third-Party
+import httpx2
 import orjson
 import pytest
 from mcp_types import TextContent
@@ -238,7 +239,7 @@ def mock_streamable(*args, **kwargs):
 
     @pytest.mark.asyncio
     async def test_streamable_client_called_with_prebuilt_client_and_terminate_on_close(self):
-        """v2 SDK contract: streamable_http_client receives a pre-built httpx client and
+        """v2 SDK contract: streamable_http_client receives a pre-built httpx2 client and
         terminate_on_close=True (replacing the removed manual __terminate_http_session)."""
         plugin = _make_plugin()
 
@@ -255,12 +256,12 @@ async def __aexit__(self, *args):
         list_tools_result.tools = []
         mock_session.list_tools = AsyncMock(return_value=list_tools_result)
 
-        prebuilt_client = AsyncMock(spec=httpx.AsyncClient)
+        prebuilt_client = AsyncMock(spec=httpx2.AsyncClient)
 
         with (
             patch("cpex.framework.external.mcp.client.streamable_http_client", return_value=OkCtx()) as mock_streamable,
             patch("cpex.framework.external.mcp.client.ClientSession", return_value=mock_session),
-            patch("cpex.framework.external.mcp.client.httpx.AsyncClient", return_value=prebuilt_client),
+            patch("cpex.framework.external.mcp.client.httpx2.AsyncClient", return_value=prebuilt_client),
         ):
             plugin._exit_stack = AsyncExitStack()
             await plugin._ExternalPlugin__connect_to_http_server("http://localhost:9999/mcp")