Bump httpx2 from 2.12.0 to 2.13.1 in the all-dependencies group

[dependabot]

Bumps the all-dependencies group with 1 update: httpx2.

Updates httpx2 from 2.12.0 to 2.13.1

Release notes

Sourced from httpx2's releases.

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

🔐 Reliable proxy TLS and HTTP/2 negotiation

TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).

🧹 Clean WebSocket shutdown

The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).

httpx2

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2

Fixed

• Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).
• Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: pydantic/httpx2@v2.13.0...v2.13.1

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.13.1 (September 23rd, 2026)

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position. (#1214)
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown. (#1228)

2.13.0 (September 14th, 2026)

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)

Fixed

• Make the --no-verify CLI flag disable TLS certificate verification and add an explicit --verify counterpart. (#1140, #1186)
• Avoid nested async generator finalization errors when streamed responses are abandoned early. (#1204)

Commits

• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• 62a607d Prepare version 2.14.0 (#1227)
• df9783d Respect file cursor positions when calculating raw content length (#1214)
• 04d152b docs: correct stale URL.query example (#1222)
• f295185 Prepare version 2.13.0 (#1208)
• 8f215b5 Use portable links in API docstrings (#1202)
• 36d636a Group httpx2.__all__ exports by source module (#1188)
• f1064aa Bump the python-packages group across 1 directory with 11 updates (#1179)
• bc27137 Update uv-dynamic-versioning requirement from >=0.14.0 to >=0.14.1 (#1180)
• 62e0827 Restore --no-verify CLI flag (#1186)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	456	97	76	46	73%

report-only-changed-files is enabled. No changed files were found in the coverage report :)

Tests	Skipped	Failures	Errors	Time
6	0 💤	0 ❌	0 🔥	2.469s ⏱️