chore(deps): bump httpx2 from 2.7.0 to 2.12.0 in the python-security group across 1 directory (#3823)

Raise the published HTTPX2 minimum to 2.12.0 so SDK installations
receive incremental response decompression and stream cleanup on
decoding errors. Keep the matching HTTPcore2 constraint and update both
the project and runnable realtime-example locks.

Keep focused synchronous and asynchronous regressions for bounded,
lossless decoding of a large gzip response and immediate stream closure
on malformed gzip/deflate data. Existing large JSON/SSE parser coverage
remains intact, with all large cases in one collected test to keep xdist
execution sequential. Preserve the release-please lock marker and align
policy, wheel-metadata validation, and retry-header assertions with the
new dependency.

Validation: five focused tests, Ruff, Pyright, and mypy passed locally
after trimming redundant parser and dependency-floor tests. Earlier
regression reversal confirmed the bounded-decoding and stream-cleanup
probes fail against HTTPX2 2.10.0. Changed dependency artifact URLs and
hashes were verified against PyPI, and build metadata was reviewed.
Hosted CI validates the final head, including the Python 3.10/3.14 and
HTTPX2 test jobs, wheel installation, lint, and custom-code budgets.

---

Bumps the python-security group with 1 update in the / directory:
[httpx2](https://github.com/pydantic/httpx2).

Updates `httpx2` from 2.7.0 to 2.12.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/releases">httpx2's
releases</a>.</em></p>
<blockquote>
<h2>v2.12.0</h2>
<h2>Highlights</h2>
<h3>🛡️ Bounded response decompression</h3>
<p><code>httpx2</code> now decodes <code>gzip</code>,
<code>deflate</code>, Brotli, and Zstandard responses incrementally.
Each decode step emits at most 1 MiB, so streaming a highly compressed
response no longer requires materializing an entire inflated network
chunk in memory (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1126">pydantic/httpx2#1126</a>).</p>
<h3>📦 Shared Zstandard API</h3>
<p>Python 3.13 and earlier now use <code>backports.zstd</code>, which
provides the same bounded incremental decompression API as
<code>compression.zstd</code> on Python 3.14 and later (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1146">pydantic/httpx2#1146</a>).</p>
<h2>httpx2</h2>
<h3>Changed</h3>
<ul>
<li>Use <code>backports.zstd</code> for Zstandard decoding on Python
3.13 and earlier by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1146">pydantic/httpx2#1146</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Bound peak memory while streaming compressed responses and close
response streams when decoding fails by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1126">pydantic/httpx2#1126</a></li>
</ul>
<h2>httpcore2</h2>
<p>No changes since <code>2.11.0</code>. Version bumped to stay in
lockstep with <code>httpx2</code>.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0">https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0</a></p>
<h2>v2.11.0</h2>
<h2>Highlights</h2>
<h3>🌐 Public origin API</h3>
<p><code>httpx2</code> now includes an immutable and hashable
<code>Origin</code> value object, available through
<code>URL.origin</code>. It provides normalized scheme, host, and
effective port comparisons without including URL paths, queries,
fragments, or credentials (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1134">pydantic/httpx2#1134</a>).</p>
<h3>🛠️ Request compatibility and validation</h3>
<ul>
<li>Explicit <code>Transfer-Encoding</code> headers now take precedence
over body-derived <code>Content-Length</code> headers (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1137">pydantic/httpx2#1137</a>).</li>
<li>Deprecated status code aliases are available again (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1135">pydantic/httpx2#1135</a>).</li>
<li>Multipart part headers are validated before serialization (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1142">pydantic/httpx2#1142</a>).</li>
</ul>
<h2>httpx2</h2>
<h3>Added</h3>
<ul>
<li>Add the public <code>Origin</code> value object and
<code>URL.origin</code> property by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1134">pydantic/httpx2#1134</a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra by
<a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/pydantic/httpx2/pull/1141">pydantic/httpx2#1141</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md">httpx2's
changelog</a>.</em></p>
<blockquote>
<h2>2.12.0 (August 18th, 2026)</h2>
<h3>Changed</h3>
<ul>
<li>Use <code>backports.zstd</code> for Zstandard decoding on Python
3.13 and earlier.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1146">#1146</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Bound peak memory while streaming compressed responses and close
response streams when decoding fails.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1126">#1126</a>)</li>
</ul>
<h2>2.11.0 (August 18th, 2026)</h2>
<h3>Added</h3>
<ul>
<li>Add the public <code>Origin</code> value object and
<code>URL.origin</code> property for normalized,
hashable origin comparisons. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1134">#1134</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1141">#1141</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Restore deprecated status code aliases. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1135">#1135</a>)</li>
<li>Extract HTTP/2 release notes from changelog headings correctly. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1136">#1136</a>)</li>
<li>Respect explicit <code>Transfer-Encoding</code> headers and expose
buffered request body lengths to WSGI applications.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1137">#1137</a>)</li>
<li>Validate multipart part header names and values before
serialization.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1142">#1142</a>)</li>
</ul>
<h2>2.10.0 (August 9th, 2026)</h2>
<h3>Added</h3>
<ul>
<li>Add support for running on WebAssembly / Emscripten via Pyodide,
using a JavaScript
<code>fetch</code>-based transport defined in
<code>httpx2-jsfetch</code>.
(<a
href="https://redirect.github.com/pydantic/httpx2/pull/1119">#1119</a>)</li>
<li>Add <code>max_event_size</code> to cap SSE event buffering. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1071">#1071</a>)</li>
<li>Add RFC 9110 status code constants. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1069">#1069</a>)</li>
<li>Add support for Python 3.15. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1090">#1090</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Improve SSE chunk buffering performance. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1117">#1117</a>)</li>
<li>Skip cookie extraction for responses without <code>Set-Cookie</code>
headers. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1107">#1107</a>)</li>
<li>Return <code>str | None</code> instead of <code>Any</code> from
<code>Headers.get</code>. (<a
href="https://redirect.github.com/pydantic/httpx2/pull/1121">#1121</a>)</li>
</ul>
<h3>Fixed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pydantic/httpx2/commit/71ae23be5448f859c2b4e21d9972ddfa7b8d759d"><code>71ae23b</code></a>
Version 2.12.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1147">#1147</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8"><code>4fd0c70</code></a>
Decode compressed response bodies incrementally (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1126">#1126</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/d588e528a11eb20323031ee571fadc668bb81b3f"><code>d588e52</code></a>
Use <code>backports.zstd</code> on Python 3.13 and earlier (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1146">#1146</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/344589da2a992f7e5a0c25c68cc78c25ec6d70bd"><code>344589d</code></a>
Version 2.11.0 (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1143">#1143</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/de96d810ee4e309d118982fe7084a46a2bcd600d"><code>de96d81</code></a>
Validate multipart part headers (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1142">#1142</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/51c32698ce029140cb69a26921d017e3edda80fa"><code>51c3269</code></a>
Require brotli 1.2.0 in the brotli extra (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1141">#1141</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab"><code>829b93a</code></a>
Respect explicit Transfer-Encoding headers (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1137">#1137</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/4fa6c8ee96fb79035c6820e4f44a10b6262d9c9f"><code>4fa6c8e</code></a>
Fix changelog extraction regex for H2 release headings (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1136">#1136</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/8a6f37063514ee2a2601607c20be72667fdfa3be"><code>8a6f370</code></a>
Restore deprecated status code aliases (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1135">#1135</a>)</li>
<li><a
href="https://github.com/pydantic/httpx2/commit/d03f1ec6a1a323f951a8c21cd14f9c02f2d1e855"><code>d03f1ec</code></a>
Add public Origin API (<a
href="https://redirect.github.com/pydantic/httpx2/issues/1134">#1134</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pydantic/httpx2/compare/v2.7.0...v2.12.0">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marcus Wood <marcuswood@openai.com>