[ViperJuice]

Six advisories were published against the pinned httpx2/httpcore2 2.9.1 in the last two days, so main started failing its own audit gate without anyone changing code. Every open PR inherits the red X — including the TRUST phase in #240, whose diff touches no dependency file at all.

That is precisely what the gate added in #228 exists to do: catch newly published advisories against what actually ships.

httpx2    2.9.1  PYSEC-2026-3845/3846/3847/3848/3849  fixes 2.10.0 / 2.11.0 / 2.12.0
httpcore2 2.9.1  PYSEC-2026-3844                      fix   2.10.0

Lockfile only

pyproject.toml:86 already declares httpx2>=2.5.0,<3.0.0 and 2.12.0 sits inside it, so no constraint moves.

Scoped with --upgrade-package per flagged package rather than a bare uv lock --upgrade, which over-reached in this repo before and dragged ruff forward, breaking ~40 unrelated files under scripts/probes/. Exactly three entries changed:

Package	Change
httpcore2	2.9.1 → 2.12.0
httpx2	2.9.1 → 2.12.0
httpx2-jsfetch	new 1.0

The new transitive was checked, not waved through

A previously-unseen package appearing under an HTTP library is the exact shape this repo's current trust-boundary programme is about, so it got looked at:

• declared by httpx2 2.12.0 itself, not injected by the resolver
• from PyPI with both sdist and wheel sha256 hashes recorded in the lock
• gated sys_platform == 'emscripten' — it never installs off Pyodide

Verified empirically rather than by reading the marker: after uv sync --locked --all-extras --dev, httpx2_jsfetch is not importable. It is a lockfile graph entry only.

Verification

• pip-audit --strict on the resolved environment: "No known vulnerabilities found" (was six).
• Full suite: 3456 collected — identical population to main, since this PR adds no tests. 3215 passed + 107 failed + 106 errors = 3428, exactly main's passed count.
• Those failures are the known worktree-location artifact, not a regression: node_modules at the volume root trips npm's local-prefix rule and the resolver refuses by design (npm identity: the same collision class survives in rarer flag spellings #195). A checkout outside /mnt runs clean, as CI does.
• Matching counts alone wouldn't catch a pass↔fail swap, so I checked the reasons: every failure traces to that refusal or its downstream UpdateServerOutput cascade, and the output contains zero occurrences of httpx, httpcore, ConnectError, ReadError or TransportError. The transport bump introduced none of them.

httpx2 is the transport client/manager.py runs on, so this is not a cosmetic bump — that is why the failure reasons were checked rather than just the totals.

Merging this first unblocks #240, which is otherwise green on all three interpreters.

🤖 Generated with Claude Code

https://claude.ai/code/session_018FncHYooSXexECJ2DYcnu6

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}