Skip to content

Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.4#42

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/julia/HTTP-1.10-and-2.3
Closed

Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.4#42
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/julia/HTTP-1.10-and-2.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on HTTP to permit the latest version.

Release notes

Sourced from HTTP's releases.

v2.4.0

HTTP v2.4.0

Diff since v2.3.1

Merged pull requests:

Commits
  • b5219f5 Harden HTTP.jl security defaults for v2.4.0 (#1316)
  • 9e830d9 Update Project.toml
  • e3680e5 fix version check for public declarations (#1313)
  • 4c50080 Add support for passing IO objects to Websockets.open() (#1251)
  • 6a19dbf Update Project.toml
  • bb14ad9 Declare the documented public API via Julia's public mechanism (#1312)
  • f8e9db6 docs: add a parse_multipart_form usage example (#949) (#1311)
  • a9e8b86 Add public isrecoverable(::Exception) for retry classification (#1245) (#1310)
  • b4b0a5e Bind outbound connections to a local address/interface via local_addr (#834) ...
  • eeb77b2 WebSocket permessage-deflate compression (RFC 7692) (#853) (#1308)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file julia Pull requests that update julia code labels Jun 19, 2026
Updates the requirements on [HTTP](https://github.com/JuliaWeb/HTTP.jl) to permit the latest version.
- [Release notes](https://github.com/JuliaWeb/HTTP.jl/releases)
- [Changelog](https://github.com/JuliaWeb/HTTP.jl/blob/master/CHANGELOG.md)
- [Commits](JuliaWeb/HTTP.jl@v1.10.0...v2.4.0)

---
updated-dependencies:
- dependency-name: HTTP
  dependency-version: 2.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.3 Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.4 Jun 22, 2026
@dependabot dependabot Bot force-pushed the dependabot/julia/HTTP-1.10-and-2.3 branch from adadc71 to 22d661e Compare June 22, 2026 18:35
@tbeason

tbeason commented Jun 25, 2026

Copy link
Copy Markdown
Owner

Superseded by #45, which performs the full HTTP.jl 2.4 code migration (this PR only widened the compat bound, which isn't sufficient — the package doesn't build on 2.x without the code changes). Closing in favor of #45.

@tbeason tbeason closed this Jun 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/julia/HTTP-1.10-and-2.3 branch June 25, 2026 14:28
tbeason added a commit that referenced this pull request Jun 25, 2026
* Upgrade to HTTP.jl 2.4 and release v0.3.1

HTTP.jl 2.x is a ground-up rewrite. All real-HTTP usage is isolated in
src/http.jl (plus one direct dispatcher call in batch.jl):

- readtimeout -> read_idle_timeout (2.x rename; same idle-timeout semantics)
- retry=false -> retries=0 (2.x has no `retry` boolean)
- HTTP.Exceptions.{HTTPError,TimeoutError,ConnectError} -> top-level HTTP.*
  (the Exceptions submodule is gone)
- streaming uses startread's returned Response instead of http.message
- JSON3.read(resp.body) -> JSON3.read(Vector{UInt8}(resp.body)); in 2.x
  resp.body is an HTTP.BytesBody wrapper JSON3 doesn't recognize
- _is_retryable_exception keeps connect timeouts retryable: 2.x surfaces them
  as TimeoutError(operation="connect") rather than ConnectError

Tests: HTTP.Exceptions.X -> HTTP.X and TimeoutError(n) -> TimeoutError("read", n)
(the 1-arg ctor is gone). HTTP.Response mock ctors are backward compatible.

Compat bumped to "2.4" in Project.toml and benchmark/Project.toml. Bumps the
package to v0.3.1. Supersedes #42.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Treat TLS-handshake timeouts as retryable connection failures

HTTP 2.x's connect_timeout budget covers DNS/dial *and* the TLS handshake. A
handshake deadline surfaces as TimeoutError(operation="tls_handshake"), not
"connect", so the previous predicate skipped the retry loop and then mislabeled
it as a read timeout (BentoTimeoutError → "raise the read timeout"), when it's
really a transient connection failure.

Generalize the connect-timeout special-case to a _CONNECT_PHASE_TIMEOUT_OPS set
{"connect", "tls_handshake"} via _is_connect_timeout, used by both the retry
predicate and the two BentoTimeoutError mapping sites. Adds a regression test.

Addresses Codex review feedback on #45.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file julia Pull requests that update julia code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant