Skip to content

Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.4 - #42

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/julia/HTTP-1.10-and-2.3
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/julia/HTTP-1.10-and-2.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 19, 2026 •

Copy link
Copy Markdown
Contributor

Updates the requirements on HTTP to permit the latest version.

Release notes

Sourced from HTTP's releases.

v2.4.0

HTTP v2.4.0

Diff since v2.3.1

Merged pull requests:

Commits
  • b5219f5 Harden HTTP.jl security defaults for v2.4.0 (#1316)
  • 9e830d9 Update Project.toml
  • e3680e5 fix version check for public declarations (#1313)
  • 4c50080 Add support for passing IO objects to Websockets.open() (#1251)
  • 6a19dbf Update Project.toml
  • bb14ad9 Declare the documented public API via Julia's public mechanism (#1312)
  • f8e9db6 docs: add a parse_multipart_form usage example (#949) (#1311)
  • a9e8b86 Add public isrecoverable(::Exception) for retry classification (#1245) (#1310)
  • b4b0a5e Bind outbound connections to a local address/interface via local_addr (#834) ...
  • eeb77b2 WebSocket permessage-deflate compression (RFC 7692) (#853) (#1308)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file julia Pull requests that update julia code labels Jun 19, 2026
Updates the requirements on [HTTP](https://github.com/JuliaWeb/HTTP.jl) to permit the latest version.
- [Release notes](https://github.com/JuliaWeb/HTTP.jl/releases)
- [Changelog](https://github.com/JuliaWeb/HTTP.jl/blob/master/CHANGELOG.md)
- [Commits](JuliaWeb/HTTP.jl@v1.10.0...v2.4.0)

---
updated-dependencies:
- dependency-name: HTTP
  dependency-version: 2.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.3 Build(deps): Update HTTP requirement from 1.10 to 1.10, 2.4 Jun 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/julia/HTTP-1.10-and-2.3 branch from adadc71 to 22d661e Compare June 22, 2026 18:35
@tbeason

tbeason commented Jun 25, 2026

Copy link
Copy Markdown
Owner

Superseded by #45, which performs the full HTTP.jl 2.4 code migration (this PR only widened the compat bound, which isn't sufficient — the package doesn't build on 2.x without the code changes). Closing in favor of #45.

@tbeason tbeason closed this Jun 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/julia/HTTP-1.10-and-2.3 branch June 25, 2026 14:28
tbeason added a commit that referenced this pull request Jun 25, 2026
* Upgrade to HTTP.jl 2.4 and release v0.3.1

HTTP.jl 2.x is a ground-up rewrite. All real-HTTP usage is isolated in
src/http.jl (plus one direct dispatcher call in batch.jl):

- readtimeout -> read_idle_timeout (2.x rename; same idle-timeout semantics)
- retry=false -> retries=0 (2.x has no `retry` boolean)
- HTTP.Exceptions.{HTTPError,TimeoutError,ConnectError} -> top-level HTTP.*
  (the Exceptions submodule is gone)
- streaming uses startread's returned Response instead of http.message
- JSON3.read(resp.body) -> JSON3.read(Vector{UInt8}(resp.body)); in 2.x
  resp.body is an HTTP.BytesBody wrapper JSON3 doesn't recognize
- _is_retryable_exception keeps connect timeouts retryable: 2.x surfaces them
  as TimeoutError(operation="connect") rather than ConnectError

Tests: HTTP.Exceptions.X -> HTTP.X and TimeoutError(n) -> TimeoutError("read", n)
(the 1-arg ctor is gone). HTTP.Response mock ctors are backward compatible.

Compat bumped to "2.4" in Project.toml and benchmark/Project.toml. Bumps the
package to v0.3.1. Supersedes #42.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Treat TLS-handshake timeouts as retryable connection failures

HTTP 2.x's connect_timeout budget covers DNS/dial *and* the TLS handshake. A
handshake deadline surfaces as TimeoutError(operation="tls_handshake"), not
"connect", so the previous predicate skipped the retry loop and then mislabeled
it as a read timeout (BentoTimeoutError → "raise the read timeout"), when it's
really a transient connection failure.

Generalize the connect-timeout special-case to a _CONNECT_PHASE_TIMEOUT_OPS set
{"connect", "tls_handshake"} via _is_connect_timeout, used by both the retry
predicate and the two BentoTimeoutError mapping sites. Adds a regression test.

Addresses Codex review feedback on #45.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file julia Pull requests that update julia code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant