h11 dependency pinning causes weird cycle

Using both pip-tools or uv when trying to resolve dependencies where using uvicorn and httpx as a dev dependency will get confused and downgrade to httpcore 0.13.2 which is ancient.

I'm not 100% sure how this happens, but we had it on two separate codebases this morning. (one using uv and one using pip-tools).

It seems to stem from having a loose httpcore and h11 requirement on both cases (via e.g. uvicorn) where both resolvers prioritise h11 as it was pinned first and then the first version of httpcore that meets requirements is 0.13.2, it then also pulls in httpx to 0.25.1 as that's the higest version that doesn't require httpcore>1.
This results in a broken build as httpx needs the newer httpcore.

Looking at h11 it recently had a bunch of cleanup work done, in response to a reported cve, and has been api-stable for years now, so might be safe to relax the pin of it here.

Having similar issues here. The recent h11 CVE was addressed in h11 0.16.0. Bumping to this version causes the following dependency conflict from httpcore:

9.376     The user requested h11==0.16.0
9.376     httpcore 1.0.0 depends on h11<0.15 and >=0.13

This pinning is also preventing users from being able to update h11 to address the Critical-level CVE:

GHSA-vqfr-h8mv-ghfj

due to httpcore's pin to <0.15

httpcore/pyproject.toml

Line 33 in ae46dfb

"h11>=0.13,<0.15",

Hoping this small edit to the h11 dependency pin can help #1008

pip-audit also fails when trying to install h11 for httpcore. We need an update to 0.16.0. Thanks!

Sorry for the potentially odd question, but what's the reason behind <0.15 pin?

what's the reason behind <0.15 pin?

It's there because we can't assume that a 0.x -> 0.y version update is necessarily going to be API compatible.

In practice h11 has been API stable for some time now, so we could be less restrictive.

I'm also having issues related to the Critical-level CVE. An update to bump h11 to 0.16.0 would be extremely usefull.

@grigi

I will block users who pile in on issues.

httpcore 1.0.9 is now released.

@grigi I'm going to assume this is resolved. If you'd like it to be reopened can you clarify with a simple reproducible example?

$ pip install httpx uvicorn
Collecting httpx
  Using cached httpx-0.28.1-py3-none-any.whl.metadata (7.1 kB)
Collecting uvicorn
  Using cached uvicorn-0.34.2-py3-none-any.whl.metadata (6.5 kB)
Collecting anyio (from httpx)
  Using cached anyio-4.9.0-py3-none-any.whl.metadata (4.7 kB)
Collecting certifi (from httpx)
  Using cached certifi-2025.1.31-py3-none-any.whl.metadata (2.5 kB)
Collecting httpcore==1.* (from httpx)
  Downloading httpcore-1.0.9-py3-none-any.whl.metadata (21 kB)
Collecting idna (from httpx)
  Using cached idna-3.10-py3-none-any.whl.metadata (10 kB)
Collecting h11>=0.16 (from httpcore==1.*->httpx)
  Using cached h11-0.16.0-py3-none-any.whl.metadata (8.3 kB)
Collecting click>=7.0 (from uvicorn)
  Using cached click-8.1.8-py3-none-any.whl.metadata (2.3 kB)
Collecting sniffio>=1.1 (from anyio->httpx)
  Using cached sniffio-1.3.1-py3-none-any.whl.metadata (3.9 kB)
Using cached httpx-0.28.1-py3-none-any.whl (73 kB)
Downloading httpcore-1.0.9-py3-none-any.whl (78 kB)
Using cached uvicorn-0.34.2-py3-none-any.whl (62 kB)
Using cached click-8.1.8-py3-none-any.whl (98 kB)
Using cached h11-0.16.0-py3-none-any.whl (37 kB)
Using cached anyio-4.9.0-py3-none-any.whl (100 kB)
Using cached idna-3.10-py3-none-any.whl (70 kB)
Using cached certifi-2025.1.31-py3-none-any.whl (166 kB)
Using cached sniffio-1.3.1-py3-none-any.whl (10 kB)
Installing collected packages: sniffio, idna, h11, click, certifi, uvicorn, httpcore, anyio, httpx
Successfully installed anyio-4.9.0 certifi-2025.1.31 click-8.1.8 h11-0.16.0 httpcore-1.0.9 httpx-0.28.1 idna-3.10 sniffio-1.3.1 uvicorn-0.34.2

Update httpcore to 1.0.9

Navigation Menu

Repository navigation

h11 dependency pinning causes weird cycle #1007

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

h11 dependency pinning causes weird cycle #1007

Description

Activity

rstmsn commented on Apr 24, 2025

lukehsiao commented on Apr 24, 2025

ljdelavega commented on Apr 24, 2025

mlauchli commented on Apr 24, 2025

Zaczero commented on Apr 24, 2025

lovelydinosaur commented on Apr 24, 2025

jgutilla commented on Apr 24, 2025

lovelydinosaur commented on Apr 24, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions