Replace httpx dependency with httpx2

[ricgiland]

The httpx library is no longer being maintained and the repo owner has prevented new pull requests so that it is essentially archived. As such, it likely has unaddressed security vulnerabilities and other issues. Fortunately, the people over at Pydantic have decided to fork the project into httpx2 and maintain it themselves. httpx2 uses the same API and can be a drop-in replacement for httpx. Suggest changing the dependency to httpx2

[MiniCodeMonkey]

Thanks for flagging this — the premise checks out. httpx hasn't shipped a release since 0.28.1 in December 2024, and httpx2 under the Pydantic org is a real, actively maintained continuation.

That said, I'm going to hold off for now:

• httpx2's first PyPI release was 2026-08-18, so it's about ten days old. I'd like to see it soak for a while before making it a hard requirement for everyone installing this library.
• It's API-compatible but not import-compatible — the package is httpx2, so this is a breaking change for anyone catching httpx.HTTPError or httpx.TimeoutException around our calls, or passing in their own httpx.Client. That makes it a major-version change, not a dependency bump.
• There's no outstanding httpx CVE forcing our hand today, so the cost/benefit doesn't favor moving immediately.

Leaving this open as a tracking issue. The plan is to revisit at the next major version, and sooner if a security issue lands in httpx that won't get patched upstream.