fix(deps): vuln httpx2 (minor → 2.13.0) [pyproject.toml]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• pyproject.toml (uv)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
httpx2	2.9.1	2.13.0	minor	Direct	7 HIGH, 9 MEDIUM

---

Security Details

🚨 Critical & High Severity (7 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
httpx2	PYSEC-2026-3846	high	HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)	2.9.1	2.12.0	-
httpx2	CVE-2026-84381	HIGH	HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies	2.9.1	-	-
httpx2	PYSEC-2026-3844	HIGH	HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies	2.9.1	-	-
httpx2	PYSEC-2026-3845	HIGH	HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies	2.9.1	2.10.0	-
httpx2	GHSA-7mj9-2mp8-4m2p	HIGH	HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies	2.9.1	2.10.0	-
httpx2	CVE-2026-84382	high	HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)	2.9.1	-	-
httpx2	GHSA-8xx6-hgc6-gc2m	HIGH	HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)	2.9.1	2.12.0	-

ℹ️ Other Vulnerabilities (9)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
httpx2	GHSA-pf96-p4fj-6566	MODERATE	HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated	2.9.1	2.11.0	-
httpx2	CVE-2026-84378	MODERATE	HTTPX2: Quadratic SSE line buffering can cause CPU denial of service	2.9.1	-	-
httpx2	PYSEC-2026-3847	MODERATE	HTTPX2: Quadratic SSE line buffering can cause CPU denial of service	2.9.1	2.10.0	-
httpx2	GHSA-f2fp-rgf2-35cp	MODERATE	HTTPX2: Quadratic SSE line buffering can cause CPU denial of service	2.9.1	2.10.0	-
httpx2	PYSEC-2026-3849	MODERATE	HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated	2.9.1	2.11.0	-
httpx2	CVE-2026-84380	MODERATE	HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated	2.9.1	-	-
httpx2	GHSA-h4x7-gw46-3wm6	MODERATE	HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers	2.9.1	2.11.0	-
httpx2	CVE-2026-84379	MODERATE	HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers	2.9.1	-	-
httpx2	PYSEC-2026-3848	MODERATE	HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers	2.9.1	2.11.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 70.58% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f337393 | Docs | View more details | Give us feedback!}