[HTTPXodus] migrate httpx to httpx2 with dual import (closes #1856)

[ProgrammerPlus1998]

Closes #1856

🏷️ Part of HTTPXodus — a community effort to help major Python projects plan their path off the stalled httpx stable line onto httpx2, the actively maintained fork by Pydantic Services. One coordinated PR per project — no drive-by changes.

What this PR does

This is the implementation of the migration discussed in #1856. It switches langfuse/langfuse-python's HTTP transport from httpx to httpx2 via dual import: on Python ≥ 3.10 the runtime binds to httpx2; on 3.9 (which langfuse still supports and httpx2 cannot run on) the import falls back to httpx. requires-python is not changed.

Diff summary

12 files, +45 / −11 (commit b869dbd):

File	Change
pyproject.toml	Added httpx2>=2.12.0; python_version >= "3.10" next to the existing httpx>=0.15.4,<1.0
11 source files in langfuse/	All import httpx → dual import (Option A) — see MIGRATION.md for full list

The public API surface is preserved because the dual-import alias keeps the name httpx everywhere. No call-site changes are needed beyond the import.

Test results

Validated in a fresh venv on Python 3.12 with both httpx and httpx2 installed (SUT resolves to httpx2):

• pip install -e ".[dev]" resolves to both
• python -c "import langfuse; ..." smoke test passes
• Targeted test run: 431 passed, 1 failed (test_prompt - pre-existing on stock main, reproduced on clean checkout before changes), 18 errors in tests requiring optional deps (langchain) not installed in this dev env

Notes for reviewer

• The httpx.Client / httpx.AsyncClient / httpx.Response.raise_for_status() types used in langfuse exist in both httpx and httpx2 with identical signatures, so no call-site changes are needed beyond the import.
• ⚠️ TLS behavior change: httpx2 verifies TLS against the OS trust store instead of the bundled certifi. Langfuse deployments that rely on a custom CA bundle may need SSL_CERT_FILE / SSL_CERT_DIR after the switch. Worth a line in the changelog.
• Dual import is the right call here: langfuse-python's requires-python floor is below httpx2's >=3.10 floor, and dropping 3.9 would be out of scope. If langfuse-python later raises the floor, this can be replaced with a hard import httpx2 as httpx in a follow-up.

Happy to revise per review — and equally happy to close this PR if the maintainers would rather wait for httpx 1.0 stable. 🙏

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Lockfile Is Stale

This adds httpx2 without regenerating uv.lock. The locked langfuse dependency metadata still contains only httpx, while every CI job installs dependencies with uv sync --locked. As a result, CI fails during dependency installation before linting, type checking, or tests can run. Please regenerate and commit the lockfile.

Prompt To Fix With AI

This is a comment left during a code review.
Path: pyproject.toml
Line: 12

Comment:
**Lockfile Is Stale**

This adds `httpx2` without regenerating `uv.lock`. The locked `langfuse` dependency metadata still contains only `httpx`, while every CI job installs dependencies with `uv sync --locked`. As a result, CI fails during dependency installation before linting, type checking, or tests can run. Please regenerate and commit the lockfile.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.