Version 2.3.0 (#1006)

Kludex · web-flow · commit 04f3804dda82 · 2026-06-01T15:12:27.000+02:00
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
@@ -30,7 +30,7 @@ jobs:
         shell: bash
 
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@3194d9a39c4d46684cb44bf7207fc56626aad8fd # v4
+        uses: CodSpeedHQ/action@9d332c4d90b43981c3e55ae8e38e68709996240f # v4.17.0
         with:
           mode: instrumentation
           run: uv run pytest tests/test_benchmark.py --codspeed
diff --git a/README.md b/README.md
@@ -117,7 +117,7 @@ The HTTPX2 project relies on these excellent libraries:
 * `httpcore2` - The underlying transport implementation for `httpx2`.
   * `h11` - HTTP/1.1 support.
 * `anyio` - Structured concurrency primitives, used to support both `asyncio` and `trio`.
-* `certifi` - SSL certificates.
+* `truststore` - SSL verification using the operating system's trust store.
 * `idna` - Internationalized domain name support.
 
 As well as these optional installs:
@@ -127,7 +127,7 @@ As well as these optional installs:
 * `rich` - Rich terminal support. *(Optional, with `httpx2[cli]`)*
 * `click` - Command line client support. *(Optional, with `httpx2[cli]`)*
 * `brotli` or `brotlicffi` - Decoding for "brotli" compressed responses. *(Optional, with `httpx2[brotli]`)*
-* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported natively via the stdlib [`compression.zstd`](https://docs.python.org/3/library/compression.zstd.html) module.)*
+* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported via the stdlib [`compression.zstd`](https://docs.python.org/3/library/compression.zstd.html) module when it is available; the `httpx2[zstd]` extra installs nothing there, so decoding falls back to `zstandard` only on 3.13 and below.)*
 
 A huge amount of credit is due to `requests` for the API layout that
 much of this work follows, as well as to `urllib3` for plenty of design
diff --git a/docs/advanced/ssl.md b/docs/advanced/ssl.md
@@ -20,29 +20,29 @@ You can disable SSL verification completely and allow insecure requests...
 
 If you're using a `Client()` instance you should pass any `verify=<...>` configuration when instantiating the client.
 
-By default the [certifi CA bundle](https://certifiio.readthedocs.io/en/latest/) is used for SSL verification.
+By default the operating system's trust store is used for SSL verification, via [the `truststore` package](https://truststore.readthedocs.io/).
 
 For more complex configurations you can pass an [SSL Context](https://docs.python.org/3/library/ssl.html) instance...
 
 ```python
-import certifi
-import httpx2
 import ssl
+import truststore
+import httpx2
 
 # This SSL context is equivalent to the default `verify=True`.
-ctx = ssl.create_default_context(cafile=certifi.where())
+ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
 client = httpx2.Client(verify=ctx)
 ```
 
-Using [the `truststore` package](https://truststore.readthedocs.io/) to support system certificate stores...
+Using [the `certifi` CA bundle](https://certifiio.readthedocs.io/en/latest/) instead of the system trust store...
 
 ```python
-import ssl
-import truststore
+import certifi
 import httpx2
+import ssl
 
-# Use system certificate stores.
-ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+# Use the certifi CA bundle.
+ctx = ssl.create_default_context(cafile=certifi.where())
 client = httpx2.Client(verify=ctx)
 ```
 
diff --git a/docs/index.md b/docs/index.md
@@ -108,7 +108,7 @@ The HTTPX2 project relies on these excellent libraries:
 * `httpcore2` - The underlying transport implementation for `httpx2`.
   * `h11` - HTTP/1.1 support.
 * `anyio` - Structured concurrency primitives, used to support both `asyncio` and `trio`.
-* `certifi` - SSL certificates.
+* `truststore` - SSL verification using the operating system's trust store.
 * `idna` - Internationalized domain name support.
 
 As well as these optional installs:
@@ -118,7 +118,7 @@ As well as these optional installs:
 * `rich` - Rich terminal support. *(Optional, with `httpx2[cli]`)*
 * `click` - Command line client support. *(Optional, with `httpx2[cli]`)*
 * `brotli` or `brotlicffi` - Decoding for "brotli" compressed responses. *(Optional, with `httpx2[brotli]`)*
-* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported natively via the stdlib [`compression.zstd`][] module.)*
+* `zstandard` - Decoding for "zstd" compressed responses on Python 3.13 and below. *(Optional, with `httpx2[zstd]`. On Python 3.14+, `zstd` is supported via the stdlib [`compression.zstd`][] module when it is available; the `httpx2[zstd]` extra installs nothing there, so decoding falls back to `zstandard` only on 3.13 and below.)*
 
 A huge amount of credit is due to `requests` for the API layout that
 much of this work follows, as well as to `urllib3` for plenty of design
diff --git a/docs/quickstart.md b/docs/quickstart.md
@@ -101,8 +101,8 @@ b'<!doctype html>\n<html>\n<head>\n<title>Example Domain</title>...'
 Any `gzip` and `deflate` HTTP response encodings will automatically
 be decoded for you. If `brotlipy` is installed, then the `brotli` response
 encoding will be supported. The `zstd` response encoding is supported
-natively on Python 3.14+ via the stdlib [`compression.zstd`][]
-module; on Python 3.13 and below it requires the `zstandard` package.
+on Python 3.14+ via the stdlib [`compression.zstd`][] module when it is
+available; on Python 3.13 and below it requires the `zstandard` package.
 
 For example, to create an image from binary data returned by a request, you can use the following code:
 
diff --git a/src/httpcore2/CHANGELOG.md b/src/httpcore2/CHANGELOG.md
@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.3.0 (June 1st, 2026)
+
+### Changed
+
+* Use `truststore` instead of `certifi` for default SSL verification, loading the operating system's trust store. ([#1002](https://github.com/pydantic/httpx2/pull/1002))
+* Rewrite `_assign_requests_to_connections` as a single-pass loop. ([#974](https://github.com/pydantic/httpx2/pull/974))
+* Use `anyio`'s `fast_acquire` for `Lock` and `Semaphore`. ([#970](https://github.com/pydantic/httpx2/pull/970))
+* Use `memoryview` in `write()` to avoid copies. ([#954](https://github.com/pydantic/httpx2/pull/954))
+
 ## 2.2.0 (May 16th, 2026)
 
 No changes since `2.1.0`. Version bumped to stay in lockstep with `httpx2`.
diff --git a/src/httpcore2/README.md b/src/httpcore2/README.md
@@ -85,7 +85,7 @@ The motivation for `httpcore` is:
 The `httpcore` package has the following dependencies...
 
 * `h11`
-* `certifi`
+* `truststore`
 
 And the following optional extras...
 
diff --git a/src/httpx2/CHANGELOG.md b/src/httpx2/CHANGELOG.md
@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## 2.3.0 (June 1st, 2026)
+
+### Changed
+
+* Use `truststore` instead of `certifi` for default SSL verification, loading the operating system's trust store. ([#209](https://github.com/pydantic/httpx2/pull/209))
+
+### Fixed
+
+* Raise when `verify` is a string path and a client-side `cert` is also provided to `create_ssl_context`. ([#990](https://github.com/pydantic/httpx2/pull/990))
+* Allow a `default_encoding` callable to return `None`. ([#951](https://github.com/pydantic/httpx2/pull/951))
+* Make the `zstd` import optional on Python 3.14. ([#1000](https://github.com/pydantic/httpx2/pull/1000))
+* Store elapsed time on the stream wrapper to avoid reference cycles. ([#948](https://github.com/pydantic/httpx2/pull/948))
+
 ## 2.2.0 (May 16th, 2026)
 
 ### Fixed
diff --git a/uv.lock b/uv.lock
