[v1.x] build: restrict httpx to <1.0.0 - #2559
Conversation
Sorry, something went wrong.
Backport of #2345 to the v1.x release branch. httpx publishes 1.0.devN pre-releases on PyPI which are a ground-up rewrite with an incompatible API (no AsyncClient, Auth, Timeout, or TransportError). With the previous unbounded `httpx>=0.27.1` constraint, `pip install --pre` of any package depending on mcp resolves httpx 1.0.dev3, which makes `import mcp` fail at `httpx_sse._exceptions` with: AttributeError: module 'httpx' has no attribute 'TransportError' Pin to `<1.0.0` until we explicitly add httpx 1.x support. Reported-by: SyncTekLLC Github-Issue: #2543
There was a problem hiding this comment.
LGTM — straightforward backport adding an upper bound on httpx.
Extended reasoning...Overview
This PR backports #2345 to the v1.x release branch. It changes a single dependency specifier in pyproject.toml from httpx>=0.27.1 to httpx>=0.27.1,<1.0.0, with the corresponding requires-dist metadata line in uv.lock. No source code, tests, or resolved package versions change — the lockfile already resolved httpx 0.28.1, so only the constraint metadata is updated.
Security risks
None. This narrows an existing dependency range to exclude known-incompatible httpx 1.0 dev pre-releases. It does not add new dependencies, loosen any constraints, or touch auth/crypto/permission code paths.
Level of scrutiny
Low. This is a one-line, mechanical version-bound change that has already been reviewed and merged on main (#2345). The motivation is well-documented with a reproducible failure case (AttributeError: module 'httpx' has no attribute 'TransportError' under pip install --pre), and the fix is the standard remedy: cap below the breaking major version. The PR description also explains why <2.0 and a speculative httpx-sse cap were rejected.
Other factors
No bugs were flagged by the bug-hunting system, there are no outstanding reviewer comments, and the change is non-breaking for all users on stable httpx (0.28.x remains the latest stable). Given the trivial scope and that it mirrors an already-landed change on main, this is safe to approve without further human review.
Sorry, something went wrong.
Backport of #2345 to the v1.x release branch. Closes #2543.
Motivation and Context
httpx publishes 1.0.dev1/1.0.dev2/1.0.dev3 pre-releases on PyPI. These are a ground-up rewrite with an incompatible public API — no AsyncClient, Auth, Timeout, BasicAuth, codes, or the TransportError/StreamError exception hierarchy.
The current v1.x constraint is unbounded (httpx>=0.27.1), so when a downstream package is installed with pip install --pre (common for alpha/beta libraries built on mcp), pip resolves httpx 1.0.dev3 and import mcp fails immediately:
File ".../httpx_sse/_exceptions.py", line 4, in <module> class SSEError(httpx.TransportError): ^^^^^^^^^^^^^^^^^^^^ AttributeError: module 'httpx' has no attribute 'TransportError'This was already fixed on main in #2345 but never backported, so all published 1.x releases (including 1.27.0) are affected.
How Has This Been Tested?
Reproduced in a fresh venv:
Confirmed that constraining to httpx<1.0 (resolves 0.28.1) restores all of import mcp, stdio_client, sse_client, and streamablehttp_client.
Breaking Changes
None. httpx 0.28.1 remains the latest stable; this only excludes the incompatible 1.0 dev pre-releases.
Types of changes
Checklist
Additional context
Re the alternatives raised in #2543:
AI Disclaimer