build(deps-dev): bump httpcore2 from 2.9.1 to 2.12.0 in /services/account_unification

[dependabot]

Bumps httpcore2 from 2.9.1 to 2.12.0.

Release notes

Sourced from httpcore2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• 6f38ddf Cache sniffio availability instead of importing it on every call (#1132)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔴 Dev requirements pin diverges from the lockfile

httpcore2 is bumped to 2.12.0 in the generated dev requirements, but uv.lock still resolves 2.9.1 and httpx2 stays at 2.9.1 in both the requirements file and pyproject.toml. The four dependency surfaces are meant to come from one resolver run (doctoring record); editing only this one makes them disagree, so uv lock --check fails and uv sync --locked still installs 2.9.1.

Prompt for agents

The bump of httpcore2 to 2.12.0 was applied only to the generated services/account_unification/requirements-dev.txt. The other dependency surfaces are inconsistent: services/account_unification/uv.lock still pins httpcore2==2.9.1 (see the [[package]] entry for httpcore2), and httpx2 remains ==2.9.1 in both requirements-dev.txt and pyproject.toml. docs/doctoring/2026-08-dependency-and-packaging-refresh.md states pyproject.toml, uv.lock, requirements.lock, and requirements-dev.txt are regenerated from one resolver execution and must not be edited independently, and CI runs `uv lock --check` and `uv sync --locked --extra dev`. Regenerate all dependency surfaces from a single uv resolver run so uv.lock (and any httpx2 constraint) is consistent with requirements-dev.txt, rather than hand-editing the generated dev requirements file.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Exact-head admission audit: 5dc82798832c60d8059d77138b85e5db2398b4cf (base main@2e00633e5485905ecc608708eb9f57e2779ea5e2, 1 ahead / 0 behind).

현재 blocker:

• unresolved review threads: 1

유효 commit·diff·review evidence를 보존한 채 Draft/Proposed로 교정합니다. Base 이동이나 queue 대기만으로 Close하지 않으며 Force Push·synthetic status/approval·manual rerun·bypass를 사용하지 않습니다. Blocker 수리 후 새 exact head에서 Checks와 review admission을 다시 받아야 합니다.