October 2026 Summaries

Mergify migrated its Python engine’s outbound HTTP clients from the unmaintained httpx package to httpx2 to reduce future security and maintenance risks, but delayed the change until Datadog’s ddtrace added native support that preserved per-host monitoring spans. Although the code port largely consisted of import changes across 132 files, the team added linting to prevent accidental use of the old client, which could bypass shared retries and TLS settings. A central challenge was maintaining consistent certificate trust behavior: because httpx2 defaults to the operating system trust store while other engine components use certifi plus optional private CA bundles, Mergify explicitly configured httpx2 to use the same shared TLS context as Postgres, S3, Git, and other services. The investigation also found that Google’s genai SDK was using aiohttp rather than its nominal httpx client for Vertex AI requests, leading the team to inject managed httpx2 clients for consistent TLS configuration and better tracing, while retaining the SDK’s transport for mutual-TLS deployments. The engine now uses httpx2 for its own traffic and has improved observability and certificate consistency, though the legacy httpx package remains in its lockfile because dependencies such as google-genai and the respx test-mocking library still require it.