Moving Our Python Engine to httpx2: the Tracer and the Trust Store Were the Hard Part

Mergify migrated its Python engine’s outbound HTTP clients from the unmaintained httpx package to httpx2 to reduce future security and maintenance risks, but delayed the change until Datadog’s ddtrace added native support that preserved per-host monitoring spans. Although the code port largely consisted of import changes across 132 files, the team added linting to prevent accidental use of the old client, which could bypass shared retries and TLS settings. A central challenge was maintaining consistent certificate trust behavior: because httpx2 defaults to the operating system trust store while other engine components use certifi plus optional private CA bundles, Mergify explicitly configured httpx2 to use the same shared TLS context as Postgres, S3, Git, and other services. The investigation also found that Google’s genai SDK was using aiohttp rather than its nominal httpx client for Vertex AI requests, leading the team to inject managed httpx2 clients for consistent TLS configuration and better tracing, while retaining the SDK’s transport for mutual-TLS deployments. The engine now uses httpx2 for its own traffic and has improved observability and certificate consistency, though the legacy httpx package remains in its lockfile because dependencies such as google-genai and the respx test-mocking library still require it.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.