Ensure compatibility with httpx>=0.28

Closes: #1099277

debian/changelog

+python-urllib3 (2.3.0-2) UNRELEASED; urgency=medium
+
+  * Ensure compatibility with httpx>=0.28 (closes: #1099277).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 12 Mar 2025 11:16:20 +0000
+
 python-urllib3 (2.3.0-1) unstable; urgency=medium
 
   * Team upload.

debian/patches/httpx-0.28.patch

+From: Carl Smedstad <carl.smedstad@protonmail.com>
+Date: Mon, 30 Dec 2024 16:04:28 +0100
+Subject: Ensure compatibility with httpx>=0.28
+
+Version 0.28 of httpx removed support for supplying a path (of string
+type) to verify, only a bool or an SSL context is now supported.
+See: https://github.com/encode/httpx/releases/tag/0.28.0
+
+Running the test suite with httpx 0.28 will break the dummy server and a
+such number of tests in test/with_dummyserver/.
+
+To resolve this, create an SSL context in the ProxyApp init function and
+supply that to AsyncClient, instead of a raw string. This change is
+backwards compatible, i.e. the test suite will still succeed against
+the currently pinned version of httpx, 0.25.2.
+
+Origin: https://github.com/urllib3/urllib3/pull/3545
+Bug-Debian: https://bugs.debian.org/1099277
+Last-Update: 2025-03-12
+---
+ dummyserver/asgi_proxy.py | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/dummyserver/asgi_proxy.py b/dummyserver/asgi_proxy.py
+index 107c5e0..00c0a1b 100755
+--- a/dummyserver/asgi_proxy.py
++++ b/dummyserver/asgi_proxy.py
+@@ -1,5 +1,6 @@
+ from __future__ import annotations
+ 
++import ssl
+ import typing
+ 
+ import httpx
+@@ -29,7 +30,10 @@ async def _read_body(receive: ASGIReceiveCallable) -> bytes:
+ 
+ class ProxyApp:
+     def __init__(self, upstream_ca_certs: str | None = None):
+-        self.upstream_ca_certs = upstream_ca_certs
++        self.ssl_context = None
++        if upstream_ca_certs:
++            self.ssl_context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
++            self.ssl_context.load_verify_locations(cafile=upstream_ca_certs)
+ 
+     async def __call__(
+         self, scope: Scope, receive: ASGIReceiveCallable, send: ASGISendCallable
+@@ -48,7 +52,7 @@ class ProxyApp:
+         receive: ASGIReceiveCallable,
+         send: ASGISendCallable,
+     ) -> None:
+-        async with httpx.AsyncClient(verify=self.upstream_ca_certs or True) as client:
++        async with httpx.AsyncClient(verify=self.ssl_context or True) as client:
+             client_response = await client.request(
+                 method=scope["method"],
+                 url=scope["path"],

debian/patches/series

 test_http2_probe_blocked_per_thread-requires_network.patch
 openssl-3.4.0.patch
+httpx-0.28.patch