chore(deps): bump httpx2/httpcore2 lockstep to 2.12.0 in /reviewer

[dependabot]

Reviewer dependency repair

httpx2 and httpcore2 are advanced in lockstep to 2.12.0 and an isolated editable-install + pip check regression prevents this reviewer dependency boundary from returning to an internally inconsistent state.

The lane has already ordinarily/non-force reconverged to current protected main@97c1562b896ddb4236d3e223693c56bfb119ce5e; current exact head is 4ee78bfbd859d83da3c6d88d1ccceda111903c33. Fresh reviewer-ci 34305569464 is terminal SUCCESS, patch-validator-image 34305569439 is in progress, and application CI 34305569492 plus required Security Scan 34305569472 are queued. Predecessor gate conclusions do not transfer to this head.

The prior exact 2cc84d0e993eb7bd89cfb82814e66f0764e66a05 provided a useful reality RED: application CI/reviewer-ci/required Security succeeded, but patch-validator-image run 34298437106, job 102300006922, failed after exact image build, static runtime identity, metadata inspection, and no-network/read-only/non-root smoke all succeeded. Generate CycloneDX SBOM and vulnerability receipt found CVE-2026-84373 in protected-source vitest@4.1.9 and @vitest/mocker@4.1.9, fixed in 4.1.11. The vulnerability gate is correctly fail-closed.

Issue #568 owns that Noema Node build/test dependency foundation defect; Draft #569 is its current implementation lane from protected main@97c1562.... Keep this PR Draft. #569 must normally integrate a coherent non-vulnerable Vitest lock and protected-main image evidence first; then reconverge this lane again if protected main moved, rerun all four exact-head gates, and only then reconsider merge/succession. #563 remains open until complete succession is independently proved; do not close it merely because this candidate has a newer version.

[seonghobae]

Valid dependency-lock finding on exact a4d877f15375f69d48b7e75b5a95b069096c302d: this PR changes only httpx2 from 2.5.0 to 2.12.0 in the generated Python 3.11 hash lock, but leaves httpcore2==2.5.0. Upstream httpx2 v2.12.0 package metadata declares httpcore2==2.12.0 on non-Emscripten platforms, so the flattened --no-deps environment is internally inconsistent even though current reviewer-ci can install it. The existing isolated-install regression proves imports but never runs pip check, so this exact mismatch can pass CI.

Repair path: first add a regression that runs pip check in the isolated editable environment and observe hosted RED on this exact dependency generation. Then regenerate/repair the lock so httpcore2 stays in the exact version required by httpx2, using the release hashes rather than weakening --require-hashes or dropping --no-deps. This is a lock-integrity finding, not a reason to close the Dependabot PR.

[seonghobae]

Hosted reviewer-ci RED on exact dd78c4bce4ca35e994b0cfa5e72d30c9454981c5 was causal, not flaky: test_clean_editable_install_imports_reviewer_and_canonical_core ran an isolated editable install and pip check rejected httpx2 2.12.0 with stale httpcore2 2.5.0 (httpx2 2.12.0 requires httpcore2==2.12.0 outside Emscripten). The regression itself is retained. Minimal repair 25ccd849237961416cc6975990dcd9ca34ef78b0 changes only the generated hash lock entry to httpcore2==2.12.0 with the two PyPI-published SHA-256 artifacts; no test/gate weakening and no force update. Fresh exact-head gates are now authoritative; predecessor successes are not.

[seonghobae]

현재 maintenance delta 자체는 유효합니다. 초기 Dependabot exact는 httpx2==2.12.0만 올려 isolated editable install의 dependency integrity를 보장하지 못했고, test-only dd78c4bce4ca35e994b0cfa5e72d30c9454981c5에서 pip check를 추가한 뒤 reviewer-ci 34287559303가 hosted RED가 되었습니다. Current exact 25ccd849237961416cc6975990dcd9ca34ef78b0는 httpcore2==2.12.0을 lockstep으로 맞추고 그 hostile dependency-integrity check를 보존합니다. 현재 application CI/reviewer-ci/required Security는 SUCCESS이고 patch-validator-image만 IN_PROGRESS입니다.

다만 protected main@36e5cf957ee20a8bb3e19ff50fea6c97771d2ba1의 active source prerequisite는 Draft #560입니다. #562를 먼저 병합하면 #560의 current live-base/exact-head evidence를 불필요하게 무효화하고 restack churn을 만듭니다. 그래서 이 PR을 Draft로 전환했습니다. #560 정상 integration 뒤 ordinary/non-force reconvergence하고, unchanged restacked exact의 required gates를 다시 확인한 뒤에만 ready/merge 대상으로 승격합니다. #563의 httpcore2==2.10.0 단독 bump는 이 lane과 중복되므로 #562가 검증·통합되면 유효 delta를 상위 lockstep version으로 완전 승계하는 successor가 됩니다.

[seonghobae]

Noema single-writer coordination: #560 has now normally integrated as protected main@e3aa77c3f678336c548440f355f988345b0ba976. This lane was ordinary/non-force reconverged from prior exact 25ccd849237961416cc6975990dcd9ca34ef78b0 to 2cc84d0e993eb7bd89cfb82814e66f0764e66a05, preserving the lockstep httpx2==2.12.0 / httpcore2==2.12.0 hash delta and the isolated editable-install pip check regression. Predecessor GREEN does not transfer; keep Draft until this exact receives fresh CI/reviewer/Security/image terminal SUCCESS and clean review authority.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T03:36:44.053238Z	d93aabf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.