Security: require httpx2 >= 2.12.0
vgi-python now requires httpx2>=2.12.0 (up from >=2.9.1) and vgi-rpc>=0.47.2, which carries the same floor. httpx2 is the client for HTTP workers and the Cloudflare Durable Objects storage backend. Fixes three advisories:
- GHSA-8xx6-hgc6-gc2m (high): streaming response decompression did not bound peak memory, so a hostile HTTP worker or storage endpoint could exhaust client memory with a small compressed response.
- GHSA-h4x7-gw46-3wm6 (medium): multipart part header injection.
- GHSA-pf96-p4fj-6566 (medium): conflicting Content-Length and Transfer-Encoding headers could be auto-generated.
Explainer video
The README now links a 2½-minute overview of VGI: watch it on YouTube.