Visitar URL original
Use `httpx2-jsfetch` on Emscripten by hoodmane · Pull Request #1119 · pydantic/httpx2 · GitHub
Skip to content

Use httpx2-jsfetch on Emscripten - #1119

Merged
Kludex merged 16 commits into
pydantic:mainfrom
hoodmane:use-httpx2-jsfetch
Aug 8, 2026
Merged

Use httpx2-jsfetch on Emscripten#1119
Kludex merged 16 commits into
pydantic:mainfrom
hoodmane:use-httpx2-jsfetch

Conversation

@hoodmane

@hoodmane hoodmane commented Aug 7, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Use httpx2-jsfetch to provide JavascriptFetchTransport in Emscripten Python.

Checklist

  • I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.

Tested in httpx2-jsfetch as requested.

Review in cubic

@codspeed

codspeed Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 16 untouched benchmarks
⏩ 7 skipped benchmarks1

Comparing hoodmane:use-httpx2-jsfetch (1848cd2) with main (454b8b2)

Open in CodSpeed

Footnotes

  1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@hoodmane hoodmane mentioned this pull request Aug 7, 2026
Closed
3 tasks done
cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Aug 7, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

Comment thread docs/overrides/pyodide.html
Comment thread docs/overrides/pyodide.html Outdated
Comment thread docs/overrides/pyodide.html
cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Aug 7, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 5 files (changes from recent commits).

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

Comment thread src/httpx2/pyproject.toml
Comment thread src/httpx2/CHANGELOG.md
veria-ai[bot]
veria-ai Bot reviewed Aug 7, 2026
View reviewed changes
Comment thread docs/overrides/pyodide.html Outdated
{% block scripts %}
{{ super() }}
<script src="https://cdn.jsdelivr.net/npm/ace-builds@1.36.2/src-noconflict/ace.min.js"></script>
<script src="https://cdn.jsdelivr.net/pyodide/v0.29.3/full/pyodide.js"></script>

@veria-ai veria-ai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low: Third-party scripts lack integrity checks

Both Ace and Pyodide execute directly from jsDelivr without integrity metadata. An attacker who alters either CDN response can run JavaScript under the documentation site's origin; self-host these assets or add verified SRI hashes with crossorigin="anonymous".

@veria-ai

veria-ai Bot commented Aug 7, 2026

Copy link
Copy Markdown

PR overview

This pull request updates the Pyodide documentation page to use httpx2_jsfetch in Emscripten and includes the browser-side Ace and Pyodide setup used by the page.

One security issue remains open: third-party JavaScript is loaded from jsDelivr without integrity verification. Exploitation depends on a compromised or altered CDN response, but could allow JavaScript to execute under the documentation site's origin.

Open issues (1)

Fixed/addressed: 0 · PR risk: 4/10

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Aug 7, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 2 files (changes from recent commits).

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

Comment thread src/httpx2/httpx2/_transports/__init__.py Outdated
Kludex
Kludex requested changes Aug 7, 2026
View reviewed changes
Comment thread src/httpx2/pyproject.toml
@Kludex Kludex changed the title Use httpx2_jsfetch on Emscripten Use httpx2-jsfetch on Emscripten Aug 7, 2026
@Kludex
Kludex enabled auto-merge (squash) August 8, 2026 09:32
@Kludex
Kludex merged commit dec24ad into pydantic:main Aug 8, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments
@veria-ai veria-ai[bot] veria-ai[bot] left review comments
@Kludex Kludex Kludex approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hoodmane @Kludex