Fix no_proxy to support IPV6 CIDR format - #3741
Open
p3ck wants to merge 9 commits into
Open
Conversation
no_proxy=fe11::/16 python -c 'import httpx; c = httpx.Client()'
Closes: #3221
|
Hi, thanks for this PR. I found this httpx issue 6 months ago and wanted to address it since then. Your change only makes httpx not crash when an IPv6 range is in no_proxy but it is not properly handled. I build upon your work and addressed the issue with extending
EDIT: PR is here: p3ck#1 It is also not yet properly tested as I didn't manage to run all tests. I only managed to run tests I modified. |
p3ck
force-pushed
the
issue_3221
branch
3 times, most recently
from
February 25, 2026 02:17
da3dda0 to
71c6448
Compare
Author
|
@ofilip Thank you for the great work. Can you check the changes I made to get it to pass linting and testing? Thanks |
I reviewed your commits and everything seems in place. Thx a lot for review, tests and improvements. |
lennondotw
added a commit
to lennondotw/ai-goofish-monitor
that referenced
this pull request
Apr 13, 2026
httpx <= 0.28.1 wraps NO_PROXY IPv6 entries including the CIDR mask inside brackets (e.g. `[::1/128]`), which its URL parser rejects as `Invalid port: ':1'`. This is triggered by OrbStack/Docker Desktop injecting `NO_PROXY=localhost,127.0.0.0/8,::1/128` into containers. Strip the `/prefix` from IPv6 CIDR entries before initializing AsyncOpenAI. This is safe because httpx doesn't support CIDR range matching anyway — it only does exact-host comparison. Upstream fix: encode/httpx#3741 (pending merge)
This was referenced Apr 29, 2026
mbeijen
added a commit
to mbeijen/httpx2
that referenced
this pull request
May 19, 2026
Setting no_proxy patterns matched by hostname string comparison. So 192.168.0.1 would not match all://192.168.0.0/16. Add IPNetPattern, backed by ipaddress.ip_network, and a build_url_pattern() factory that returns IPNetPattern for all:// patterns containing a slash and WildcardURLPattern otherwise. Introduce a Pattern protocol so Client and AsyncClient can hold either kind in their _mounts dict. URLPattern is kept as a backward-compatible alias for WildcardURLPattern. Together with pydantic#967 will close - pydantic#829 - pydantic#899 Ported from encode/httpx#3741. Co-Authored-By: Ondrej Filip <ondrej.filip@firma.seznam.cz> Co-Authored-By: Bill Peck <bpeck@redhat.com>
mbeijen
added a commit
to mbeijen/httpx2
that referenced
this pull request
May 24, 2026
Setting no_proxy patterns matched by hostname string comparison. So 192.168.0.1 would not match all://192.168.0.0/16. Add IPNetPattern, backed by ipaddress.ip_network, and a build_url_pattern() factory that returns IPNetPattern for all:// patterns containing a slash and WildcardURLPattern otherwise. Introduce a Pattern protocol so Client and AsyncClient can hold either kind in their _mounts dict. URLPattern is kept as a backward-compatible alias for WildcardURLPattern. Together with pydantic#967 will close - pydantic#829 - pydantic#899 Ported from encode/httpx#3741. Co-Authored-By: Ondrej Filip <ondrej.filip@firma.seznam.cz> Co-Authored-By: Bill Peck <bpeck@redhat.com>
workofart
added a commit
to workofart/harness-training
that referenced
this pull request
Jun 5, 2026
OrbStack injects a no_proxy/NO_PROXY into every container that lists its internal IPv6 ULA range (e.g. ::1, fd07:...::/64). httpx cannot parse a bare IPv6 entry in no_proxy -- it splits on ':' and reads the address bytes as a port, raising InvalidURL at Client construction -- so any task that builds an httpx client (notably huggingface_hub v1.x via datasets) crashes before its first request and silently falls back to the offline cache. The injection is regenerated on every OrbStack restart, so a host-side edit does not stick. Probe the container's injected no_proxy once and pin a cleaned override (IPv6 entries dropped, everything else preserved) into the exec env so every agent action and the in-container verifier inherit it. Best-effort and a no-op on hosts that inject no IPv6. Refs: encode/httpx#3741, psf/requests#6313, orbstack/orbstack#2449
workofart
added a commit
to workofart/harness-training
that referenced
this pull request
Jun 5, 2026
* verifier env: share context across exp, route through caches, restore apt-get shim Three container-environment fixes for the separate verifier, grouped: - share a built verifier context across runs of the same task to avoid rebuilding it every trial - route the separate-verifier container through the apt/pip caches with the same retry/timeout policy the agent container already gets, so a flaky mirror cannot stall the grade - restore the real apt-get on images that ship a hermetic no-op `apt-get` shim (keeping the real binary at apt-get.real), so offline verifies can install packages the image did not pre-bake (e.g. git-multibranch's `expect`). No-op on images without the shim. * env: strip httpx-breaking IPv6 entries from injected no_proxy OrbStack injects a no_proxy/NO_PROXY into every container that lists its internal IPv6 ULA range (e.g. ::1, fd07:...::/64). httpx cannot parse a bare IPv6 entry in no_proxy -- it splits on ':' and reads the address bytes as a port, raising InvalidURL at Client construction -- so any task that builds an httpx client (notably huggingface_hub v1.x via datasets) crashes before its first request and silently falls back to the offline cache. The injection is regenerated on every OrbStack restart, so a host-side edit does not stick. Probe the container's injected no_proxy once and pin a cleaned override (IPv6 entries dropped, everything else preserved) into the exec env so every agent action and the in-container verifier inherit it. Best-effort and a no-op on hosts that inject no IPv6. Refs: encode/httpx#3741, psf/requests#6313, orbstack/orbstack#2449 * supervisor: rerun a fresh baseline when the active one was interrupted A baseline run killed mid-flight leaves state.json pointing the active baseline at a record that never finalized as a keep. _ensure_baseline_at_head trusted that pointer on commit+panels alone, so on restart it short-circuited (returned False) and let the loop compare candidates against partial, ungraded evidence instead of measuring a fresh baseline. Discard a non-keep/unconcluded active baseline before the short-circuit: finalize the stale record as a crash and fall back to its parent keep (or seed fresh when there is none), so an interrupted baseline reliably restarts fresh. Adds a regression test reproducing the short-circuit. * config: document and expand the shared-verifier task list Annotate shared_verifier_task_names with the concrete reason each task needs to reuse the agent's live container instead of a fresh separate verifier (running daemon the verifier connects to / build artifacts or installed deps the agent produced / git over the agent's working tree / local-only image), and add the tasks that fail for those same reasons: git-multibranch, mailman, adaptive-rejection-sampler, git-leak-recovery, merge-diff-arc-agi-task, sanitize-git-repo, reshard-c4-data. * agent: raise default turn timeout to 3600s The previous 600s ceiling truncated long-running build/verify steps. Raise the default per-turn timeout so slow tasks are bounded by the trial budget rather than cut off mid-action. * exclude reshard-c4-data from the eval panel Drop reshard-c4-data from the train panel and add it to a contamination_risk excluded group instead of carrying a local task override for it. Running the task offline (to avoid re-downloading the held-out HF c4 shard every trial) would require an override that commits the canonical solution and verifier oracle into this repo, which the self-improvement loop could read. Excluding it removes that risk; the task also exceeds the train task_timeout_sec.
mbeijen
added a commit
to mbeijen/httpx2
that referenced
this pull request
Jun 13, 2026
Setting no_proxy patterns matched by hostname string comparison. So 192.168.0.1 would not match all://192.168.0.0/16. Add IPNetPattern, backed by ipaddress.ip_network, and a build_url_pattern() factory that returns IPNetPattern for all:// patterns containing a slash and WildcardURLPattern otherwise. Introduce a Pattern protocol so Client and AsyncClient can hold either kind in their _mounts dict. URLPattern is kept as a backward-compatible alias for WildcardURLPattern. Together with pydantic#967 will close - pydantic#829 - pydantic#899 Ported from encode/httpx#3741. Co-Authored-By: Ondrej Filip <ondrej.filip@firma.seznam.cz> Co-Authored-By: Bill Peck <bpeck@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes no_proxy to support IPV6 CIDR format.
no_proxy=fe11::/16 python -c 'import httpx; c = httpx.Client()'
Closes: #3221
Checklist