Current required h11 version (>=0.13,<0.15) is vulnerable to GHSA-vqfr-h8mv-ghfj

[yyyyyyyan]

As stated in #1007 (comment) and #1008, the required version for h11 (>=0.13,<0.15) is vulnerable to GHSA-vqfr-h8mv-ghfj.

[TayfurYldz]

This is resolved in current httpcore.

The current dependency declaration is:

dependencies = [
    "certifi",
    "h11>=0.16",
]

so the old h11>=0.13,<0.15 constraint referenced here is no longer present. Installing a current httpcore release should therefore allow/require the fixed h11 line rather than keeping the vulnerable pre-0.16 range.

For an environment that still reports the advisory, I would check the resolved versions rather than only the top-level requirement (python -m pip show httpcore h11 or the lockfile), because an old httpcore pin/lock can keep the historical constraint even after the project metadata has changed upstream.

There shouldn't be a need for an application-level workaround on current versions; the dependency floor itself has been moved to h11>=0.16.