The Fix
Upgrade to version 0.13.0 or later.
Based on closed encode/httpx issue #433 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -12,6 +12,7 @@
CertTypes,
PoolLimits,
+ Timeout,
TimeoutTypes,
VerifyTypes,
import httpx
url = "https://httpbin.org/delay/10"
# (1)
httpx.get(url, timeout=None) # Times out after 5s
# (2)
client = httpx.Client(timeout=None)
client.get(url) # Does not timeout, returns after 10s
# (3)
client = httpx.Client()
client.get(url, timeout=None) # Times out after 5s
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Option A — Upgrade to fixed release\nUpgrade to version 0.13.0 or later.\nWhen NOT to use: Do not use this fix if the behavior of timeout=None is intended to be different in specific contexts.\n\n
Why This Fix Works in Production
- Trigger: Passing 'timeout=None' should always result in no timeout
- Mechanism: Passing None to the timeout parameter leads to inconsistent timeout behavior across request entrypoints
- Why the fix works: Differentiates between `timeout=None` and `timeout=UNSET`, ensuring consistent timeout behavior across the library. (first fixed release: 0.13.0).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Passing None to the timeout parameter leads to inconsistent timeout behavior across request entrypoints
- Production symptom (often without a traceback): Passing 'timeout=None' should always result in no timeout
Proof / Evidence
- GitHub issue: #433
- Fix PR: https://github.com/encode/httpx/pull/592
- First fixed release: 0.13.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.72
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“@florimondmanca I don't understand the reason to use the sentinel value”
“This issue is more subtle than I initially thought it would be and will require to go through various places of the code base. Still…”
“@florimondmanaca can you assign it to me please?”
“Ok, so if I got it right, in summary we want: - [x] Client instance: leave default DEFAULT_TIMEOUT_CONFIG - [ ] client .request(...) methods: change…”
Failure Signature (Search String)
- Passing 'timeout=None' should always result in no timeout
- Currently, the behavior of passing `None` to the `timeout` parameter in the various request entrypoints is not consistent:
Copy-friendly signature
Failure Signature
-----------------
Passing 'timeout=None' should always result in no timeout
Currently, the behavior of passing `None` to the `timeout` parameter in the various request entrypoints is not consistent:
Error Message
Signature-only (no traceback captured)
Error Message
-------------
Passing 'timeout=None' should always result in no timeout
Currently, the behavior of passing `None` to the `timeout` parameter in the various request entrypoints is not consistent:
Minimal Reproduction
import httpx
url = "https://httpbin.org/delay/10"
# (1)
httpx.get(url, timeout=None) # Times out after 5s
# (2)
client = httpx.Client(timeout=None)
client.get(url) # Does not timeout, returns after 10s
# (3)
client = httpx.Client()
client.get(url, timeout=None) # Times out after 5s
What Broke
Users experience unexpected timeouts or delays when using timeout=None in requests.
Why It Broke
Passing None to the timeout parameter leads to inconsistent timeout behavior across request entrypoints
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 0.13.0 or later.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Option D — Guard side-effects with OnceOnly Guardrail for side-effects
Mitigate duplicate external side-effects under retries/timeouts/agent loops by gating the operation before calling external systems.
- Place OnceOnly between your code/agent and real side-effects (Stripe, emails, CRM, APIs).
- Use a stable key per side-effect (e.g., customer_id + action + idempotency_key).
- Fail-safe: configure fail-open vs fail-closed based on blast radius and spend risk.
Show example snippet (optional)
from onceonly import OnceOnly
import os
once = OnceOnly(api_key=os.environ["ONCEONLY_API_KEY"], fail_open=True)
# Stable idempotency key per real side-effect.
# Use a request id / job id / webhook delivery id / Stripe event id, etc.
event_id = "evt_..." # replace
key = f"stripe:webhook:{event_id}"
res = once.check_lock(key=key, ttl=3600)
if res.duplicate:
return {"status": "already_processed"}
# Safe to execute the side-effect exactly once.
handle_event(event_id)
Fix reference: https://github.com/encode/httpx/pull/592
First fixed release: 0.13.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use this fix if the behavior of timeout=None is intended to be different in specific contexts.
- Do not use this to hide logic bugs or data corruption. Use it to block duplicate external side-effects and enforce tool permissions/spend caps.
Verify Fix
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
- Upgrade behind a canary and run integration tests against the canary before 100% rollout.
- Track RSS + object counts after deployments; alert on monotonic growth and GC pressure.
- Add a long-running test that repeats the failing call path and asserts stable memory.
Version Compatibility Table
| Version | Status |
|---|---|
| 0.13.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.