HTTPX should be allowed to update to 0.26.X, supertokens-python prevents other packages from updating due to this upper limit. I understand that since httpx is in semver v0 no stable upper version is available yet, so a solution like <1 isn't safe. httpx does seem to be planning a v1 soon though.

I don't know the supertokens-python codebase that thoroughly, but the httpx changelog doesn't seem like anything would be blockers to allowing the update here:

0.26.0 (20th December, 2023)

• Added
  • The proxy argument was added. You should use the proxy argument instead of the deprecated proxies, or use mounts= for more complex configurations. encode/httpx#2879
• Deprecated
  • The proxies argument is now deprecated. It will still continue to work, but it will be removed in the future. encode/httpx#2879
• Fixed
  • Fix cases of double escaping of URL path components. Allow / as a safe character in the query portion. encode/httpx#2990
  • Handle NO_PROXY envvar cases when a fully qualified URL is supplied as the value. encode/httpx#2741
  • Allow URLs where username or password contains unescaped '@'. encode/httpx#2986
  • Ensure ASGI raw_path does not include URL query component. encode/httpx#2999
  • Ensure Response.iter_text() cannot yield empty strings. encode/httpx#2998

0.25.2 (24th November, 2023)

• Added
  • Add missing type hints to few init() methods. encode/httpx#2938

0.25.1 (3rd November, 2023)

• Added
  • Add support for Python 3.12. encode/httpx#2854
  • Add support for httpcore 1.0 encode/httpx#2885
• Fixed
  • Raise ValueError on Response.encoding being set after Response.text has been accessed. encode/httpx#2852

0.25.0 (11th September, 2023)

• Removed
  • Drop support for Python 3.7. encode/httpx#2813
• Added
  • Support HTTPS proxies. encode/httpx#2845
  • Change the type of Extensions from Mapping[Str, Any] to MutableMapping[Str, Any]. encode/httpx#2803
  • Add socket_options argument to httpx.HTTPTransport and httpx.AsyncHTTPTransport classes. encode/httpx#2716
  • The Response.raise_for_status() method now returns the response instance. For example: data = httpx.get('...').raise_for_status().json(). encode/httpx#2776
• Fixed
  • Return 500 error response instead of exceptions when raise_app_exceptions=False is set on ASGITransport. encode/httpx#2669
  • Ensure all WSGITransport environs have a SERVER_PROTOCOL. encode/httpx#2708
  • Always encode forward slashes as %2F in query parameters encode/httpx#2723
  • Use Mozilla documentation instead of httpstatuses.com for HTTP error reference encode/httpx#2768