Support HTTP.jl 2.0 alongside 1.x

[krynju]

Summary

Adds HTTP.jl 2.0 support while keeping 1.x working. The package now resolves and tests cleanly against both HTTP majors.

HTTP.jl 2.0 is a major rewrite with a reworked public API. A load-time feature flag (_HTTP_V2 = !isdefined(HTTP, :Messages)) plus small shims in the HTTP.jl client backend bridge the differences:

• statustext — HTTP.Messages removed → fall back to Response.reason
• header lookup — HTTP.Header / HTTP.header(::Vector) removed → plain case-insensitive lookup over the request headers
• content_type — returns a String on 2.0 (was a Pair on 1.x)
• error fields — TimeoutError.readtimeout → .timeout_ns; ConnectError.error → .cause
• timeout ms — forced to Integer so the reason string still matches the \d+ milliseconds regex in is_longpoll_timeout (real bug, not just cosmetic)
• streaming — read(io, n) removed → readbytes!; drop the verbose kwarg unsupported by 2.0 HTTP.open; map readtimeout → read_idle_timeout on 2.0
• server — HTTP.Forms.Multipart → HTTP.Multipart (same type on 1.x)

Test fixtures updated for both versions; the timeout server fixture uses HTTP.listen! on 2.0 vs serve!(...; stream=true) on 1.x.

CI

Adds an http: ['1', '2'] matrix dimension. A step pins the HTTP compat per cell (resolver and Pkg.test's sandbox both honor it). Julia 1.6 + HTTP 2 is excluded, since HTTP.jl 2.0 requires Julia ≥ 1.10.

Verification

	HTTP 1.11	HTTP 2.4
load	✓	✓
client: JSON / urlencoded form / 404 status text	✓	✓
Utils testset	16/16	16/16
buffered timeout	✓	✓
real longpoll-timeout (server + client)	1/1	1/1 + 14/14 timeout_tests

Forms/multipart-upload, DeepObject, Union-types and the petstore client tests also passed on HTTP 2.0 locally. No 1.x regression.

🤖 Generated with Claude Code

[tanmaykm]

Companion code generator change: OpenAPITools/openapi-generator#24102. Required only when HTTP.jl 2.x is used with code-generated servers that extract parameters from headers.

Claude review comments:

---

What it does: Adds HTTP.jl 2.0 support while keeping 1.x working. The core changes are a load-time _HTTP_V2 feature flag plus small shims in the HTTP.jl client backend (src/client/httplibs/juliaweb_http.jl) that bridge API differences —
statustext, header lookup, content-type, error fields, timeout keyword/units, and streaming reads. src/server.jl switches HTTP.Forms.Multipart → HTTP.Multipart and adds a case-insensitive header fallback in get_param. The rest is test
fixtures, generated server stubs, a CI http: ['1','2'] matrix, and a version bump to 0.3.0.

The shim layer is well-organized and the comments are genuinely helpful. I verified the two things I was most suspicious of and both are clean:

• The \d+ milliseconds regex match is safe — client.timeout is constrained to ::Integer (client.jl:47), so the 1.x e.readtimeout * 1000 stays an Int.
• get_response_header → HTTP.header(resp, …) (juliaweb_http.jl:84, unchanged) is on the hot path for every response (client.jl:145), and the PR's "client: JSON ✓ on HTTP 2.4" result exercises it — so the HTTP.header removal was
  correctly scoped to the ::Vector method only.

Findings

1. src/server.jl:64 — case-insensitive matching leaks from headers into query/path/form params (low severity, wrong-depth fix).
   The fallback lives in the shared get_param(source::Dict, …), but that method also serves query, path, and form params — not just headers, which are the only params that are case-insensitive per RFC. A conforming client never hits the
   fallback (generated code passes the spec's exact name and HTTP.queryparams/path params preserve wire case), so this doesn't break correct requests; it silently makes the server lenient — e.g. a request with ?Name=foo would now satisfy a
   query param declared as name, where before it resolved to nothing. The maintainer action is to scope the case-insensitive lookup to the header path (e.g. normalize the header dict where the generated code builds
   Dict{String,String}(req.headers), or a header-specific lookup) rather than the shared Dict method.

2. test/server/timeouttest/timeouttest_server.jl:56 — _HTTP_V2 detection duplicated (reuse).
   http_v2 = isdefined(Base, :pkgversion) && something(pkgversion(HTTP), v"1") >= v"2" is a verbatim copy of the canonical OpenAPI.Clients._HTTP_V2 (juliaweb_http.jl:28). Other test files (utilstests.jl, allany/runtests.jl) already
   reference OpenAPI.Clients._HTTP_V2, so reuse the constant here too — a second copy of the version-detection logic can drift if the detection rule ever changes.

No correctness bugs survived verification. Both findings are low-severity polish; the PR is in good shape.

---