Fix vulnerable dependencies - #322
Open
github-actions[bot] wants to merge 1 commit into
Open
Conversation
github-actions
Bot
force-pushed
the
fix-vulnerable-deps
branch
from
August 9, 2026 20:35
d13f314 to
120541c
Compare
kdeldycke
force-pushed
the
fix-vulnerable-deps
branch
11 times, most recently
from
August 11, 2026 12:24
3a9c8f4 to
c8f2337
Compare
kdeldycke
force-pushed
the
fix-vulnerable-deps
branch
from
August 11, 2026 14:28
c8f2337 to
3b3094b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerabilities
3.83.15github-advisories,uv-audit3.1.43.1.6github-advisories,uv-audit3.1.43.1.5github-advisories,uv-audit3.1.43.1.5github-advisories,uv-audit3.73.8.1github-advisories,uv-audit2.18.02.20.0github-advisories,uv-audit8.3.29.0.3github-advisories,uv-audit2.32.32.32.4github-advisories,uv-audit2.32.32.33.0github-advisories,uv-audit2.62.8.4github-advisories,uv-audit2.62.8.4github-advisories,uv-audit2.2.22.6.0github-advisories,uv-audit2.2.22.6.3github-advisories,uv-audit2.2.22.5.0github-advisories,uv-audit2.2.22.6.0github-advisories,uv-audit2.2.22.5.0github-advisories,uv-audit2.2.22.7.0github-advisories,uv-audit🆙 Updated packages
Resolved with
exclude-newercutoff:2026-08-04.3.8→3.183.1.4→3.1.63.7→3.10.38.3.2→9.1.12.32.3→2.34.22.6→2.9.22.2.2→2.7.0Release notes
idnaChangelog
jinja23.1.5This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.5/
Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5
Milestone: https://redirect.github.com/pallets/jinja/milestone/16?closed=1
str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7hclearandpopon known mutable sequence types. #2032renderfor an async template usesasyncio.run. #1952auto_aiterwarnings. #1960aclose-ableAsyncGeneratorfromTemplate.generate_async. #1960root_render_func()unclosed inTemplate.generate_async. #1960concatfunction for the current environment when calling block references. #1701|uniqueasync-aware, allowing it to be used after another async-aware filter. #1781|intfilter handlesOverflowErrorfrom scientific notation. #1921{% set ... %}call. #2021copy/pickle/etc) interaction withUndefinedobjects. #2025copy/picklesupport for the internalmissingobject. #2027Environment.overlay(enable_async)is applied correctly. #2061... Full release notes
3.1.6This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6
|attrfilter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. https://redirect.github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7markdown3.8Changed
abbrextension by introducing methodcreate_element(#1483).non-redundant cases to the newer test framework.
Fixed
attr_listontoc(#1493).md_in_htmlprocesses content inside "markdown" blocks as they areparsed outside of "markdown" blocks to keep things more consistent for
third-party extensions (#1503).
md_in_htmlhandle tags within inline code blocks better (#1075).md_in_htmlfix handling of one-liner block HTML handling (#1074).<center>is treated like a block-level element (#1481).abbrextension respectsAtomicStringand does not processperceived abbreviations in these strings (#1512).
smartyextension correctly renders nested closing quotes (#1514).3.8.1Fixed
md_in_html(#1526).3.8.2Fixed
codecsdeprecation in Python 3.14.<fooand Python 3.14.3.10.1Fixed
3.10.2Fixed
</(#1593).3.10.3Fixed
SetextHeaderProcessorregex to prevent mixed=and-chars in setext-style headers (#1606).pytest8.3.3pytest 8.3.3 (2024-09-09)
Bug fixes
#12446: Avoid calling
@property(and other instance descriptors) during fixture discovery -- byasottile{.interpreted-text role="user"}#12659: Fixed the issue of not displaying assertion failure differences when using the parameter
--import-mode=importlibin pytest>=8.1.#12667: Fixed a regression where type change in [ExceptionInfo.errisinstance]{.title-ref} caused [mypy]{.title-ref} to fail.
#12744: Fixed typing compatibility with Python 3.9 or less -- replaced [typing.Self]{.title-ref} with [typing_extensions.Self]{.title-ref} -- by
Avasam{.interpreted-text role="user"}#12745: Fixed an issue with backslashes being incorrectly converted in nodeid paths on Windows, ensuring consistent path handling across environments.
#6682: Fixed bug where the verbosity levels where not being respected when printing the "msg" part of failed assertion (as in
assert condition, msg).#9422: Fix bug where disabling the terminal plugin via
-p no:terminalwould cause crashes related to missing theverboseoption.-- by
GTowers1{.interpreted-text role="user"}Improved documentation
... Full release notes
8.3.4pytest 8.3.4 (2024-12-01)
Bug fixes
#12592: Fixed
KeyError{.interpreted-text role="class"} crash when using--import-mode=importlibin a directory layout where a directory contains a child directory with the same name.#12818: Assertion rewriting now preserves the source ranges of the original instructions, making it play well with tools that deal with the
AST, like executing.#12849: ANSI escape codes for colored output now handled correctly in
pytest.fail{.interpreted-text role="func"} with [pytrace=False]{.title-ref}.#9353:
pytest.approx{.interpreted-text role="func"} now uses strict equality when given booleans.Improved documentation
#10558: Fix ambiguous docstring of
pytest.Config.getoption{.interpreted-text role="func"}.#10829: Improve documentation on the current handling of the
--basetempoption and its lack of retention functionality (temporary directory location and retention{.interpreted-text role="ref"}).#12866: Improved cross-references concerning the
recwarn{.interpreted-text role="fixture"} fixture.#12966: Clarify
filterwarnings{.interpreted-text role="ref"} docs on filter precedence/order when using multiple@pytest.mark.filterwarnings <pytest.mark.filterwarnings ref>{.interpreted-text role="ref"} marks.Contributor-facing changes
... Full release notes
8.3.5pytest 8.3.5 (2025-03-02)
Bug fixes
-vvverbosity.libeditbuild of Python, such as on macOS or with uv-managed Python binaries from thepython-build-standaloneproject. This could manifest e.g. by a broken prompt when usingPdb, or seeing empty inputs with manual usage ofinput()and suspended capturing.AttributeError{.interpreted-text role="class"} crash when using--import-mode=importlibwhen top-level directory same name as another module of the standard library.--import-mode=importlib, a directory containing py file with the same name would cause anImportErrorImproved documentation
#12842: Added dedicated page about using types with pytest.
See
types{.interpreted-text role="ref"} for detailed usage.Contributor-facing changes
test_terminal.pywith Pygments >= 2.19.0when building Sphinx docs -- by
webknjaz{.interpreted-text role="user"}.8.4.0pytest 8.4.0 (2025-06-02)
Removals and backward incompatible breaking changes
#11372: Async tests will now fail, instead of warning+skipping, if you don't have any suitable plugin installed.
#12346: Tests will now fail, instead of raising a warning, if they return any value other than None.
#12874: We dropped support for Python 3.8 following its end of life (2024-10-07).
#12960: Test functions containing a yield now cause an explicit error. They have not been run since pytest 4.0, and were previously marked as an expected failure and deprecation warning.
See
the docs <yield tests deprecated>{.interpreted-text role="ref"} for more information.Deprecations (removal in next major release)
autouse=True. For guidance on how to work around this warning seesync-test-async-fixture{.interpreted-text role="ref"}.New features
... Full release notes
8.4.1pytest 8.4.1 (2025-06-17)
Bug fixes
#13461: Corrected
_pytest.terminal.TerminalReporter.isattyto supportbeing called as a method. Before it was just a boolean which could
break correct code when using
-o log_cli=true).#13477: Reintroduced
pytest.PytestReturnNotNoneWarning{.interpreted-text role="class"} which was removed by accident in pytest [8.4]{.title-ref}.This warning is raised when a test functions returns a value other than
None, which is often a mistake made by beginners.See
return-not-none{.interpreted-text role="ref"} for more information.#13497: Fixed compatibility with
Twisted 25+.Improved documentation
faulthandlernot working on Windows.8.4.2pytest 8.4.2 (2025-09-03)
Bug fixes
#13478: Fixed a crash when using
console_output_style{.interpreted-text role="confval"} withtimesand a module is skipped.#13530: Fixed a crash when using
pytest.approx{.interpreted-text role="func"} anddecimal.Decimal{.interpreted-text role="class"} instances with thedecimal.FloatOperation{.interpreted-text role="class"} trap set.#13549: No longer evaluate type annotations in Python
3.14when inspecting function signatures.This prevents crashes during module collection when modules do not explicitly use
from __future__ import annotationsand import types for annotations within aif TYPE_CHECKING:block.#13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in
pytest.Parser.addini{.interpreted-text role="meth"}.#13563:
pytest.approx{.interpreted-text role="func"} now only importsnumpyif NumPy is already insys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.Improved documentation
pytest_generate_testsis discovered in test modules/classes; other hooks must be inconftest.pyor plugins.Contributor-facing changes
-Wdefaultor a similar override.... Full release notes
9.0.0pytest 9.0.0 (2025-11-05)
New features
#1367: Support for subtests has been added.
subtests <subtests>are an alternative to parametrization, useful in situations where the parametrization values are not all known at collection time.Example:
Each assert failure or error is caught by the context manager and reported individually, giving a clear picture of all files that are missing a docstring.
In addition,
unittest.TestCase.subTestis now also supported.This feature was originally implemented as a separate plugin in pytest-subtests, but since then has been merged into the core.
#13743: Added support for native TOML configuration files.
While pytest, since version 6, supports configuration in
pyproject.tomlfiles under[tool.pytest.ini_options],it does so in an "INI compatibility mode", where all configuration values are treated as strings or list of strings.
Now, pytest supports the native TOML data model.
In
pyproject.toml, the native TOML configuration is under the[tool.pytest]table.... Full release notes
9.0.1pytest 9.0.1 (2025-11-12)
Bug fixes
raise unittest.SkipTest.Packaging updates and notes for downstreams
version string can be passed into its
package_envthroughthe
SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTESTenvironmentvariable as a part of the release process -- by
webknjaz.Contributor-facing changes
creating GitHub Releases without having a Git checkout on
disk -- by
bluetechandwebknjaz.version string can be passed into its
package_envthroughthe
SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTESTenvironmentvariable as a part of the release process -- by
webknjaz.9.0.2pytest 9.0.2 (2025-12-06)
Bug fixes
#13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.
You may enable it again by passing
-p terminalprogress. We may enable it by default again once compatibility improves in the future.Additionally, when the environment variable
TERMisdumb, the escape codes are no longer emitted, even if the plugin is enabled.#13904: Fixed the TOML type of the
tmp_path_retention_countsettings in the API reference from number to string.#13946: The private
config.inicfgattribute was changed in a breaking manner in pytest 9.0.0.Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim.
It will be deprecated in pytest 9.1 and removed in pytest 10.
#13965: Fixed quadratic-time behavior when handling
unittestsubtests in Python 3.10.Improved documentation
pytest's command-line flags <command-line-flags>.9.0.3pytest 9.0.3 (2026-04-07)
Bug fixes
#12444: Fixed
pytest.approxwhich now correctly takes into account~collections.abc.Mappingkeys order to compare them.#13634: Blocking a
conftest.pyfile using the-p no:option is now explicitly disallowed.Previously this resulted in an internal assertion failure during plugin loading.
Pytest now raises a clear
UsageErrorexplaining that conftest files are not plugins and cannot be disabled via-p.#13734: Fixed crash when a test raises an exceptiongroup with
__tracebackhide__ = True.#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.
#14343: Fixed use of insecure temporary directory (CVE-2025-71176).
Improved documentation
-pvsPYTEST_PLUGINSplugin loading and fixed an incorrect-pexample.capsysandcapfd) take precedence over the-s/--capture=nocommand-line options inAccessing captured output from a test function <accessing-captured-output>.pytest_collectionhook setssession.itemsbefore it callspytest_collection_finish, not after.Contributor-facing changes
... Full release notes
9.1.0pytest 9.1.0 (2026-06-13)
Removals and backward incompatible breaking changes
#14533: When using
--doctest-modules, autouse fixtures withmodule,packageorsessionscope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.If this is undesirable, move the fixture definition to a
conftest.pyfile if possible.Technical explanation for those interested:
When using --doctest-modules, pytest possibly collects Python modules twice, once as
pytest.Moduleand once as aDoctestModule(depending on the configuration).Due to improvements in pytest's fixture implementation, if e.g. the
DoctestModulecollects a fixture, it is now visible to it only, and not to theModule.This means that both need to register the fixtures independently.
Deprecations (removal in next major release)
#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without
@classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use@classmethoddecorator instead -- byyastcher.See
10819and14011.#12882: Calling
request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue>during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.See
dynamic-fixture-request-during-teardownfor details.... Full release notes
9.1.1pytest 9.1.1 (2026-06-19)
Bug fixes
pytest.RaisesGroupwhich would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.list-itemtyping errors from mypy in@pytest.mark.parametrize <pytest.mark.parametrize ref>argvaluesparameter.conftest.pyfiles located in<invocation dir>/test*were no longer loaded as initial conftests when invoked without arguments.This could cause certain hooks (like
pytest_addoption) in these files to not fire.requestsv2.32.42.32.4 (2025-06-10)
Security
environment will retrieve credentials for the wrong hostname/machine from a
netrc file. (#6965)
Improvements
Deprecations
v2.32.52.32.5 (2025-08-18)
Bugfixes
a new class of issues in Requests that have had negative impact across a number
of use cases. The Requests team has decided to revert this feature as long term
maintenance of it is proving to be unsustainable in its current iteration.
Deprecations
v2.33.02.33.0 (2026-03-25)
Announcements
Security
requests.utils.extract_zipped_pathsnow extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.Improvements
Bugfixes
Deprecations
Documentation
New Contributors
Full Changelog: https://redirect.github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25
v2.33.12.33.1 (2026-03-30)
Bugfixes
files in the tmp directory. (#7305)
New Contributors
Full Changelog: https://redirect.github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30
v2.34.02.34.0 (2026-05-11)
Announcements
Requests 2.34.0 introduces inline types, replacing those provided by
typeshed. Public API types should be fully compatible with mypy, pyright,
and ty. We believe types are comprehensive but if you find issues, please
report them to the pinned tracking issue.
Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for
helping review and test the types ahead of the release. (#7272)
Improvements
usedforsecurity=Falseto clarifysecurity considerations. (#7310)
should be able to start testing prior to its release in October. (#7422)
Bugfixes
Response.historyno longer contains a reference to itself, preventingaccidental looping when traversing the history list. (#7328)
proxy_bypass implementation has been updated with CPython's fix from
bpo-39057. (#7427)
URI paths. This should address user issues with specific presigned
URLs. Note the full fix requires urllib3 2.7.0+. (#7315)
New Contributors
... Full release notes
v2.34.12.34.1 (2026-05-13)
Bugfixes
jsoninput type fromdictandlisttoMappingand
Sequence. (#7436)headersinput type to MutableMapping and removedNonefromRequest.headerstyping to improve handling for users. (#7431)Response.reasonmoved fromstr | Nonetostrto improve handlingfor users. (#7437)
__getattr__implementationsweren't being properly detected as Iterables. (#7433)
New Contributors
Full Changelog: https://redirect.github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13
v2.34.22.34.2 (2026-05-14)
headersinput type back toMappingto avoid invariance issues withMutableMappingand inferred dict types. Users callingRequest.headers.update()may need to narrow typing in their code. (#7441)Full Changelog: https://redirect.github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14
soupsieve2.72.7
:openpseudo selector.:mutedpseudo selector.:autofill,:buffering,:fullscreen,:picture-in-picture,:popover-open,:seeking,:stalled, and:volume-locked. These selectors, while recognized, will not match anyelement as they require a live environment to check element states and browser states. This just prevents Soup Sieve
from failing when any of these selectors are specified.
2.82.8
2.8.12.8.1
2.8.22.8.2
:in-rangeand:out-of-rangewith end of year weeks (@mundanevision20).2.8.32.8.3
2.8.42.8.4
2.92.9
:nth-child/:nth-of-type(and-last-variants) forAn+Bvalues whose sequence steps ontoindex 0 or onto the last child (e.g.
:nth-child(2n-2),:nth-child(n-1),:nth-child(n+5)), which previouslymatched the wrong elements or nothing at all (@gaoflow).
2.9.12.9.1
[attr^=""],[attr$=""], and[attr*=""]to match nothing when the value is empty, per CSSSelectors Level 4 substring matching, which previously matched any element merely having the attribute
(@chuenchen309).
2.9.22.9.2
:is()and:where()were not accounting for empty selectors in the max selector count asthey should (@arpitjain099).
:has()was allowing empty selectors in some circumstances even though it is notforgiving.
:is()and:where()contain empty selectors.urllib32.2.3🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Features
Bugfixes
HTTPConnection.default_socket_options. (#3448)HTTP/2 (experimental)
HTTP/2 support is still in early development.
h2(https://pypi.org/project/h2/) usage. Now only accepting supported h2 major version 4.x.x. (#3290)Full Changelog: https://redirect.github.com/urllib3/urllib3/compare/2.2.2...2.2.3
2.3.0🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Features
HTTPResponse.shutdown()to stop any ongoing or future reads for a specific response. It callsshutdown(SHUT_RD)on the underlying socket. This feature was sponsored by LaunchDarkly. (https://redirect.github.com/urllib3/urllib3/issues/2868)--experimental-wasm-stack-switching. (https://redirect.github.com/urllib3/urllib3/issues/3400)proxy_is_tunnelingproperty toHTTPConnectionandHTTPSConnection. (https://redirect.github.com/urllib3/urllib3/issues/3285)NewConnectionErrorandNameResolutionError. (https://redirect.github.com/urllib3/urllib3/issues/3480)Bugfixes
Deprecations and Removals
Full Changelog: https://redirect.github.com/urllib3/urllib3/compare/2.2.3...2.3.0
2.4.0🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Features
verify_flagsoption tocreate_urllib3_contextwith a default ofVERIFY_X509_PARTIAL_CHAINandVERIFY_X509_STRICTfor Python 3.13+. (#3571)Bugfixes
Misc
multiple.intoto.jsonlasset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)2.5.0🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security issues
urllib3 2.5.0 fixes two moderate security issues:
retriesis passed — CVE-2025-50181 reported by @sandumjacob (5.3 Medium, GHSA-pq67-6m6q-mj2v)Features
compression.zstdmodule that is new in Python 3.14. See PEP 784 for more information. (#3610)hatch-vcs(#3612)Bugfixes
HTTPResponse.shutdownon a connection already released to the pool. (#3581)CONNECTstatement when using an IPv6 proxy withconnection_from_host. Previously would not be wrapped in[]. (#3615)2.6.0🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security
Content-Encodingheader, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418 reported by @illia-v, 8.9 High, GHSA-gm62-xv2j-4w53)Features
... Full release notes
2.6.1🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
HTTPResponse.getheaders()andHTTPResponse.getheader()methods. (#3731)2.6.2🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
HTTPResponse.read_chunked()to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. (https://redirect.github.com/urllib3/urllib3/issues/3734)2.6.3🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
Retry-Aftertimes greater than 6 hours as 6 hours by default. (https://redirect.github.com/urllib3/urllib3/issues/3743)urllib3.connection.VerifiedHTTPSConnectionon Emscripten. (https://redirect.github.com/urllib3/urllib3/issues/3752)2.7.0🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security
Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.
Decompression-bomb safeguards of the streaming API were bypassed:
HTTPResponse.drain_conn()was called after the response had been read and decompressed partially. (Reported by @Cycloctane)HTTPResponse.read(amt=N)orHTTPResponse.stream(amt=N)call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)See GHSA-mf9v-mfxr-j63j for details.
HTTP pools created using
ProxyManager.connection_from_urldid not strip sensitive headers specified inRetry.remove_headers_on_redirectwhen redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)Deprecations and Removals
FutureWarninginstead ofDeprecationWarningfor better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (https://redirect.github.com/urllib3/urllib3/issues/3763)... Full release notes
⚙️ Configuration
Relevant
[tool.repomatic]options:vulnerable-deps.sourcesvulnerable-deps.syncImportant
If you suspect the PR content is outdated, click
Run workflowto refresh it manually before merging.Workflow metadatafix-vulnerable-depspushmain8e9236b7fix-vulnerable-depsautofix.yaml🏭 Generated with repomatic
7.9.0