Releases: psf/requests
v2.31.0
2.31.0 (2023-05-22)
Security
-
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding ofProxy-Authorization
headers to destination servers when
following HTTPS redirects.When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct aProxy-Authorization
header that is attached to the request to
authenticate with the proxy.In cases where Requests receives a redirect response, it previously reattached
theProxy-Authorization
header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.Full details can be read in our Github Security Advisory
and CVE-2023-32681.
v2.30.0
2.30.0 (2023-05-03)
Dependencies
-
⚠️ Added support for urllib3 2.0.⚠️ This may contain minor breaking changes so we advise careful testing and
reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html
prior to upgrading.Users who wish to stay on urllib3 1.x can pin to
urllib3<2
.
v2.29.0
v2.28.2
2.28.2 (2023-01-12)
Dependencies
- Requests now supports charset_normalizer 3.x. (#6261)
Bugfixes
- Updated MissingSchema exception to suggest https scheme rather than http. (#6188)
New Contributors
- @slyapustin made their first contribution in #6188
- @mila made their first contribution in #6200
- @DavidCain made their first contribution in #6204
- @jaap3 made their first contribution in #6234
- @deedy5 made their first contribution in #6261
- @winmorre made their first contribution in #6262
- @oliviacrain made their first contribution in #6291
- @ch-iv made their first contribution in #6317
- @boahc077 made their first contribution in #6236
Full Changelog: v2.28.1...v2.28.2
v2.28.1
2.28.1 (2022-06-29)
Improvements
- Speed optimization in
iter_content
with transition toyield from
. (#6170)
Dependencies
New Contributors
- @hswong3i made their first contribution in #6179
- @frenzymadness made their first contribution in #6169
Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2281-2022-06-29
v2.28.0
2.28.0 (2022-06-09)
Deprecations
⚠️ Requests has officially dropped support for Python 2.7.⚠️ (#6091)- Requests has officially dropped support for Python 3.6 (including pypy3). (#6091)
Improvements
- Wrap JSON parsing issues in Request's JSONDecodeError for payloads without
an encoding to makejson()
API consistent. (#6097) - Parse header components consistently, raising an InvalidHeader error in
all invalid cases. (#6154) - Added provisional 3.11 support with current beta build. (#6155)
- Requests got a makeover and we decided to paint it black. (#6095)
Bugfixes
- Fixed bug where setting
CURL_CA_BUNDLE
to an empty string would disable
cert verification. All Requests 2.x versions before 2.28.0 are affected. (#6074) - Fixed urllib3 exception leak, wrapping
urllib3.exceptions.SSLError
with
requests.exceptions.SSLError
forcontent
anditer_content
. (#6057) - Fixed issue where invalid Windows registry entires caused proxy resolution
to raise an exception rather than ignoring the entry. (#6149) - Fixed issue where entire payload could be included in the error message for
JSONDecodeError. (#6079)
New Contributors
- @marwanpro made their first contribution in #6035
- @chyzzqo2 made their first contribution in #6036
- @Chavithra made their first contribution in #6044
- @sha016 made their first contribution in #5978
- @BoboTiG made their first contribution in #4766
- @davidshivaji made their first contribution in #6133
- @ogayot made their first contribution in #6136
Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2280-2022-06-09
v2.27.1
2.27.1 (2022-01-05)
Bugfixes
- Fixed parsing issue that resulted in the
auth
component being
dropped from proxy URLs. (#6028)
Full Changelog: https://github.com/psf/requests/blob/v2.27.1/HISTORY.md#2271-2022-01-05
v2.27.0
2.27.0 (2022-01-03)
Improvements
-
Officially added support for Python 3.10. (#5928)
-
Added a
requests.exceptions.JSONDecodeError
to unify JSON exceptions between
Python 2 and 3. This gets raised in theresponse.json()
method, and is
backwards compatible as it inherits from previously thrown exceptions.
Can be caught fromrequests.exceptions.RequestException
as well. (#5856) -
Improved error text for misnamed
InvalidSchema
andMissingSchema
exceptions. This is a temporary fix until exceptions can be renamed
(Schema->Scheme). (#6017) -
Improved proxy parsing for proxy URLs missing a scheme. This will address
recent changes tourlparse
in Python 3.9+. (#5917)
Bugfixes
-
Fixed defect in
extract_zipped_paths
which could result in an infinite loop
for some paths. (#5851) -
Fixed handling for
AttributeError
when calculating length of files obtained
byTarfile.extractfile()
. (#5239) -
Fixed urllib3 exception leak, wrapping
urllib3.exceptions.InvalidHeader
with
requests.exceptions.InvalidHeader
. (#5914) -
Fixed bug where two Host headers were sent for chunked requests. (#5391)
-
Fixed regression in Requests 2.26.0 where
Proxy-Authorization
was
incorrectly stripped from all requests sent withSession.send
. (#5924) -
Fixed performance regression in 2.26.0 for hosts with a large number of
proxies available in the environment. (#5924) -
Fixed idna exception leak, wrapping
UnicodeError
with
requests.exceptions.InvalidURL
for URLs with a leading dot (.) in the
domain. (#5414)
Deprecations
- Requests support for Python 2.7 and 3.6 will be ending in 2022. While we
don't have exact dates, Requests 2.27.x is likely to be the last release
series providing support.
New Contributors
- @steveberdy made their first contribution in #5877
- @Akay7 made their first contribution in #5821
- @mgorny made their first contribution in #5890
- @tl-hbk made their first contribution in #5851
- @itsadok made their first contribution in #5899
- @theGOTOguy made their first contribution in #5906
- @verhovsky made their first contribution in #5910
- @hodbn made their first contribution in #5391
- @davisagli made their first contribution in #5993
- @vashisthabhinav made their first contribution in #5998
- @mondeja made their first contribution in #5414
- @gdubicki made their first contribution in #5382
Full Changelog: https://github.com/psf/requests/blob/v2.27.0/HISTORY.md#2270-2022-01-03