Skip to content

Bump requests from 2.32.5 to 2.33.1#74

Closed
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/pip/dev/requests-2.33.1
Closed

Bump requests from 2.32.5 to 2.33.1#74
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/pip/dev/requests-2.33.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026 •
edited
Loading

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps requests from 2.32.5 to 2.33.1.

Release notes

Sourced from requests's releases.

v2.33.1

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump requests from 2.32.5 to 2.33.1
f44d930 
Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.1.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.5...v2.33.1)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 6, 2026
@dependabot dependabot Bot mentioned this pull request Apr 6, 2026
Closed
Bentlybro added a commit that referenced this pull request Apr 22, 2026
@Bentlybro
Bump deps: Flask 3.1.3, Werkzeug 3.1.8, Authlib 1.7, pydantic 2.13.2,…
e7418eb 
… etc.

Rolls up the open dependabot PRs #65, #66, #69, #72, #73, #74, #75, #76
into a single commit. Each bump is a minor/patch release with no breaking
changes relevant to this codebase; all chat.completions / Flask-SocketIO
/ pydantic-v1-validator usage continues to work.

- Flask[async]       3.1.2 -> 3.1.3   (#65, #72)
- Flask-SocketIO     5.6.0 -> 5.6.1   (#66)
- Werkzeug           3.1.5 -> 3.1.8   (#73; supersedes master-targeting #67
                                        which wanted 3.1.6)
- python-dotenv      1.2.1 -> 1.2.2   (#69)
- requests           2.32.5 -> 2.33.1 (#74)
- pydantic           2.12.5 -> 2.13.2 (#76)
- Authlib            1.6.8 -> 1.7.0   (#75)

Doing this as one commit on dev because dev has diverged from master
(Phase 0 + Phase 1 security/architectural work) and each dependabot PR
has a requirements.txt conflict against the new pins we added — resolving
8 of those by hand is more churn than just bumping the versions directly.
@Bentlybro
Copy link
Copy Markdown
Member

Bentlybro commented Apr 22, 2026

Superseded by e7418eb on dev, which rolls this bump up with the rest of the open dependabot PRs into a single commit. Needed because dev has diverged from master with Phase 0 + Phase 1 work and resolving 8 individual requirements.txt conflicts is more churn than a direct bump. Thanks @dependabot 🤖

@Bentlybro Bentlybro closed this Apr 22, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 22, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/pip/dev/requests-2.33.1 branch April 22, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Bentlybro