* Fixed bug breaking the ability to specify custom SSLContexts
in sub-classes of HTTPAdapter.
* Fixed issue where Requests started failing to run on Python
versions compiled without the `ssl` module.
* To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
* Fixed an issue where setting verify=False on the first request from a Session
will cause subsequent requests to the same origin to also ignore cert verification,
* verify=True now reuses a global SSLContext which should improve request time
* Requests now supports optional use of character detection (chardet or charset_normalizer)
when repackaged or vendored. This enables pip and other projects to minimize their
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=185
- Update to 2.32.1
* Fixed an issue where setting verify=False on the first request from a Session
will cause subsequent requests to the same origin to also ignore cert verification,
regardless of the value of verify. (bsc#1224788, CVE-2024-35195)
* verify=True now reuses a global SSLContext which should improve request time
variance between first and subsequent requests.
* Requests now supports optional use of character detection (chardet or charset_normalizer)
when repackaged or vendored. This enables pip and other projects to minimize their
vendoring surface area.
* Requests has officially added support for CPython 3.12 and dropped support for CPython 3.7.
* Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system using hatchling.
OBS-URL: https://build.opensuse.org/request/show/1175561
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=182
- allow using newest version of charset-normalizer (3.0+)
- Skip test_pyopenssl_redirect due to gh#psf/requests#5846
- add 5711.patch from upstream instead to remove idna<3 pin
can install the new idna dropping python2
- refreshed requests-no-hardcoded-version.patch
- Do not require full python, (implicit) python-base is sufficient.
- Skip one more test that is flaky
- -test subpackage must be empty
* Only load the idna library when we’ve determined we need it.
* Fixed an issue with JSON encoding detection, specifically detecting
- Fixed requests-do-not-use-bundle.patch
requests-do-not-use-bundle.patch
- fix license (Apache-2.0 only)
- Now has a "security" package extras set,
- Bugfix for responses that attempt to redirect to themselves
- Support for connect timeouts! Timeout now accepts a tuple
(connect, read) which is used to set individual connect and
- update to 1.2.0:
+ charade: LGPL-2.1+
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=180
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of Proxy-Authorization headers to destination servers when
following HTTPS redirects.
When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a Proxy-Authorization header that is attached to the request to
authenticate with the proxy.
In cases where Requests receives a redirect response, it previously reattached
the Proxy-Authorization header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.
Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.
Full details can be read in our Github Security Advisory
and CVE-2023-32681.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=177
* Officially added support for Python 3.10. (#5928)
* Added a `requests.exceptions.JSONDecodeError` to unify JSON exceptions between
Python 2 and 3. This gets raised in the `response.json()` method, and is
backwards compatible as it inherits from previously thrown exceptions.
Can be caught from `requests.exceptions.RequestException` as well. (#5856)
* Improved error text for misnamed `InvalidSchema` and `MissingSchema`
exceptions. This is a temporary fix until exceptions can be renamed
(Schema->Scheme). (#6017)
* Improved proxy parsing for proxy URLs missing a scheme. This will address
recent changes to `urlparse` in Python 3.9+. (#5917)
* Fixed defect in `extract_zipped_paths` which could result in an infinite loop
for some paths. (#5851)
* Fixed handling for `AttributeError` when calculating length of files obtained
by `Tarfile.extractfile()`. (#5239)
* Fixed urllib3 exception leak, wrapping `urllib3.exceptions.InvalidHeader` with
`requests.exceptions.InvalidHeader`. (#5914)
* Fixed bug where two Host headers were sent for chunked requests. (#5391)
* Fixed regression in Requests 2.26.0 where `Proxy-Authorization` was
incorrectly stripped from all requests sent with `Session.send`. (#5924)
* Fixed performance regression in 2.26.0 for hosts with a large number of
proxies available in the environment. (#5924)
* Fixed idna exception leak, wrapping `UnicodeError` with
`requests.exceptions.InvalidURL` for URLs with a leading dot (.) in the
domain. (#5414)
* Requests support for Python 2.7 and 3.6 will be ending in 2022. While we
don't have exact dates, Requests 2.27.x is likely to be the last release
series providing support.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=156
- `Session.send` now correctly resolves proxy configurations from both
the Session and Request. Behavior now matches `Session.request`. (#5681)
- Fixed a race condition in zip extraction when using Requests in parallel
from zip archive. (#5707)
- Instead of `chardet`, use the MIT-licensed `charset_normalizer` for Python3
to remove license ambiguity for projects bundling requests.
- Requests now supports `idna` 3.x on Python 3. `idna` 2.x will continue to
be used on Python 2 installations. (#5711)
- The `requests[security]` extra has been converted to a no-op install.
PyOpenSSL is no longer the recommended secure option for Requests. (#5867)
- Requests has officially dropped support for Python 3.5. (#5867)
- drop 5711.patch: upstream
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=154
- remove patch pr_5251-pytest5.patch, not needed anymore.
- update to version 2.24.0:
- pyOpenSSL TLS implementation is now only used if Python
either doesn't have an `ssl` module or doesn't support
SNI. Previously pyOpenSSL was unconditionally used if available.
This applies even if pyOpenSSL is installed via the
`requests[security]` extra (#5443)
- Redirect resolution should now only occur when
`allow_redirects` is True. (#5492)
- No longer perform unnecessary Content-Length calculation for
requests that won't use it. (#5496)
OBS-URL: https://build.opensuse.org/request/show/822499
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=142
- restored Name section that got messed up by spec-cleaner
- specfile:
* remove devel for noarch
* remove restriction for urllib3 < 1.24
* HISTORY and README changed from .rst to .md
- update to version 2.20.0:
* Bugfixes
+ Content-Type header parsing is now case-insensitive
(e.g. charset=utf8 v Charset=utf8).
+ Fixed exception leak where certain redirect urls would raise
uncaught urllib3 exceptions.
+ Requests removes Authorization header from requests redirected
from https to http on the same hostname. (CVE-2018-18074)
+ should_bypass_proxies now handles URIs without hostnames
(e.g. files).
* Dependencies
+ Requests now supports urllib3 v1.24.
* Deprecations
+ Requests has officially stopped support for Python 2.6.
OBS-URL: https://build.opensuse.org/request/show/645391
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=112
- make multibuild package to resolve circular deps on tests
- make multibuild package to resolve circular deps on tests
- update to version 2.19.1:
* Fixed issue where status_codes.py’s init function failed trying
to append to a __doc__ value of None.
- update to version 2.19.0:
* Improvements
+ Warn about possible slowdown with cryptography version < 1.3.4
+ Check host in proxy URL, before forwarding request to adapter.
+ Maintain fragments properly across redirects. (RFC7231 7.1.2)
+ Removed use of cgi module to expedite library load time.
+ Added support for SHA-256 and SHA-512 digest auth algorithms.
+ Minor performance improvement to Request.content.
+ Migrate to using collections.abc for 3.7 compatibility.
* Bugfixes
+ Parsing empty Link headers with parse_header_links() no longer
return one bogus entry.
+ Fixed issue where loading the default certificate bundle from
a zip archive would raise an IOError.
+ Fixed issue with unexpected ImportError on windows system
which do not support winreg module.
+ DNS resolution in proxy bypass no longer includes the username
and password in the request. This also fixes the issue of DNS
queries failing on macOS.
+ Properly normalize adapter prefixes for url comparison.
+ Passing None as a file pointer to the files param no longer
raises an exception.
OBS-URL: https://build.opensuse.org/request/show/623059
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=109
- update to version 2.19.1:
* Fixed issue where status_codes.py’s init function failed trying
to append to a __doc__ value of None.
- update to version 2.19.0:
* Improvements
+ Warn about possible slowdown with cryptography version < 1.3.4
+ Check host in proxy URL, before forwarding request to adapter.
+ Maintain fragments properly across redirects. (RFC7231 7.1.2)
+ Removed use of cgi module to expedite library load time.
+ Added support for SHA-256 and SHA-512 digest auth algorithms.
+ Minor performance improvement to Request.content.
+ Migrate to using collections.abc for 3.7 compatibility.
* Bugfixes
+ Parsing empty Link headers with parse_header_links() no longer
return one bogus entry.
+ Fixed issue where loading the default certificate bundle from
a zip archive would raise an IOError.
+ Fixed issue with unexpected ImportError on windows system
which do not support winreg module.
+ DNS resolution in proxy bypass no longer includes the username
and password in the request. This also fixes the issue of DNS
queries failing on macOS.
+ Properly normalize adapter prefixes for url comparison.
+ Passing None as a file pointer to the files param no longer
raises an exception.
+ Calling copy on a RequestsCookieJar will now preserve the
cookie policy correctly.
* We now support idna v2.7 and urllib3 v1.23.
- Properly set idna/urllib3 dependency versions, runtime and buildtime
- Spec cleanup, remove conditionals for ancient distro versions
- Remove duplicates with fdupes
OBS-URL: https://build.opensuse.org/request/show/620316
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=108
