- Update to 2.32.5
* The SSLContext caching feature originally introduced in 2.32.0 has
created a new class of issues in Requests that have had negative
impact across a number of use cases. The Requests team has decided
to revert this feature as long term maintenance of it is proving
to be unsustainable in its current iteration.
* Added support for Python 3.14.
* Dropped support for Python 3.8 following its end of support.
- Drop inject-default-ca-bundles.patch, fixed upstream
- Drop revert-caching-default-sslcontext.patch, merged upstream
- Update BuildRequires from setup.py
OBS-URL: https://build.opensuse.org/request/show/1308365
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=199
- update to 2.32.4:
* CVE-2024-47081 Fixed an issue where a maliciously crafted URL
and trusted environment will retrieve credentials for the wrong
hostname/machine from a netrc file
* Numerous documentation improvements
* Added support for pypy 3.11 for Linux and macOS.
* Dropped support for pypy 3.9 following its end of support.
- drop CVE-2024-47081.patch (merged upstream)
- Switch to pyproject macros.
- Remove Requires on python-py, it should have been removed earlier.
OBS-URL: https://build.opensuse.org/request/show/1284404
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-requests?expand=0&rev=87
* CVE-2024-47081 Fixed an issue where a maliciously crafted URL
and trusted environment will retrieve credentials for the wrong
hostname/machine from a netrc file
* Numerous documentation improvements
* Added support for pypy 3.11 for Linux and macOS.
* Dropped support for pypy 3.9 following its end of support.
- drop CVE-2024-47081.patch (merged upstream)
- Switch to pyproject macros.
- Remove Requires on python-py, it should have been removed earlier.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=195
- update to 2.32.3:
* Fixed bug breaking the ability to specify custom SSLContexts
in sub-classes of HTTPAdapter.
* Fixed issue where Requests started failing to run on Python
versions compiled without the `ssl` module.
* To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
* Fixed an issue where setting verify=False on the first request from a Session
will cause subsequent requests to the same origin to also ignore cert verification,
* verify=True now reuses a global SSLContext which should improve request time
* Requests now supports optional use of character detection (chardet or charset_normalizer)
when repackaged or vendored. This enables pip and other projects to minimize their
OBS-URL: https://build.opensuse.org/request/show/1179087
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-requests?expand=0&rev=82
* Fixed bug breaking the ability to specify custom SSLContexts
in sub-classes of HTTPAdapter.
* Fixed issue where Requests started failing to run on Python
versions compiled without the `ssl` module.
* To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
* Fixed an issue where setting verify=False on the first request from a Session
will cause subsequent requests to the same origin to also ignore cert verification,
* verify=True now reuses a global SSLContext which should improve request time
* Requests now supports optional use of character detection (chardet or charset_normalizer)
when repackaged or vendored. This enables pip and other projects to minimize their
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=185
- Update to 2.32.1
* Fixed an issue where setting verify=False on the first request from a Session
will cause subsequent requests to the same origin to also ignore cert verification,
regardless of the value of verify. (bsc#1224788, CVE-2024-35195)
* verify=True now reuses a global SSLContext which should improve request time
variance between first and subsequent requests.
* Requests now supports optional use of character detection (chardet or charset_normalizer)
when repackaged or vendored. This enables pip and other projects to minimize their
vendoring surface area.
* Requests has officially added support for CPython 3.12 and dropped support for CPython 3.7.
* Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system using hatchling.
OBS-URL: https://build.opensuse.org/request/show/1175561
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=182
- switch from unmaintained brotlipy to Brotli (same as urllib3)
- allow using newest version of charset-normalizer (3.0+)
- Skip test_pyopenssl_redirect due to gh#psf/requests#5846
- add 5711.patch from upstream instead to remove idna<3 pin
can install the new idna dropping python2
- refreshed requests-no-hardcoded-version.patch
- Do not require full python, (implicit) python-base is sufficient.
- Skip one more test that is flaky
- -test subpackage must be empty
* Only load the idna library when we’ve determined we need it.
* Fixed an issue with JSON encoding detection, specifically detecting
- Fixed requests-do-not-use-bundle.patch
requests-do-not-use-bundle.patch
- fix license (Apache-2.0 only)
- Now has a "security" package extras set,
- Bugfix for responses that attempt to redirect to themselves
- Support for connect timeouts! Timeout now accepts a tuple
(connect, read) which is used to set individual connect and
- update to 1.2.0:
+ charade: LGPL-2.1+
OBS-URL: https://build.opensuse.org/request/show/1110368
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-requests?expand=0&rev=80
- allow using newest version of charset-normalizer (3.0+)
- Skip test_pyopenssl_redirect due to gh#psf/requests#5846
- add 5711.patch from upstream instead to remove idna<3 pin
can install the new idna dropping python2
- refreshed requests-no-hardcoded-version.patch
- Do not require full python, (implicit) python-base is sufficient.
- Skip one more test that is flaky
- -test subpackage must be empty
* Only load the idna library when we’ve determined we need it.
* Fixed an issue with JSON encoding detection, specifically detecting
- Fixed requests-do-not-use-bundle.patch
requests-do-not-use-bundle.patch
- fix license (Apache-2.0 only)
- Now has a "security" package extras set,
- Bugfix for responses that attempt to redirect to themselves
- Support for connect timeouts! Timeout now accepts a tuple
(connect, read) which is used to set individual connect and
- update to 1.2.0:
+ charade: LGPL-2.1+
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=180
- Delete requests-no-hardcoded-version.patch
- Security Update to 2.31.0 (bsc#1211674):
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of Proxy-Authorization headers to destination servers when
following HTTPS redirects.
When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a Proxy-Authorization header that is attached to the request to
authenticate with the proxy.
In cases where Requests receives a redirect response, it previously reattached
the Proxy-Authorization header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.
Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.
Full details can be read in our Github Security Advisory
and CVE-2023-32681.
OBS-URL: https://build.opensuse.org/request/show/1092607
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-requests?expand=0&rev=79
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of Proxy-Authorization headers to destination servers when
following HTTPS redirects.
When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a Proxy-Authorization header that is attached to the request to
authenticate with the proxy.
In cases where Requests receives a redirect response, it previously reattached
the Proxy-Authorization header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.
Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.
Full details can be read in our Github Security Advisory
and CVE-2023-32681.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=177
* Officially added support for Python 3.10. (#5928)
* Added a `requests.exceptions.JSONDecodeError` to unify JSON exceptions between
Python 2 and 3. This gets raised in the `response.json()` method, and is
backwards compatible as it inherits from previously thrown exceptions.
Can be caught from `requests.exceptions.RequestException` as well. (#5856)
* Improved error text for misnamed `InvalidSchema` and `MissingSchema`
exceptions. This is a temporary fix until exceptions can be renamed
(Schema->Scheme). (#6017)
* Improved proxy parsing for proxy URLs missing a scheme. This will address
recent changes to `urlparse` in Python 3.9+. (#5917)
* Fixed defect in `extract_zipped_paths` which could result in an infinite loop
for some paths. (#5851)
* Fixed handling for `AttributeError` when calculating length of files obtained
by `Tarfile.extractfile()`. (#5239)
* Fixed urllib3 exception leak, wrapping `urllib3.exceptions.InvalidHeader` with
`requests.exceptions.InvalidHeader`. (#5914)
* Fixed bug where two Host headers were sent for chunked requests. (#5391)
* Fixed regression in Requests 2.26.0 where `Proxy-Authorization` was
incorrectly stripped from all requests sent with `Session.send`. (#5924)
* Fixed performance regression in 2.26.0 for hosts with a large number of
proxies available in the environment. (#5924)
* Fixed idna exception leak, wrapping `UnicodeError` with
`requests.exceptions.InvalidURL` for URLs with a leading dot (.) in the
domain. (#5414)
* Requests support for Python 2.7 and 3.6 will be ending in 2022. While we
don't have exact dates, Requests 2.27.x is likely to be the last release
series providing support.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=156
- Correct {Build,}Requires for charset_normalizer.
- Add trustme to BuildRequires for the test suite.
- update to 2.26.0:
- `Session.send` now correctly resolves proxy configurations from both
the Session and Request. Behavior now matches `Session.request`. (#5681)
- Fixed a race condition in zip extraction when using Requests in parallel
from zip archive. (#5707)
- Instead of `chardet`, use the MIT-licensed `charset_normalizer` for Python3
to remove license ambiguity for projects bundling requests.
- Requests now supports `idna` 3.x on Python 3. `idna` 2.x will continue to
be used on Python 2 installations. (#5711)
- The `requests[security]` extra has been converted to a no-op install.
PyOpenSSL is no longer the recommended secure option for Requests. (#5867)
- Requests has officially dropped support for Python 3.5. (#5867)
- drop 5711.patch: upstream
OBS-URL: https://build.opensuse.org/request/show/928315
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-requests?expand=0&rev=71
- `Session.send` now correctly resolves proxy configurations from both
the Session and Request. Behavior now matches `Session.request`. (#5681)
- Fixed a race condition in zip extraction when using Requests in parallel
from zip archive. (#5707)
- Instead of `chardet`, use the MIT-licensed `charset_normalizer` for Python3
to remove license ambiguity for projects bundling requests.
- Requests now supports `idna` 3.x on Python 3. `idna` 2.x will continue to
be used on Python 2 installations. (#5711)
- The `requests[security]` extra has been converted to a no-op install.
PyOpenSSL is no longer the recommended secure option for Requests. (#5867)
- Requests has officially dropped support for Python 3.5. (#5867)
- drop 5711.patch: upstream
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-requests?expand=0&rev=154
