310a047fdd
- Update to 2.6.3 * Fixed a high-severity security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (GHSA-38jv-5279-wg99) (bsc#1256331, CVE-2026-21441) * Started treating `Retry-After times greater than 6 hours as 6 hours by default. (#3743) * Fixed urllib3.connection.VerifiedHTTPSConnection` on Emscripten. (#3752)
Markéta Machová2026-01-13 14:05:11 +00:00
036b503cc3
Backport fix to address CVE-2026-21441
slfo-1.2
John Paul Adrian Glaubitz
2026-01-13 11:08:08 +01:00
fb6b6ac030
Accepting request 1325966 from devel:languages:python
Ana Guerrero2026-01-09 16:02:44 +00:00
6a84f8d26a
- Update to 2.6.2 * Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. - Update to 2.6.1 * Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. - Update to 2.6.0 * Security: - Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471, GHSA-2xpw-w6gg-jr37, bsc#1254867) - Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the Content-Encoding header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418, GHSA-gm62-xv2j-4w53, bsc#1254866) * Features: - Enabled retrieval, deletion, and membership testing in HTTPHeaderDict using bytes keys. - Added host and port information to string representations of HTTPConnection. - Added support for Python 3.14 free-threading builds explicitly. * Removals: - Removed the HTTPResponse.getheaders() method in favor of HTTPResponse.headers. Removed the HTTPResponse.getheader(name, default) method in favor of HTTPResponse.headers.get(name, default). * Bugfixes: - Fixed redirect handling in urllib3.PoolManager when an integer is passed for the retries parameter. - Fixed HTTPConnectionPool when used in Emscripten with no explicit port. - Fixed handling of SSLKEYLOGFILE with expandable variables. * Misc: - Changed the zstd extra to install backports.zstd instead of zstandard on Python 3.13 and before. - Improved the performance of content decoding by optimizing BytesQueueBuffer class. - Allowed building the urllib3 package with newer setuptools-scm v9.x. - Ensured successful urllib3 builds by setting Hatchling requirement to ≥ 1.27.0.
Markéta Machová2026-01-08 13:44:15 +00:00
c7e3c17e34
Accepting request 1287779 from devel:languages:python
Ana Guerrero2025-06-24 18:45:47 +00:00
75573f8736
- Update to 2.5.0: * Security issues Pool managers now properly control redirects when retries is passed (CVE-2025-50181, GHSA-pq67-6m6q-mj2v, bsc#1244925) Redirects are now controlled by urllib3 in the Node.js runtime (CVE-2025-50182, GHSA-48p4-8xcf-vxj5, bsc#1244924) * Features Added support for the compression.zstd module that is new in Python 3.14. Added support for version 0.5 of hatch-vcs * Bugfixes Raised exception for HTTPResponse.shutdown on a connection already released to the pool. Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in [].
Steve Kowalik2025-06-23 02:04:11 +00:00
fa15163672
- Update to 2.4.0 * Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522) * Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567) * Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571) * Fixed a bug with partial reads of streaming data in Emscripten. (#3555) * Switched to uv for installing development dependecies. (#3550) * Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566) - 2.3.0: * Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response. It calls shutdown(SHUT_RD) on the underlying socket. This feature was sponsored by LaunchDarkly. (#2868) * Added support for JavaScript Promise Integration on Emscripten. This enables more efficient WebAssembly requests and streaming, and makes it possible to use in Node.js if you launch it as node --experimental-wasm-stack-switching. (#3400) * Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection. (#3285) * Added pickling support to NewConnectionError and NameResolutionError. (#3480) * Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1". (#3489) * Removed support for Python 3.8. (#3492)
Daniel Garcia2025-05-27 09:29:34 +00:00
af9a86ac19
- Skip test_close_after_handshake flaky test, it fails sometimes in ppc64le and s390x architectures, bsc#1243583
Daniel Garcia2025-05-27 08:55:03 +00:00
2e3a3af491
Accepting request 1232162 from devel:languages:python
Ana Guerrero2024-12-19 20:40:18 +00:00
c9bda474fd
- Skip some flaky tests that fail sometimes in OBS (bsc#1234681)
Daniel Garcia2024-12-19 10:26:30 +00:00
9860f9689b
Accepting request 1231820 from devel:languages:python
Ana Guerrero2024-12-18 19:09:10 +00:00
ef1a31c0b1
- Ignore DeprecationWarning in tests (bsc#1234681)
Daniel Garcia2024-12-18 08:42:44 +00:00
a5d1101265
Accepting request 1205339 from devel:languages:python
Ana Guerrero2024-10-03 16:00:38 +00:00
a6661b64be
- Update to 2.2.3: * Features + Added support for Python 3.13. * Bugfixes + Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. + Fixed ResourceWarning on CONNECT with Python < 3.11.4 by backporting python/cpython#103472. + Fixed a crash where certain standard library hash functions were absent in restricted environments. + Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. + Allowed passing negative integers as amt to read methods of http.client.HTTPResponse as an alternative to None. + Fixed issue where InsecureRequestWarning was emitted for HTTPS connections when using Emscripten. + Fixed HTTPConnectionPool.urlopen to stop automatically casting non-proxy headers to HTTPHeaderDict. This change was premature as it did not apply to proxy headers and HTTPHeaderDict does not handle byte header values correctly yet. + Changed InvalidChunkLength to ProtocolError when response terminates before the chunk length is sent. + Changed ProtocolError to be more verbose on incomplete reads with excess content. + Added support for HTTPResponse.read1() method. + Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. + Fixed HTTPConnection.proxy_is_verified and
Steve Kowalik2024-09-24 05:07:08 +00:00
259b7264d6
Accepting request 1181456 from devel:languages:python
Ana Guerrero2024-06-18 20:50:46 +00:00
020c67f782
Accepting request 1138118 from devel:languages:python
Ana Guerrero2024-01-12 22:44:33 +00:00
95eb7884e4
- Add upstream patch openssl-3.2.patch, to fix tests with opennssl 3.2.0, gh#urllib3/urllib3#3271
Daniel Garcia2024-01-11 11:49:26 +00:00
6533ff8336
Accepting request 1130850 from devel:languages:python
Ana Guerrero2023-12-05 16:02:48 +00:00
e748795144
- update to 2.1.0: * Removed support for the deprecated urllib3[secure] extra. * Removed support for the deprecated SecureTransport TLS implementation. * Removed support for the end-of-life Python 3.7. * Allowed loading CA certificates from memory for proxies. * Fixed decoding Gzip-encoded responses which specified `x-gzip` content-encoding.
Dirk Mueller2023-11-27 20:30:05 +00:00
91110ae749
Accepting request 1118603 from devel:languages:python
Ana Guerrero2023-10-19 20:46:47 +00:00
2e198fd675
- update to 2.0.7 (bsc#1216377, CVE-2023-45803): * Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses.
Daniel Garcia2023-10-18 14:25:18 +00:00
027dfe1969
Accepting request 1117485 from devel:languages:python
Ana Guerrero2023-10-13 21:13:49 +00:00
761c1d117d
Accepting request 1117445 from home:fcrozat:branches:devel:languages:python
Matej Cepl2023-10-12 14:33:44 +00:00
b0cb844771
Accepting request 1115892 from devel:languages:python
Ana Guerrero2023-10-06 19:12:45 +00:00
71ecb78924
- update to 2.0.6 (bsc#1215968, CVE-2023-43804): * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect - 2.0.5: * Allowed pyOpenSSL third-party module without any deprecation warning. #3126 * Fixed default blocksize of HTTPConnection classes to match high-level classes. Previously was 8KiB, now 16KiB. #3066Daniel Garcia2023-10-05 15:48:58 +00:00
0aa6795e5a
Accepting request 1112725 from devel:languages:python
Ana Guerrero2023-09-21 20:20:25 +00:00
9e2080ddfc
* Changed HTTPConnection.request_chunked() to not erroneously emit multiple * Added `urllib3.util.SKIP_HEADER for skipping User-Agent, Accept-Encoding`, - Add missing dependency on python-six (bsc#1150895) - update to 1.25 (bsc#1132663, bsc#1129071, CVE-2019-9740, CVE-2019-11236): * Allow providing a list of headers to strip from requests when redirecting without repeatedly flushing the decoder, to function better on * Accept ca_cert_dir for SSL-related PoolManager configuration. - add python-pyOpenSSL, python-certifi and python-pyasn1 requirements - Comment out test requirements, as tests are disabled anyway, and * Add support for directories of certificate authorities, as * New exception: NewConnectionError, raised when we fail to - Update 0001-Don-t-pin-dependency-to-exact-version.patch * Shuffled around development-related files. If you're maintaining a distro package of urllib3, you may need * Unverified HTTPS requests will trigger a warning on the first * New retry logic and urllib3.util.retry.Retry configuration * All raised exceptions should now wrapped in a urllib3.exceptions.HTTPException-extending exception. urllib3.exceptions.MaxRetryError, including timeout-related exceptions which were previously exempt. Underlying error is * urllib3.exceptions.ConnectionError renamed to * Requesting an empty host will raise * Catch read timeouts over SSL connections as * Fix TLS verification when using a proxy in Python 3.4.1. * Add disable_cache option to urllib3.util.make_headers. * Wrap socket.timeout exception with * Fixed proxy-related bug where connections were being reused * Added socket_options keyword parameter which allows to define * Removed HTTPConnection.tcp_nodelay in favor of * Don't install dummyserver into site-packages as it's only
Dirk Mueller2023-09-21 08:23:11 +00:00
053c01be78
Accepting request 1109358 from devel:languages:python
Ana Guerrero2023-09-07 19:12:54 +00:00
2682ddb5ff
Accepting request 1100699 from devel:languages:python
Ana Guerrero2023-07-26 11:22:14 +00:00
c7e95ee43b
- update to 2.0.4: * Added support for union operators to `HTTPHeaderDict * Added BaseHTTPResponse to urllib3.__all__ (#3078 * Fixed `urllib3.connection.HTTPConnection to raise the http.client.connect` audit event to have the same behavior as the standard library HTTP client * Relied on the standard library for checking hostnames in supported PyPy releases
Dirk Mueller2023-07-25 18:37:53 +00:00
2ff9f6959c
Accepting request 1096959 from devel:languages:python
Fabian Vogt2023-07-06 16:28:04 +00:00
ebc06a4521
- Disable test_deprecated_no_scheme so it needs network connection to run correctly.
Daniel Garcia2023-07-05 11:43:00 +00:00
a2ae3b2049
- update to 2.0.3: * Allowed alternative SSL libraries such as LibreSSL, while still issuing a warning as we cannot help users facing issues with implementations other than OpenSSL. * Deprecated URLs which don't have an explicit scheme * Fixed response decoding with Zstandard when compressed data is made of several frames. * Fixed `assert_hostname=False` to correctly skip hostname check.
Dirk Mueller2023-06-19 20:27:38 +00:00
27eb919afe
- update to 2.0.2: * Fixed `HTTPResponse.stream()` to continue yielding bytes if buffered decompressed data was still available to be read even if the underlying socket is closed. This prevents a compressed response from being truncated.
Dirk Mueller2023-05-14 12:37:31 +00:00
927c3f301e
Ignore a file that does not play well on OBS
Steve Kowalik2023-05-10 07:29:01 +00:00
9375f787df
- Update to 2.0.1: * Fixed a socket leak when fingerprint or hostname verifications fail. * Fixed an error when HTTPResponse.read(0) was the first read call or when the internal response body buffer was otherwise empty. * Removed support for Python 2.7, 3.5, and 3.6. * Removed fallback on certificate commonName in match_hostname() function. * Removed support for Python with an ssl module compiled with LibreSSL, CiscoSSL, wolfSSL, and all other OpenSSL alternatives. * Removed support for OpenSSL versions earlier than 1.1.1. * Removed urllib3.contrib.appengine.AppEngineManager and support for Google App Engine Standard Environment. * Changed ssl_version to instead set the corresponding SSLContext.minimum_version and SSLContext.maximum_version values. * Changed default SSLContext.minimum_version to be TLSVersion.TLSv1_2 in line with Python 3.10. * Changed urllib3.util.create_urllib3_context to not override the system cipher suites with a default value. * Changed multipart/form-data header parameter formatting matches the WHATWG HTML Standard as of 2021-06-10. * Changed HTTPConnection.request() to always use lowercase chunk boundaries when sending requests with Transfer-Encoding: chunked. * Changed enforce_content_length default to True, preventing silent data loss when reading streamed responses. * Changed all parameters in the HTTPConnection and HTTPSConnection constructors to be keyword-only except host and port. * Changed HTTPConnection.getresponse() to set the socket timeout from HTTPConnection.timeout value before reading data from the socket. * Changed name of Retry.BACK0FF_MAX to be Retry.DEFAULT_BACKOFF_MAX. * Changed TLS handshakes to use SSLContext.check_hostname when possible. * Changed the default blocksize to 16KB to match OpenSSL's default read
Steve Kowalik2023-05-03 06:50:37 +00:00
2ac700f523
- update to 1.26.15: * Fix socket timeout value when `HTTPConnection` is reused * Remove "!" character from the unreserved characters in IPv6 Zone ID parsing * Fix IDNA handling of '' byte
Dirk Mueller2023-03-14 22:47:38 +00:00
3f9ddd55c5
- update to 1.26.12: * Deprecated the urllib3[secure] extra and the urllib3.contrib.pyopenssl module. Both will be removed in v2.x. See this GitHub issue <https://github.com/urllib3/urllib3/issues/2680>_ for justification and info on how to migrate.
Dirk Mueller2022-08-22 22:02:52 +00:00
a6fe4b937e
Accepting request 992365 from home:bnavigator:branches:devel:languages:python
Matej Cepl2022-08-02 16:42:20 +00:00
b5aef7fbb3
- refresh remove_mock.patch with extra mock usages - Remove unneeded BuildRequires of mock.
Dirk Mueller2022-08-02 14:55:32 +00:00
aecb18b5a2
- update to 1.26.10: * Removed support for Python 3.5 * Fixed an issue where a `ProxyError` recommending configuring the proxy as HTTP instead of HTTPS could appear even when an HTTPS proxy wasn't configured.
Dirk Mueller2022-07-24 08:04:55 +00:00
8b7b942d17
Accepting request 967156 from home:bnavigator:branches:devel:languages:python
Markéta Machová2022-04-06 05:43:40 +00:00
51cc811858
- update to 1.26.9: * Changed `urllib3[brotli] extra to favor installing Brotli libraries that are still receiving updates like brotli and brotlicffi instead of brotlipy. This change does not impact behavior of urllib3, only which dependencies are installed. * Fixed a socket leaking when HTTPSConnection.connect() raises an exception. * Fixed server_hostname being forwarded from PoolManager to HTTPConnectionPool` when requesting an HTTP URL. Should only be forwarded when requesting an HTTPS URL.
Dirk Mueller2022-03-29 11:48:46 +00:00
768d17111c
- update to 1.26.8: * Added extra message to`urllib3.exceptions.ProxyError when urllib3 detects that a proxy is configured to use HTTPS but the proxy itself appears to only use HTTP. * Added a mention of the size of the connection pool when discarding a connection due to the pool being full. * Added explicit support for Python 3.11. * Deprecated the Retry.MAX_BACKOFF class property in favor of Retry.DEFAULT_MAX_BACKOFF to better match the rest of the default parameter names. Retry.MAX_BACKOFF is removed in v2.0. * Changed location of the vendored ssl.match_hostname function from urllib3.packages.ssl_match_hostname to urllib3.util.ssl_match_hostname` to ensure Python 3.10+ compatibility after being repackaged by downstream distributors. * Fixed absolute imports, all imports are now relative.
Dirk Mueller2022-01-10 22:42:38 +00:00
916eaab761
- update to 1.26.7: * Fixed a bug with HTTPS hostname verification involving IP addresses and lack of SNI. * Fixed a bug where IPv6 braces weren't stripped during certificate hostname matching.
Dirk Mueller2021-10-26 21:03:35 +00:00
42309fe0fc
Accepting request 906097 from home:mcalabkova:branches:devel:languages:python
Markéta Machová2021-07-13 11:12:32 +00:00
7857238dd7
Accepting request 898448 from home:jgrassler:branches:devel:languages:python
Matej Cepl2021-06-08 16:31:30 +00:00
603e48d703
- update to 1.26.5: * Fixed deprecation warnings emitted in Python 3.10. * Updated vendored `six` library to 1.16.0. * Improved performance of URL parser when splitting the authority component.
Dirk Mueller2021-06-06 12:03:15 +00:00
febcba0e07
Accepting request 879507 from devel:languages:python
Richard Brown
2021-03-19 15:39:55 +00:00
1378162248
- update to 1.26.4: * Changed behavior of the default `SSLContext when connecting to HTTPS proxy during HTTPS requests. The default SSLContext now sets check_hostname=True`.
Dirk Mueller2021-03-16 21:10:36 +00:00
b0430c52db
- update to 1.26.3: * Fixed bytes and string comparison issue with headers (Pull #2141) * Changed `ProxySchemeUnknown` error message to be more actionable if the user supplies a proxy URL without a scheme. (Pull #2107)
Dirk Mueller2021-01-28 23:21:12 +00:00
b29a44bf2a
Accepting request 859717 from home:bnavigator:branches:devel:languages:python
Dirk Mueller2021-01-01 13:52:44 +00:00
bc99e941fc
- Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail.
Matej Cepl2020-12-17 19:34:50 +00:00
40597c3fed
- gh#urllib3/urllib3#2109 is actually not reproduceable, so don't skip test_timeout_errors_cause_retries.
Matej Cepl2020-12-17 18:15:47 +00:00
27a1b50886
Accepting request 855327 from home:mcepl:branches:devel:tools:scm
Matej Cepl2020-12-12 11:58:21 +00:00
36a5e3eac9
Accepting request 854910 from home:mcalabkova:branches:devel:languages:python
Markéta Machová2020-12-11 15:05:01 +00:00
39b831d5b8
- update to 1.26.2: * Fixed an issue where `wrap_socket and CERT_REQUIRED wouldn't be imported properly on Python 2.7.8 and earlier (Pull #2052) * Fixed an issue where two User-Agent headers would be sent if a User-Agent header key is passed as bytes (Pull #2047) * Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806) * Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that still wish to use TLS earlier than 1.2 without a deprecation warning should opt-in explicitly by setting ssl_version=ssl.PROTOCOL_TLSv1_1 (Pull #2002) **Starting in urllib3 v2.0: Connections that receive a DeprecationWarning will fail** * Deprecated Retry options Retry.DEFAULT_METHOD_WHITELIST, Retry.DEFAULT_REDIRECT_HEADERS_BLACKLIST and Retry(method_whitelist=...) in favor of Retry.DEFAULT_ALLOWED_METHODS, Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT, and Retry(allowed_methods=...) (Pull #2000) **Starting in urllib3 v2.0: Deprecated options will be removed** * Added default User-Agent header to every request (Pull #1750) * Added urllib3.util.SKIP_HEADER for skipping User-Agent, Accept-Encoding, and Host headers from being automatically emitted with requests (Pull #2018) * Collapse transfer-encoding: chunked request data and framing into the same socket.send() call (Pull #1906) * Send http/1.1 ALPN identifier with every TLS handshake by default (Pull #1894) * Properly terminate SecureTransport connections when CA verification fails (Pull #1977) * Don't emit an SNIMissingWarning when passing server_hostname=None to SecureTransport (Pull #1903) * Disabled requesting TLSv1.2 session tickets as they weren't being used by urllib3 (Pull #1970) * Suppress BrokenPipeError when writing request body after the server has closed the socket (Pull #1524) * Wrap ssl.SSLError that can be raised from reading a socket (e.g. "bad MAC") into an urllib3.exceptions.SSLError (Pull #1939) * Fix retry backoff time parsed from Retry-After` header when given in the HTTP date format. The HTTP date was parsed as the local timezone
Dirk Mueller2020-11-26 09:03:43 +00:00
d7d78a1c8f
- update to 1.25.10: * Added support for `SSLKEYLOGFILE environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to send() to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert None into ConnectionPool if the pool was empty when requesting a connection (Pull #1866) * Avoid hasattr call in BrotliDecoder.decompress()` (Pull #1858)
Dirk Mueller2020-08-04 16:10:31 +00:00
nkrapp
Ana Guerrero
Markéta Machová
John Paul Adrian Glaubitz
Steve Kowalik
Dominique Leuenberger
Daniel Garcia
Dirk Mueller
Matej Cepl
Fabian Vogt
Robert Schweikert
Richard Brown
Tomáš Chvátal