build(deps): update niquests requirement from <3.16,>=3.14 to >=3.14,<3.17

[dependabot]

Updates the requirements on niquests to permit the latest version.

Release notes

Sourced from niquests's releases.

Version 3.16.0

3.16.0 (2025-12-23)

Added

• Custom strategies for TLS revocation check per Session or AsyncSession via the new revocation_configuration parameter that takes a RevocationConfiguration object.
• Hook can now be created via a custom class. You may now inherit from niquests.LifecycleHook or niquests.AsyncLifecycleHook depending on your use case. This should considerably ease the scenario where you need to create complex hooks.
• Session underlying pooling state inspecting through repr(my_session) for debugging purposes.
• Exposed ServerSentEvent in top level package imports to ease SSE related developments.
• AsyncHTTPDigestAuth counterpart of HTTPDigestAuth for async usage. (#308)
• Shortcut to pass default headers via Session or AsyncSession construction. (#310)

Fixed

• In high concurrency scenarii the revocation check may run for multiple newly acquired connection causing a performance slowdown at warmup.

Changelog

Sourced from niquests's changelog.

3.16.0 (2025-12-23)

Added

• Custom strategies for TLS revocation check per Session or AsyncSession via the new revocation_configuration parameter that takes a RevocationConfiguration object.
• Hook can now be created via a custom class. You may now inherit from niquests.LifecycleHook or niquests.AsyncLifecycleHook depending on your use case. This should considerably ease the scenario where you need to create complex hooks.
• Session underlying pooling state inspecting through repr(my_session) for debugging purposes.
• Exposed ServerSentEvent in top level package imports to ease SSE related developments.
• AsyncHTTPDigestAuth counterpart of HTTPDigestAuth for async usage.
• Shortcut to pass default headers via Session or AsyncSession construction.

Fixed

• In high concurrency scenarii the revocation check may run for multiple newly acquired connection causing a performance slowdown at warmup.

3.15.2 (2025-08-16)

Fixed

• The return type of CaseInsensitiveDict.items() could be a list instead of an expected tuple. (#276)
• Omitting hooks (keys) in Session.hooks dict causing an error at merge with request specific hooks.
• CRL cache not persisted when pickling Session.

3.15.1 (2025-08-13)

Changed

• Disabled OCSP and CRL signature check when either the target site is located in a private network OR at least one proxy is used. See #274 for the rationale behind it.

Fixed

• Using Happy Eyeballs algorithm in async could trigger a warning about OCSP/CRL check in strict mode while no error really occurred. This was due to async cancellation propagated to tasks that did not finish through after getting a valid connection usable.

3.15.0 (2025-08-11)

Security

• Prevent MITM attack with OCSP. Previous to that version we did not check the signature against the issuer public key. While this sort of attack are indubitably rare, we prefer encouraging users to upgrade as soon as possible.

Added

• Support for CRLs in addition to our OCSP solution when the peer certificate does not support OCSP. It acts as a fallback method to check for the revocation status. This comes (in response to) shortly after the removal of Let's Encrypt OCSP responder. We are investigating if we should implement a boolean toggle to let the user prefer CRL instead of OCSP by default in a next version. Give us your ideas and feedbacks before!
• Explicit support for Python 3.14

Changed

... (truncated)

Commits

• 288c4d9 🐛 missing headers kwargs in AsyncSession
• 8b15c71 📝 add changelog entry for "add support for init header in Session"
• f7e1c63 ⬆️ Bump github/codeql-action from 3.30.1 to 4.31.6 (#306)
• 2957830 ⬆️ Bump actions/upload-artifact from 4.6.1 to 5.0.0 (#296)
• f2bd536 ⬆️ Bump actions/download-artifact from 5.0.0 to 6.0.0 (#297)
• dec40b3 ⬆️ Bump actions/checkout from 5.0.0 to 6.0.0 (#304)
• 690394d ⬆️ Bump actions/setup-python from 6.0.0 to 6.1.0 (#305)
• 5284a2b Add async digest auth (#308)
• f734f90 feat: add support for init header in Session (#310)
• 479fcf3 Release 3.16.0 (#311)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #968.