Skip to content

Bump requests from 2.32.3 to 2.33.0#905

Merged
calumbell merged 1 commit into
stagingfrom
dependabot/pip/requests-2.33.0
Apr 10, 2026
Merged

Bump requests from 2.32.3 to 2.33.0#905
calumbell merged 1 commit into
stagingfrom
dependabot/pip/requests-2.33.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026

Bumps requests from 2.32.3 to 2.33.0.

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

  • CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits
  • bc04dfd v2.33.0
  • 66d21cb Merge commit from fork
  • 8b9bc8f Move badges to top of README (#7293)
  • e331a28 Remove unused extraction call (#7292)
  • 753fd08 docs: fix FAQ grammar in httplib2 example
  • 774a0b8 docs(socks): same block as other sections
  • 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
  • ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
  • 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
  • d568f47 docs: clarify Quickstart POST example (#6960)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.33.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.3...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 6, 2026
Copy link
Copy Markdown
Contributor

@calumbell calumbell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Performed the following checks and everything looks good:

  • Read the changelogs to make sure there was nothing obvious in there that would give us issues
  • Spot checked on local Django development server (headless and being consumed by FE running on local Nuxt dev server)
  • pytest (all tests passing)
  • Integration tests all passing

@calumbell calumbell merged commit 45d4a9e into staging Apr 10, 2026
5 checks passed
@dependabot dependabot Bot deleted the dependabot/pip/requests-2.33.0 branch April 10, 2026 08:50
Copilot AI mentioned this pull request Apr 14, 2026
3 tasks
eepMoody added a commit that referenced this pull request Apr 15, 2026
* fixed parsing reaction conditions without parentheses (#842)

* Fix spell data regressions and omissions (#844)

* Fix spell data regressions from PR #842 and update newrelic API

* add missing higher-leve options

* add tests for duplicate or missing higher_level values

* Add missing casting options for deepm and spells-that-dont-suck

* fix freezing sphere being merged with freedom of movement

* Convert distance fields to integer (#845)

* Fix spell data regressions from PR #842 and update newrelic API

* add missing higher-leve options

* add tests for duplicate or missing higher_level values

* Add missing casting options for deepm and spells-that-dont-suck

* fix freezing sphere being merged with freedom of movement

* convert ambiguously precise fields to integers

* update test cases to reflect integers

* update decimal speed fallbacks

* fixed bugs in srd-2024 CreatureAction data (closes #847) (#849)

* fixed markdown errors in Creature spellcasting traits/actions (#855)

* updated srd-2014 dragon breath weapon recharge data (closes #848) (#853)

* removed prepended asterisks from toh/tdcs FeatBenefit 'desc' fields (closes #851) (#852)

* fixed bugs in srd-2024 spell markdown (closes #857)

* updated monster conversion script to scrap input md for bonus actions and reactions

* added missing srd-2024 creature reactions

* removed Mithral and Adamantine Hide Armor from srd-2014 dataset (closes #829)

* bugfix: added missing dash to bfrd mechanist starting equipment markdown

* added 2024 champion subclass data to ClassFeatureItem.json

* added srd-2024 College of Lore data to ClassFeatureItem.json

* replaced casting_times of 'bonus_action' w/ 'bonus-action' as per model spec

* wrote exclude_fields_mixin (and mvd mixins to own dir)

* added ExcludeFieldsMixin to model viewsets

* added missing srd-2024 dragon attack data to CreatureAttackAction

* removed /manifest from url, updated test cases to reflect rmvl

* rmv'd ManifestViewSet

* removed ManifestSerializer

* removed Manifest model

* rmv'd manifest from v1 API schema

* removed /version endpoint

* added character creation rules from srd-2024 (#878)

* Added filter on monsters for environments (#884)

* fixed typo in srd-2024 Adult Green Dragon spellcasting action (#891)

* [BUGFIX] Fixed data errors on `/v2/rulesets/srd_combat-sequence` (#893)

* removed references to <srd:opportunity-attacks> in all open5e data

* fixed ruleset/srd_combat-sequence blockquote markdown

* added missing ClassFeatureItem for Fighter two extra attacks action (#895)

* removed server/vector_index.pkl from repo (#883)

* removed leading slashes on Image file_urls (#886)

* [CI/CD] Upgrade Github Action versions to Node 24 compatable versions (#901)

* updated checkout github action to v6

* updated setup-python gh action to v6

* updated upload-artifact gh action to v6

* updated build-push-action gh action to v7

* Feature: split V2 Item model into Item and MagicItem models (#889)

* split v2 Item endpoint into Item and MagicItem endpoints

* removed vector_index from commit

* rmv'd accidently commited DDT config

* updated buggy test case, see issue #888

* [BUGFIX] `GameContentSerializer` now inherits from `ModelSerializer` (#899)

* GameContentSerializer now inherits from ModelSerializer

* removed 'url' from GameContent Meta->fields prop

* updated v2 tests to reflect removal of URL from many responses

* fixed failing test

* rmvd url field from MagicItemSerializer

* Bugfix: seperated mixed up V1/V2 endpoints (#890)

* updated api/urls.py to stop v1 and v2 endpoints getting mixed up

* updated v1 tests to check against endpoints behind /v1/ subroute

* [BUGFIX] Fixed EagerLoadingMixin early return error (#898)

* fixed bug in EagerLoadingMixin conditional logic, closes #897

* fixed EagerLoadingMixin missing base case, added docstring

* Bump django from 5.2.1 to 5.2.12 (#904)

Bumps [django](https://github.com/django/django) from 5.2.1 to 5.2.12.
- [Commits](django/django@5.2.1...5.2.12)

---
updated-dependencies:
- dependency-name: django
  dependency-version: 5.2.12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump requests from 2.32.3 to 2.33.0 (#905)

Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.33.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.3...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump urllib3 from 2.4.0 to 2.6.3 (#906)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.4.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.4.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump django from 5.2.12 to 5.2.13 (#908)

Bumps [django](https://github.com/django/django) from 5.2.12 to 5.2.13.
- [Commits](django/django@5.2.12...5.2.13)

---
updated-dependencies:
- dependency-name: django
  dependency-version: 5.2.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fixed bug in srd-2014 skeleton resistances/immunities (#907)

* fixed markdown bugs in srd-2014 brass dragons (#912)

* updated srd-2024 goliath giant ancestry markdown: added missing list bullets (#909)

* consolidated CRs into single 'challenge_rating' field (#910)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Blake Watson <blake@blakewatson.com>
Co-authored-by: calum <47755775+calumbell@users.noreply.github.com>
Co-authored-by: calumbell <calumabell@googlemail.com>
Co-authored-by: August Johnson <augustjohnson@users.noreply.github.com>
Co-authored-by: Steven Noto <stevennoto@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant