Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of
HTTPAdapter. (#6716)
Fixed issue where Requests started failing to run on Python versions compiled
without the ssl module. (#6724)
v2.32.2
2.32.2 (2024-05-21)
Deprecations
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of
HTTPAdapter. (#6716)
Fixed issue where Requests started failing to run on Python versions compiled
without the ssl module. (#6724)
2.32.2 (2024-05-21)
Deprecations
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the python-dependencies group with 5 updates in the / directory:
5.0.4
5.0.6
5.2.1
5.2.2
2.31.0
2.32.3
4.2.7
5.0.2
3.14.5
3.15.0
Updates
django
from 5.0.4 to 5.0.6Commits
2719a7f
[5.0.x] Bumped version for 5.0.6 release.c90b20f
[5.0.x] Added release notes for 5.0.6 and 4.2.13.0504608
[5.0.x] Added stub release notes for 5.0.6.2fa9fe3
[5.0.x] Post-release version bump.b6844c6
[5.0.x] Bumped version for 5.0.5 release.e1eecba
[5.0.x] Added release date for 5.0.5 and 4.2.12.9b5029f
[5.0.x] Fixed #35426 -- Updated querysets to be a required argument of Generi...ac9e18f
[5.0.x] Refs #35359 -- Fixed OperationTests.test_add_generate_field() test on...59c3f8a
[5.0.x] Fixed #35427 -- Corrected help text for makemessages --extension in d...e18e931
[5.0.x] Refs #35422 -- Fixed typo in docs/releases/5.0.5.txt.Updates
lxml
from 5.2.1 to 5.2.2Release notes
Sourced from lxml's releases.
Changelog
Sourced from lxml's changelog.
Commits
8e4b14c
Prepare release of lxml 5.2.2.ddaa6ed
Provide compile time version of libiconv as "etree.ICONV_COMPILED_VERSION".1ab00bd
CI: Do not install lxml as dependency of "lxml_html_clean".b325054
CI: Stop building LTO wheels to avoid messing with the library build cache.81624c2
CI: Exclude now-unsupported Python versions 3.6/7 from macOS jobs.069fa36
Fix typo.e0df2ba
Fix typo.df55eaf
Update changelog.f3e77fa
Remove dependency on SSE4 instructions, reverting back to "core2" as a target...a22e83c
Update changelog.Updates
requests
from 2.31.0 to 2.32.3Release notes
Sourced from requests's releases.
... (truncated)
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
0e322af
v2.32.3e188799
Don't create default SSLContext if ssl module isn't present (#6724)145b539
Merge pull request #6716 from sigmavirus24/bug/6715b1d73dd
Don't use default SSLContext with custom poolmanager kwargs6badbac
Update HISTORY.mda62a2d3
Allow for overriding of specific pool key params88dce9d
v2.32.2c98e4d1
Merge pull request #6710 from nateprewitt/api_rename92075b3
Add deprecation warningaa1461b
Move _get_connection to get_connection_with_tls_contextUpdates
django-stubs
from 4.2.7 to 5.0.2Commits
5118c5d
Bumpdjango-stubs-ext
dependency to latest (#2186)d9b47af
Prepare for a release5.0.1
(#2183)6b31bed
Formset get_queryset() returns QuerySet (#2174)b8f1592
Don't crash when inspecting classes loaded from cache (#2185)95e7d4d
Migrate 'test_conf.yml' to 'assert_type' tests (#2182)1f4efbe
AbstractBaseSession
: Use model fields for subclassed cases (#2180)e196985
Fix signature of Choices member creation, addassert_type
test cases, run `...d03eaf1
AddBaseConstraint.get_violation_error_message()
(#2178)496190e
5.0: Update django.db.models.expressions (#2176)5218b4f
5.0: Update django.db.models.constraints.UniqueConstraint (#2175)Updates
djangorestframework-stubs
from 3.14.5 to 3.15.0Release notes
Sourced from djangorestframework-stubs's releases.
... (truncated)
Commits
6e22a6f
Version 3.15.0 release (#605)8869eef
[pre-commit.ci] pre-commit autoupdate (#604)b882896
Bump pytest from 8.1.1 to 8.2.0 (#603)e00d4ce
AllowNone
forListField.min/max_length
(#601)f141057
Update mypy requirement from <1.10,>=1.7 to >=1.7,<1.11 (#598)f0c9e31
[pre-commit.ci] pre-commit autoupdate (#594)a472d34
CI: Run tests daily to detect incompatible django-stubs changes (#519)e0ec43f
FixHyperlinkedRelatedField.get_object()
argument types (#597)9d25503
Make HyperlinkedModelSerializer generic (#595)71a6b53
Fix CI: suppress mypy errors in test suite that come from 3rd party packages ...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show