To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
Emit a warning when [tools.setuptools] is present in pyproject.toml and will be ignored. -- by :user:SnoopJ (#4150)
Improved AttributeError error message if pkg_resources.EntryPoint.require is called without extras or distribution
Gracefully "do nothing" when trying to activate a pkg_resources.Distribution with a None location, rather than raising a TypeError
-- by :user:Avasam (#4262)
Typed the dynamically defined variables from pkg_resources -- by :user:Avasam (#4267)
Modernized and refactored VCS handling in package_index. (#4332)
Bugfixes
In install command, use super to call the superclass methods. Avoids race conditions when monkeypatching from _distutils_system_mod occurs late. (#4136)
Fix finder template for lenient editable installs of implicit nested namespaces
constructed by using package_dir to reorganise directory structure. (#4278)
Fix an error with UnicodeDecodeError handling in pkg_resources when trying to read files in UTF-8 with a fallback -- by :user:Avasam (#4348)
Improved Documentation
Uses RST substitution to put badges in 1 line. (#4312)
Deprecations and Removals
Further adoption of UTF-8 in setuptools.
This change regards mostly files produced and consumed during the build process
(e.g. metadata files, script wrappers, automatically updated config files, etc..)
Although precautions were taken to minimize disruptions, some edge cases might
be subject to backwards incompatibility.
Support for "locale" encoding is now deprecated. (#4309)
Remove setuptools.convert_path after long deprecation period.
This function was never defined by setuptools itself, but rather a
side-effect of an import for internal usage. (#4322)
Remove fallback for customisations of distutils' build.sub_command after long
deprecated period.
Users are advised to import build directly from setuptools.command.build. (#4322)
Removed typing_extensions from vendored dependencies -- by :user:Avasam (#4324)
Remove deprecated setuptools.dep_util.
The provided alternative is setuptools.modified. (#4360)
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. ([#3405](https://github.com/urllib3/urllib3/issues/3405) <https://github.com/urllib3/urllib3/issues/3405>__)
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. ([#3405](https://github.com/urllib3/urllib3/issues/3405) <https://github.com/urllib3/urllib3/issues/3405>__)
NumPy 2.0.0 is the first major release since 2006. It is the result of
11 months of development since the last feature release and is the work
of 212 contributors spread over 1078 pull requests. It contains a large
number of exciting new features as well as changes to both the Python
and C APIs.
This major release includes breaking changes that could not happen in a
regular minor (feature) release - including an ABI break, changes to
type promotion rules, and API changes which may not have been emitting
deprecation warnings in 1.26.x. Key documents related to how to adapt to
changes in NumPy 2.0, in addition to these release notes, include:
A new variable-length string dtype, numpy.dtypes.StringDType and a new
numpy.strings namespace with performant ufuncs for string operations,
Support for float32 and longdouble in all
numpy.fft functions,
Support for the array API standard in the main numpy
namespace.
Performance improvements:
Sorting functions sort, argsort,
partition, argpartition have been
accelerated through the use of the Intel x86-simd-sort and
Google Highway libraries, and may see large (hardware-specific)
speedups,
macOS Accelerate support and binary wheels for macOS >=14, with
significant performance improvements for linear algebra
operations on macOS, and wheels that are about 3 times smaller,
numpy.char fixed-length string operations have
been accelerated by implementing ufuncs that also support
numpy.dtypes.StringDType in addition to the
fixed-length string dtypes,
A new tracing and introspection API,
numpy.lib.introspect.opt_func_info, to determine
which hardware-specific kernels are available and will be
dispatched to.
numpy.save now uses pickle protocol version 4 for saving
arrays with object dtype, which allows for pickle objects larger
than 4GB and improves saving speed by about 5% for large arrays.
Bumps the pip group with 5 updates in the /docs/demonstration directory:
2024.2.22024.7.42.31.02.32.268.1.070.0.06.3.36.4.11.26.181.26.19Bumps the pip group with 6 updates in the /src/canvas-extractor directory:
2023.7.222024.7.42.31.02.32.22.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 7 updates in the /src/extractor-lib directory:
2024.2.22024.7.41.26.42.0.02.31.02.32.22.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 7 updates in the /src/file-utils directory:
2024.2.22024.7.41.26.42.0.02.31.02.32.22.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 6 updates in the /src/google-classroom-extractor directory:
2023.7.222024.7.42.31.02.32.22.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 7 updates in the /src/lms-ds-loader directory:
2024.2.22024.7.42.31.02.32.20.5.00.5.12.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 8 updates in the /src/lms-harmonizer directory:
2024.2.22024.7.41.26.42.0.02.31.02.32.20.5.00.5.12.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 6 updates in the /src/notebooks directory:
2024.2.22024.7.42.31.02.32.26.3.36.4.12.0.72.2.224.4.024.4.23.16.23.19.1Bumps the pip group with 6 updates in the /src/schoology-extractor directory:
2023.7.222024.7.42.31.02.32.22.0.72.2.224.4.024.4.24.65.04.66.33.16.23.19.1Bumps the pip group with 6 updates in the /src/sql-adapter directory:
2023.7.222024.7.42.31.02.32.21.26.181.26.1924.4.024.4.24.62.34.66.33.7.03.19.1Bumps the pip group with 1 update in the /utils/amt-integration-tests directory: numpy.
Updates
certififrom 2024.2.2 to 2024.7.4Commits
bd815382024.07.04 (#295)06a2cbfBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)13bba02Bump actions/checkout from 4.1.6 to 4.1.7 (#293)e8abcd0Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)124f4ad2024.06.02 (#291)c2196ce--- (#290)fefdeecBump actions/checkout from 4.1.4 to 4.1.5 (#289)3c5fb15Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)4a9569aBump actions/checkout from 4.1.2 to 4.1.4 (#287)1fc8086Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)Updates
requestsfrom 2.31.0 to 2.32.2Release notes
Sourced from requests's releases.
... (truncated)
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
88dce9dv2.32.2c98e4d1Merge pull request #6710 from nateprewitt/api_rename92075b3Add deprecation warningaa1461bMove _get_connection to get_connection_with_tls_context970e8cev2.32.1d6ebc4av2.32.09a40d12Avoid reloading root certificates to improve concurrent performance (#6667)0c030f7Merge pull request #6702 from nateprewitt/no_char_detection555b870Allow character detection dependencies to be optional in post-packaging stepsd6dded3Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-testUpdates
setuptoolsfrom 68.1.0 to 70.0.0Changelog
Sourced from setuptools's changelog.
... (truncated)
Commits
5cbf12aWorkaround for release error in v709c1bcc3Bump version: 69.5.1 → 70.0.04dc0c31Remove deprecatedsetuptools.dep_util(#4360)6c1ef57Remove xfail now that test passes. Ref #4371.d14fa01Add all site-packages dirs when creating simulated environment for test_edita...6b7f7a1Preventbinfolders to be taken as extern packages when vendoring (#4370)69141f6Add doctest for vendorised bin folder2a53cc1Prevent 'bin' folders to be taken as extern packages7208628Replace call to deprecatedvalidate_pyprojectcommand (#4363)96d681aRemove call to deprecated validate_pyproject commandUpdates
tornadofrom 6.3.3 to 6.4.1Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
2a0e1d1Merge pull request #3388 from bdarnell/release-641b7af4e8Release notes and version bump for version 6.4.1d65f6e7Merge pull request #3387 from bdarnell/chunked-parsing8d721a8httputil: Only strip tabs and spaces from header values7786f09Merge pull request #3386 from bdarnell/curl-crlffb119c7http1connection: Stricter handling of transfer-encodingb0ffc58curl_httpclient,http1connection: Prohibit CR and LF in headers0efa9a4Merge pull request #3385 from bdarnell/update-black2757c6eMerge pull request #3384 from tornadoweb/dependabot/pip/requests-2.32.2291d1b6*: Update blackUpdates
urllib3from 1.26.18 to 1.26.19Release notes
Sourced from urllib3's releases.
Changelog
Sourced from urllib3's changelog.
Commits
d9d85c8Release 1.26.198528b63[1.26] Fix downstream tests (#3409)40b6d16Merge pull request from GHSA-34jh-p97f-mpxf29cfd02Fix handling of OpenSSL 3.2.0 new error message "record layer failure" (#3405)b600643[1.26] Bump RECENT_DATE (#3404)7e2d389[1.26] Fix running CPython 2.7 tests in CI (#3137)Updates
certififrom 2023.7.22 to 2024.7.4Commits
bd815382024.07.04 (#295)06a2cbfBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)13bba02Bump actions/checkout from 4.1.6 to 4.1.7 (#293)e8abcd0Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)124f4ad2024.06.02 (#291)c2196ce--- (#290)fefdeecBump actions/checkout from 4.1.4 to 4.1.5 (#289)3c5fb15Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)4a9569aBump actions/checkout from 4.1.2 to 4.1.4 (#287)1fc8086Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)Updates
requestsfrom 2.31.0 to 2.32.2Release notes
Sourced from requests's releases.
... (truncated)
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
88dce9dv2.32.2c98e4d1Merge pull request #6710 from nateprewitt/api_rename92075b3Add deprecation warningaa1461bMove _get_connection to get_connection_with_tls_context970e8cev2.32.1d6ebc4av2.32.09a40d12Avoid reloading root certificates to improve concurrent performance (#6667)0c030f7Merge pull request #6702 from nateprewitt/no_char_detection555b870Allow character detection dependencies to be optional in post-packaging stepsd6dded3Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-testUpdates
urllib3from 2.0.7 to 2.2.2Release notes
Sourced from urllib3's releases.
Changelog
Sourced from urllib3's changelog.
Commits
d9d85c8Release 1.26.198528b63[1.26] Fix downstream tests (#3409)40b6d16Merge pull request from GHSA-34jh-p97f-mpxf29cfd02Fix handling of OpenSSL 3.2.0 new error message "record layer failure" (#3405)b600643[1.26] Bump RECENT_DATE (#3404)7e2d389[1.26] Fix running CPython 2.7 tests in CI (#3137)Updates
blackfrom 24.4.0 to 24.4.2Release notes
Sourced from black's releases.
Changelog
Sourced from black's changelog.
Commits
3702ba2Prepare release 24.4.2 (#4335)e4aaa8aFix incorrect f-string tokenization (#4332)ba88fc3Simplify string tokenization regexes (#4331)5683242New release templatee7fb048Prepare release 24.4.1 (#4328)3f0f8f1Support PEP 696 (#4327)2f88085Github Action: Directly install from repo ifexport-substis skipped (#4313)12ce3dbMove changelog entry to right section (#4326)1354be2Add support to style function definitions with newlines before function stubs...f4b644bPrevent wrapping of multiline fstrings in parens (#4325)Updates
tqdmfrom 4.65.0 to 4.66.3Release notes
Sourced from tqdm's releases.
Commits
4e613f8Merge pull request from GHSA-g7vv-2v7x-gj9pb53348ccli: eval safetycc372d0bump version, merge pull request #1549 from tqdm/devele9f0c05use PyPI trusted publishing7323d5bslight makefile clean5306125tests: bump pre-commit4a6fd4ffix datetime.utcfromtimestamp py3.12 warning (#1519)6f13759tests: fix macos notebook indentation3abcd2atests: fix asva4d15c8tests: fix pandas warningsUpdates
zippfrom 3.16.2 to 3.19.1Changelog
Sourced from zipp's changelog.
... (truncated)
Commits
6d1cb72Finalizefd604bdMerge pull request #120 from jaraco/bugfix/119-malformed-pathsc18417eAdd news fragment.58115d2Employ SanitizedNames in CompleteDirs. Fixes broken test.564fcc1Add SanitizedNames mixin.79a309fAdd some assertions about malformed paths.2d015c2Merge https://github.com/jaraco/skeletona595a0fRename extras to align with core metadata spec.608f90aFinalize3a22d72Merge pull request #118 from jaraco/feature/is-symlinkUpdates
certififrom 2024.2.2 to 2024.7.4Commits
bd815382024.07.04 (#295)06a2cbfBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)13bba02Bump actions/checkout from 4.1.6 to 4.1.7 (#293)e8abcd0Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)124f4ad2024.06.02 (#291)c2196ce--- (#290)fefdeecBump actions/checkout from 4.1.4 to 4.1.5 (#289)3c5fb15Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)4a9569aBump actions/checkout from 4.1.2 to 4.1.4 (#287)1fc8086Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)Updates
numpyfrom 1.26.4 to 2.0.0Release notes
Sourced from numpy's releases.
... (truncated)
Commits
1d49c7f... _Description has been truncated_