🚀 charset-normalizer is raising awareness around HTTP/2, and HTTP/3!
Did you know that Internet Explorer 11 shipped with an optional HTTP/2 support back in 2013? also libcurl did ship it in 2014[...]
All of this while our community is still struggling to make a firm advancement in HTTP clients. Now, many of you use Requests
as the defacto http client, now, and for many years now, Requests has been frozen. Being left in a vegetative state and not evolving,
this blocked millions of developers from using more advanced features.
We promptly invite Python developers to look at the drop-in replacement for Requests, namely Niquests.
It leverage charset-normalizer in a better way! Check it out, you will be positively surprised! Don't wait another decade.
We are thankful to @microsoft and involved parties for funding our work through the Microsoft FOSS Fund program.
This is the MarkupSafe 3.0.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. The 3.0.x branch is now the supported fix branch, the 2.1.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.
Update signatures for Markup methods to match str signatures. Use positional-only arguments. #400
Some str methods on Markup no longer escape their argument: strip, lstrip, rstrip, removeprefix, removesuffix, partition, and rpartition; replace only escapes its new argument. These methods are conceptually linked to search methods such as in, find, and index, which already do not escape their argument. #401
The __version__ attribute is deprecated. Use feature detection, or importlib.metadata.version("markupsafe"), instead. #402
Fix compatibility when __str__ returns a str subclass. :issue:472
Build requires setuptools >= 70.1. :issue:475
Version 3.0.1
Released 2024-10-08
Address compiler warnings that became errors in GCC 14. :issue:466
Fix compatibility with proxy objects. :issue:467
Version 3.0.0
Released 2024-10-07
Support Python 3.13 and its experimental free-threaded build. :pr:461
Drop support for Python 3.7 and 3.8.
Use modern packaging metadata with pyproject.toml instead of setup.cfg.
:pr:348
Change distutils imports to setuptools. :pr:399
Use deferred evaluation of annotations. :pr:400
Update signatures for Markup methods to match str signatures. Use
positional-only arguments. :pr:400
Some str methods on Markup no longer escape their argument:
strip, lstrip, rstrip, removeprefix, removesuffix,
partition, and rpartition; replace only escapes its new
argument. These methods are conceptually linked to search methods such as
in, find, and index, which already do not escape their argument.
:issue:401
The __version__ attribute is deprecated. Use feature detection, or
importlib.metadata.version("markupsafe"), instead. :pr:402
Discontinued support for Python 3.6, 3.7, and 3.8. Adopted new Python features from
Python versions 3.7-3.9:
Updated type annotations to use built-in container types instead of names
imported from the typing module (e.g., list[str] vs List[str]).
Reworked portions of the packrat cache to leverage insertion-preserving ordering
in dicts (including removal of uses of OrderedDict).
Changed pdb.set_trace() call in ParserElement.set_break() to breakpoint().
Converted typing.NamedTuple to dataclasses.dataclass in railroad diagramming
code.
Added from __future__ import annotations to clean up some type annotations.
(with assistance from ISyncWithFoo, issue #535, thanks for the help!)
POSSIBLE BREAKING CHANGES
The following bugfixes may result in subtle changes in the results returned or
exceptions raised by pyparsing.
Fixed code in ParseElementEnhance subclasses that
replaced detailed exception messages raised in contained expressions with a
less-specific and less-informative generic exception message and location.
If your code has conditional logic based on the message content in raised
ParseExceptions, this bugfix may require changes in your code.
Fixed bug in transform_string() where whitespace
in the input string was not properly preserved in the output string.
If your code uses transform_string, this bugfix may require changes in
your code.
Fixed bug where an IndexError raised in a parse action was
incorrectly handled as an IndexError raised as part of the ParserElement
parsing methods, and reraised as a ParseException. Now an IndexError
that raises inside a parse action will properly propagate out as an IndexError.
(Issue #573, reported by August Karlstedt, thanks!)
If your code raises IndexErrors in parse actions, this bugfix may require
changes in your code.
FIXES AND NEW FEATURES
Added type annotations to remainder of pyparsing package, and added mypy
run to tox.ini, so that type annotations are now run as part of pyparsing's CI.
Addresses Issue #373, raised by Iwan Aucamp, thanks!
Exception message format can now be customized, by overriding
ParseBaseException.format_message:
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. (#3053)
Added support for Python 3.13. ([#3473](https://github.com/urllib3/urllib3/issues/3473) <https://github.com/urllib3/urllib3/issues/3473>__)
Bugfixes
Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1.
All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. ([#3053](https://github.com/urllib3/urllib3/issues/3053) <https://github.com/urllib3/urllib3/issues/3053>__)
Fixed ResourceWarning on CONNECT with Python `__)
Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI ([#3413](https://github.com/urllib3/urllib3/issues/3413) <https://github.com/urllib3/urllib3/issues/3413>__)
Fixed a crash where certain standard library hash functions were absent in restricted environments. ([#3432](https://github.com/urllib3/urllib3/issues/3432) <https://github.com/urllib3/urllib3/issues/3432>__)
Fixed mypy error when adding to HTTPConnection.default_socket_options. ([#3448](https://github.com/urllib3/urllib3/issues/3448) <https://github.com/urllib3/urllib3/issues/3448>__)
HTTP/2 (experimental)
HTTP/2 support is still in early development.
Excluded Transfer-Encoding: chunked from HTTP/2 request body ([#3425](https://github.com/urllib3/urllib3/issues/3425) <https://github.com/urllib3/urllib3/issues/3425>__)
Now only accepting supported h2 major version 4.x.x. ([#3290](https://github.com/urllib3/urllib3/issues/3290) <https://github.com/urllib3/urllib3/issues/3290>__)
Added a probing mechanism for determining whether a given target origin
supports HTTP/2 via ALPN. ([#3301](https://github.com/urllib3/urllib3/issues/3301) <https://github.com/urllib3/urllib3/issues/3301>__)
Add support for sending a request body with HTTP/2 ([#3302](https://github.com/urllib3/urllib3/issues/3302) <https://github.com/urllib3/urllib3/issues/3302>__)
Deprecations and Removals
Note for downstream distributors: the _version.py file has been removed and is now created at build time by hatch-vcs. ([#3412](https://github.com/urllib3/urllib3/issues/3412) <https://github.com/urllib3/urllib3/issues/3412>__)
Drop support for end-of-life PyPy3.8 and PyPy3.9. ([#3475](https://github.com/urllib3/urllib3/issues/3475) <https://github.com/urllib3/urllib3/issues/3475>__)
This is the Werkzeug 3.0.6 security fix release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes.
Restore behavior where parsing multipart/x-www-form-urlencoded data with
invalid UTF-8 bytes in the body results in no form data parsed rather than a
413 error. #2930
Improve parse_options_header performance when parsing unterminated
quoted string values. #2904
Debugger pin auth is synchronized across threads/processes when tracking
failed entries. #2916
Dev server handles unexpected SSLEOFError due to issue in Python < 3.13.
#2926
Debugger pin auth works when the URL already contains a query string.
#2918
Improve type annotation fore SharedDataMiddleware. :issue:2958
Compatibility with Python 3.13 when generating debugger pin and the current
UID does not have an associated name. :issue:2957
Version 3.0.4
Released 2024-08-21
Restore behavior where parsing multipart/x-www-form-urlencoded data with
invalid UTF-8 bytes in the body results in no form data parsed rather than a
413 error. :issue:2930
Improve parse_options_header performance when parsing unterminated
quoted string values. :issue:2904
Debugger pin auth is synchronized across threads/processes when tracking
failed entries. :issue:2916
Dev server handles unexpected SSLEOFError due to issue in Python < 3.13.
:issue:2926
Debugger pin auth works when the URL already contains a query string.
:issue:2918
Move the repository to the pallets-eco organization. :pr:854
Stop supporting Python 3.9 and start supporting Python 3.13 :pr:855
Removed required flag support from :class:~fields.HiddenWidget,
:class:~fields.RangeWidget and :class:~fields.SelectWidget to
conform to W3C :pr:810
:class:~wtforms.validators.NoneOf and :class:~wtforms.validators.AnyOf
can validate multiple valued fields like :class:~fields.SelectMultipleField
:pr:538 :pr:807
Use GHA and pre-commit workflows inspired from Flask. :pr:856 :pr:860
⚠️Breaking change⚠️: Some deprecated code was removed (:pr:859):
:class:~wtforms.Flags can no longer be tuples. :issue:467
iter_choices needs a tuple of 4 items :issue:816
⚠️Breaking change⚠️: The key for form errors moved from :data:None to
empty string "". :issue:829 :pr:858
.. note::
If you need to keep the old behavior you can set the _form_error_key
parameter of your form to :data:None.
permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still (:pr:3261)
sdist generation now explicitly excludes sphinx build folder (:pr:3257)
decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError (:pr:2336)
raise correct Exception when encounting invalid chunked requests (:pr:3258)
the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore (:pr:3192)
include IPv6 loopback address [::1] in default for :ref:forwarded-allow-ips and :ref:proxy-allow-ips (:pr:3192)
** NOTE **
The SCRIPT_NAME change mitigates a regression that appeared first in the 22.0.0 release
Review your :ref:forwarded-allow-ips setting if you are still not seeing the SCRIPT_NAME transmitted
Review your :ref:forwarder-headers setting if you are missing headers after upgrading from a version prior to 22.0.0
** Breaking changes **
refuse requests where the uri field is empty (:pr:3255)
refuse requests with invalid CR/LR/NUL in heade field values (:pr:3253)
remove temporary --tolerate-dangerous-framing switch from 22.0 (:pr:3260)
If any of the breaking changes affect you, be aware that now refused requests can post a security problem, especially so in setups involving request pipe-lining and/or proxies.
Fix: nested context managers could incorrectly be analyzed to flag a missing
branch on the last context manager, as described in issue 1876_. This is
now fixed.
Fix: the missing branch message about not exiting a module had an extra
"didn't," as described in issue 1873_. This is now fixed.
Fix: a final wildcard match/case clause assigning to a name (case _ as value) was incorrectly marked as a missing branch. This is now fixed,
closing issue 1860_.
Fewer things are considered branches now. Lambdas, comprehensions, and
generator expressions are no longer marked as missing branches if they don't
complete execution. Closes issue 1852_.
Fix: the HTML report didn't properly show multi-line f-strings that end with
a backslash continuation. This is now fixed, closing issue 1836, thanks
to LiuYinCarl and Marco Ricci <pull 1838_>.
Fix: the LCOV report now has correct line numbers (fixing issue 1846) and
better branch descriptions for BRDA records (fixing issue 1850). There
are other changes to lcov also, including a new configuration option
:ref:line_checksums <config_lcov_line_checksums> to control whether line
checksums are included in the lcov report. The default is false. To keep
checksums set it to true. All this work is thanks to Zack Weinberg
Bumps the python group with 18 updates in the / directory:
2024.7.42024.8.303.3.23.4.01.2.11.2.23.73.102.1.53.0.23.1.23.2.02.2.22.2.33.0.33.0.63.1.23.2.13.19.23.20.222.0.023.0.07.6.17.6.48.3.28.3.33.2.63.3.13.15.03.16.01.7.91.7.101.11.11.13.071.1.0.2024080675.2.0.20241025Updates
certififrom 2024.7.4 to 2024.8.30Commits
325c2fd2024.08.30 (#304)d66bf5fBump actions/upload-artifact from 4.3.5 to 4.3.6 (#302)2150f23Bump actions/upload-artifact from 4.3.4 to 4.3.5 (#301)fc9b771Bump actions/setup-python from 5.1.0 to 5.1.1 (#300)965b239Bump actions/download-artifact from 4.1.7 to 4.1.8 (#297)c1f50ccBump actions/upload-artifact from 4.3.3 to 4.3.4 (#296)Updates
charset-normalizerfrom 3.3.2 to 3.4.0Release notes
Sourced from charset-normalizer's releases.
Changelog
Sourced from charset-normalizer's changelog.
Commits
f3118e3:wrench: change download/upload artifact version to last working version33e67e8:wrench: set compile-generator in generator_generic_slsa3 action73dd24c:wrench: add explicit build deps to setuptools78f1e9b:wrench: attempt to fix cd.yml *356ae702:wrench: attempt to fix cd.yml *29720055:wrench: attempt to fix cd.yml (macos part)1e10d06Update CHANGELOG.md36c103a:bookmark: Release 3.4.0 (#545)7658dfc:arrow_up: Bump github/codeql-action from 3.26.11 to 3.26.12 (#544)ca2535d:arrow_up: Bump github/codeql-action from 3.26.9 to 3.26.11 (#542)Updates
flask-wtffrom 1.2.1 to 1.2.2Release notes
Sourced from flask-wtf's releases.
Changelog
Sourced from flask-wtf's changelog.
Commits
2e14295chore: pre-commit autoupdate552b7a7chore: bump to 1.2.232f1276chore: install 'build' dependency for the release GHA workflowf712367chore: dependencies updateb929162chore: use Flask inspired GHA workflow07049e3Merge pull request #604 from azmeuk/flask-pre-commit49a1380chore: pre-commit configuration insipred from Flaskf2bbd1bMerge pull request #603 from azmeuk/py313d3cd8bfchore: stop support for python 3.8; start support for python 3.130b2e5e4Merge pull request #602 from azmeuk/pallets-ecoUpdates
idnafrom 3.7 to 3.10Release notes
Sourced from idna's releases.
Changelog
Sourced from idna's changelog.
Commits
729225dRelease v3.103eef168Merge pull request #194 from kjd/revert-unicode-16ceca619Revert Unicode 16.0.0 data updatesc43ac75Merge pull request #191 from kjd/release-3.91b8800aRelease v3.9a1fd168Merge pull request #190 from kjd/unicode-167732c61Merge branch 'master' into unicode-164ed183dRefactor membership test762216bFormat with ruff580ece9Implement changes to UTS46 algorithmUpdates
markupsafefrom 2.1.5 to 3.0.2Release notes
Sourced from markupsafe's releases.
Changelog
Sourced from markupsafe's changelog.
Commits
28ace20release version 3.0.26b51fd8build requires at least setuptools 70.1 (#478)99dda9fbuild requires at least setuptools 70.13d8fd8cfix version1933c4bfix versione85aff4relax speedups str check (#477)8cb1691relax speedups str check4dafb7cstart version 3.1.09c44ecfupdate docs build275c769Merge branch '2.1.x' into 3.0.xUpdates
pyparsingfrom 3.1.2 to 3.2.0Changelog
Sourced from pyparsing's changelog.
... (truncated)
Commits
36fc04bFix docstring with invalid esc sequencea46066dPrep for 3.2.0 releasea0c219bDocs cleanup; added new whats_new_* docs for 3.1 and 3.2d9b1f14Rewrite _collapse_string_to_ranges to use _GroupConsecutive class instead of ...0d3c2d7Fix minor internal bug in one_of building regex when all choices are single c...2165ab2Cleanup ambiguous "contains" vs "in" usage in mongodb_query_expression.py25ddb02Prep for dev before final release08846aePrep for release9ee042bRemove deprecated utcnow()a2b2f25Final cleanup on mongodb_query_expression.py and mongodb_query_expression_ste...Updates
urllib3from 2.2.2 to 2.2.3Release notes
Sourced from urllib3's releases.
Changelog
Sourced from urllib3's changelog.
Commits
2458bfcRelease 2.2.39b25db6Only attempt to publish for upstreamb9adeefDrop support for EOL PyPy3.8 and PyPy3.9b1d4649Add explicit support for Python 3.13cc42860Bump cryptography from 42.0.4 to 43.0.1 (#3470)3dae2e9Bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1 (#3469)1e94febRevert "Add TLS settings for HTTP/2 (#3456)" (#3466)aa73abcBump actions/setup-python from 5.1.0 to 5.2.0 (#3468)abbfbcbAdd 1.26.20 to changelog and make the publish workflow the same (#3464)d480615Add TLS settings for HTTP/2 (#3456)Updates
werkzeugfrom 3.0.3 to 3.0.6Release notes
Sourced from werkzeug's releases.
Changelog
Sourced from werkzeug's changelog.
Commits
5eaefc3release version 3.0.62767bcbMerge commit from fork87cc78acatch special absolute path on Windows Python < 3.1150cfeebMerge commit from fork8760275apply max_form_memory_size another level up in the parser8d6a12estart version 3.0.6a7b121arelease version 3.0.5 (#2961)9caf72arelease version 3.0.5e28a245catch OSError from getpass.getuser (#2960)e6b4ccecatch OSError from getpass.getuserUpdates
wtformsfrom 3.1.2 to 3.2.1Release notes
Sourced from wtforms's releases.
Changelog
Sourced from wtforms's changelog.
Commits
f9a999echore: bump to 3.2.16565960Merge pull request #862 from azmeuk/issue-861-selectfieldbaseffccfedfix: SelectFieldBase import6ff08cechore: install 'build' dependency for the release GHA workflow2ce93f2chore: bump to 3.2.0ba21823docs: changelog update05ad5daMerge pull request #860 from azmeuk/flask-gha6867ba9chore: bump to pallets-sphinx-themes 2.2.0a09d53cchore: use Flask inspired GHA workflow3ba396etests: remove useless flake8 related dependency in the style tox envUpdates
zippfrom 3.19.2 to 3.20.2Changelog
Sourced from zipp's changelog.
Commits
a575660Make no assertions about the number. It could be negative.0b3a1b9Finalizea4c7961Make zipp.compat.overlay.zipfile hashable.d66007aMerge https://github.com/jaraco/skeleton3fe8c5bjaraco/skeleton#14681b766cFix an incompatibility (and source of merge conflicts) with projects using Ru...b8a63caMerge pull request #125 from saschanaz/patch-10b95ec7Suppress F8215d2fa66Merge https://github.com/jaraco/skeletona675458Allow the workflow to be triggered manually.Updates
gunicornfrom 22.0.0 to 23.0.0Release notes
Sourced from gunicorn's releases.
Commits
411986dfix doc334392eMerge pull request #2559 from laggardkernel/bugfix/reexec-enve75c353Merge pull request #3189 from pajod/patch-py369357b28keep document user in access_log_format setting79fdef0bump to 23.0.03acd9fbMerge pull request #2620 from talkerbox/improve-access-log-format-docs3f56d76Merge pull request #3192 from pajod/patch-allowed-script-name256d474docs: revert duped directiveffa48b5test: default change was intentional52538cadocs: recommend SCRIPT_NAME=/subfolderUpdates
coveragefrom 7.6.1 to 7.6.4Changelog
Sourced from coverage's changelog.
... (truncated)
Commits
f24f76bdocs: sample HTML for 7.6.496e10f7docs: prep for 7.6.4b8c236afix: multi-line with-statements exit correctly. #188064b7a45docs: another discord reference68d7427docs: Python Discord43adceabuild: include 3.14 in the usual Pythonsfb2b49fbuild: github_releases can update older releases, and pauses to get the sorti...ca550ca3.0b2 wasn't correctly titledLooks like these dependencies are updatable in another way, so this is no longer needed.