🚀 charset-normalizer is raising awareness around HTTP/2, and HTTP/3!
Did you know that Internet Explorer 11 shipped with an optional HTTP/2 support back in 2013? also libcurl did ship it in 2014[...]
All of this while our community is still struggling to make a firm advancement in HTTP clients. Now, many of you use Requests
as the defacto http client, now, and for many years now, Requests has been frozen. Being left in a vegetative state and not evolving,
this blocked millions of developers from using more advanced features.
We promptly invite Python developers to look at the drop-in replacement for Requests, namely Niquests.
It leverage charset-normalizer in a better way! Check it out, you will be positively surprised! Don't wait another decade.
We are thankful to @microsoft and involved parties for funding our work through the Microsoft FOSS Fund program.
This is the MarkupSafe 3.0.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. The 3.0.x branch is now the supported fix branch, the 2.1.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.
Update signatures for Markup methods to match str signatures. Use positional-only arguments. #400
Some str methods on Markup no longer escape their argument: strip, lstrip, rstrip, removeprefix, removesuffix, partition, and rpartition; replace only escapes its new argument. These methods are conceptually linked to search methods such as in, find, and index, which already do not escape their argument. #401
The __version__ attribute is deprecated. Use feature detection, or importlib.metadata.version("markupsafe"), instead. #402
Fix compatibility when __str__ returns a str subclass. :issue:472
Build requires setuptools >= 70.1. :issue:475
Version 3.0.1
Released 2024-10-08
Address compiler warnings that became errors in GCC 14. :issue:466
Fix compatibility with proxy objects. :issue:467
Version 3.0.0
Released 2024-10-07
Support Python 3.13 and its experimental free-threaded build. :pr:461
Drop support for Python 3.7 and 3.8.
Use modern packaging metadata with pyproject.toml instead of setup.cfg.
:pr:348
Change distutils imports to setuptools. :pr:399
Use deferred evaluation of annotations. :pr:400
Update signatures for Markup methods to match str signatures. Use
positional-only arguments. :pr:400
Some str methods on Markup no longer escape their argument:
strip, lstrip, rstrip, removeprefix, removesuffix,
partition, and rpartition; replace only escapes its new
argument. These methods are conceptually linked to search methods such as
in, find, and index, which already do not escape their argument.
:issue:401
The __version__ attribute is deprecated. Use feature detection, or
importlib.metadata.version("markupsafe"), instead. :pr:402
Discontinued support for Python 3.6, 3.7, and 3.8. Adopted new Python features from
Python versions 3.7-3.9:
Updated type annotations to use built-in container types instead of names
imported from the typing module (e.g., list[str] vs List[str]).
Reworked portions of the packrat cache to leverage insertion-preserving ordering
in dicts (including removal of uses of OrderedDict).
Changed pdb.set_trace() call in ParserElement.set_break() to breakpoint().
Converted typing.NamedTuple to dataclasses.dataclass in railroad diagramming
code.
Added from __future__ import annotations to clean up some type annotations.
(with assistance from ISyncWithFoo, issue #535, thanks for the help!)
POSSIBLE BREAKING CHANGES
The following bugfixes may result in subtle changes in the results returned or
exceptions raised by pyparsing.
Fixed code in ParseElementEnhance subclasses that
replaced detailed exception messages raised in contained expressions with a
less-specific and less-informative generic exception message and location.
If your code has conditional logic based on the message content in raised
ParseExceptions, this bugfix may require changes in your code.
Fixed bug in transform_string() where whitespace
in the input string was not properly preserved in the output string.
If your code uses transform_string, this bugfix may require changes in
your code.
Fixed bug where an IndexError raised in a parse action was
incorrectly handled as an IndexError raised as part of the ParserElement
parsing methods, and reraised as a ParseException. Now an IndexError
that raises inside a parse action will properly propagate out as an IndexError.
(Issue #573, reported by August Karlstedt, thanks!)
If your code raises IndexErrors in parse actions, this bugfix may require
changes in your code.
FIXES AND NEW FEATURES
Added type annotations to remainder of pyparsing package, and added mypy
run to tox.ini, so that type annotations are now run as part of pyparsing's CI.
Addresses Issue #373, raised by Iwan Aucamp, thanks!
Exception message format can now be customized, by overriding
ParseBaseException.format_message:
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. (#3053)
Added support for Python 3.13. ([#3473](https://github.com/urllib3/urllib3/issues/3473) <https://github.com/urllib3/urllib3/issues/3473>__)
Bugfixes
Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1.
All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. ([#3053](https://github.com/urllib3/urllib3/issues/3053) <https://github.com/urllib3/urllib3/issues/3053>__)
Fixed ResourceWarning on CONNECT with Python `__)
Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI ([#3413](https://github.com/urllib3/urllib3/issues/3413) <https://github.com/urllib3/urllib3/issues/3413>__)
Fixed a crash where certain standard library hash functions were absent in restricted environments. ([#3432](https://github.com/urllib3/urllib3/issues/3432) <https://github.com/urllib3/urllib3/issues/3432>__)
Fixed mypy error when adding to HTTPConnection.default_socket_options. ([#3448](https://github.com/urllib3/urllib3/issues/3448) <https://github.com/urllib3/urllib3/issues/3448>__)
HTTP/2 (experimental)
HTTP/2 support is still in early development.
Excluded Transfer-Encoding: chunked from HTTP/2 request body ([#3425](https://github.com/urllib3/urllib3/issues/3425) <https://github.com/urllib3/urllib3/issues/3425>__)
Now only accepting supported h2 major version 4.x.x. ([#3290](https://github.com/urllib3/urllib3/issues/3290) <https://github.com/urllib3/urllib3/issues/3290>__)
Added a probing mechanism for determining whether a given target origin
supports HTTP/2 via ALPN. ([#3301](https://github.com/urllib3/urllib3/issues/3301) <https://github.com/urllib3/urllib3/issues/3301>__)
Add support for sending a request body with HTTP/2 ([#3302](https://github.com/urllib3/urllib3/issues/3302) <https://github.com/urllib3/urllib3/issues/3302>__)
Deprecations and Removals
Note for downstream distributors: the _version.py file has been removed and is now created at build time by hatch-vcs. ([#3412](https://github.com/urllib3/urllib3/issues/3412) <https://github.com/urllib3/urllib3/issues/3412>__)
Drop support for end-of-life PyPy3.8 and PyPy3.9. ([#3475](https://github.com/urllib3/urllib3/issues/3475) <https://github.com/urllib3/urllib3/issues/3475>__)
Fix an issue that caused str(Request.headers) to always appear empty. #2985
3.1.0
This is the Werkzeug 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.
Request.max_form_memory_size defaults to 500kB instead of unlimited. Non-file form fields over this size will cause a RequestEntityTooLarge error. #2964
OrderedMultiDict and ImmutableOrderedMultiDict are deprecated. Use MultiDict and ImmutableMultiDict instead. #2968
Behavior of properties on request.cache_control and response.cache_control has been significantly adjusted.
Dict values are always str | None. Setting properties will convert the value to a string. Setting a property to False is equivalent to setting it to None. Getting typed properties will return None if conversion raises ValueError, rather than the string. #2980
max_age is None if present without a value, rather than -1. #2980
no_cache is a boolean for requests, it is True instead of "*" when present. It remains a string for responses. #2980
max_stale is True if present without a value, rather than "*". #2980
no_transform is a boolean. Previously it was mistakenly always None. #2881
min_fresh is None if present without a value, rather than "*". #2881
private is True if present without a value, rather than "*". #2980
Increase default work factor for PBKDF2 to 1,000,000 iterations. #2969
Inline annotations for datastructures, removing stub files. #2970
MultiDict.getlist catches TypeError in addition to ValueError when doing type conversion. #2976
Implement | and |= operators for MultiDict, Headers, and CallbackDict, and disallow |= on immutable types. #2977
3.0.6
This is the Werkzeug 3.0.6 security fix release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes.
Improve type annotation for TypeConversionDict.get to allow the type
parameter to be a callable. :issue:2988
Headers does not inherit from MutableMapping, as it is does not
exactly match that interface. :issue:2989
Version 3.1.1
Released 2024-11-01
Fix an issue that caused str(Request.headers) to always appear empty.
:issue:2985
Version 3.1.0
Released 2024-10-31
Drop support for Python 3.8. :pr:2966
Remove previously deprecated code. :pr:2967
Request.max_form_memory_size defaults to 500kB instead of unlimited.
Non-file form fields over this size will cause a RequestEntityTooLarge
error. :issue:2964
OrderedMultiDict and ImmutableOrderedMultiDict are deprecated.
Use MultiDict and ImmutableMultiDict instead. :issue:2968
Behavior of properties on request.cache_control and
response.cache_control has been significantly adjusted.
Dict values are always str | None. Setting properties will convert
the value to a string. Setting a property to False is equivalent to
setting it to None. Getting typed properties will return None if
conversion raises ValueError, rather than the string. :issue:2980
max_age is None if present without a value, rather than -1.
:issue:2980
no_cache is a boolean for requests, it is True instead of
"*" when present. It remains a string for responses. :issue:2980
max_stale is True if present without a value, rather
than "*". :issue:2980
no_transform is a boolean. Previously it was mistakenly always
None. :issue:2881
min_fresh is None if present without a value, rather than
"*". :issue:2881
private is True if present without a value, rather than "*".
Move the repository to the pallets-eco organization. :pr:854
Stop supporting Python 3.9 and start supporting Python 3.13 :pr:855
Removed required flag support from :class:~fields.HiddenWidget,
:class:~fields.RangeWidget and :class:~fields.SelectWidget to
conform to W3C :pr:810
:class:~wtforms.validators.NoneOf and :class:~wtforms.validators.AnyOf
can validate multiple valued fields like :class:~fields.SelectMultipleField
:pr:538 :pr:807
Use GHA and pre-commit workflows inspired from Flask. :pr:856 :pr:860
⚠️Breaking change⚠️: Some deprecated code was removed (:pr:859):
:class:~wtforms.Flags can no longer be tuples. :issue:467
iter_choices needs a tuple of 4 items :issue:816
⚠️Breaking change⚠️: The key for form errors moved from :data:None to
empty string "". :issue:829 :pr:858
.. note::
If you need to keep the old behavior you can set the _form_error_key
parameter of your form to :data:None.
permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still (:pr:3261)
sdist generation now explicitly excludes sphinx build folder (:pr:3257)
decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError (:pr:2336)
raise correct Exception when encounting invalid chunked requests (:pr:3258)
the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore (:pr:3192)
include IPv6 loopback address [::1] in default for :ref:forwarded-allow-ips and :ref:proxy-allow-ips (:pr:3192)
** NOTE **
The SCRIPT_NAME change mitigates a regression that appeared first in the 22.0.0 release
Review your :ref:forwarded-allow-ips setting if you are still not seeing the SCRIPT_NAME transmitted
Review your :ref:forwarder-headers setting if you are missing headers after upgrading from a version prior to 22.0.0
** Breaking changes **
refuse requests where the uri field is empty (:pr:3255)
refuse requests with invalid CR/LR/NUL in heade field values (:pr:3253)
remove temporary --tolerate-dangerous-framing switch from 22.0 (:pr:3260)
If any of the breaking changes affect you, be aware that now refused requests can post a security problem, especially so in setups involving request pipe-lining and/or proxies.
dependabot[bot]
commented
1 week ago
Bumps the python group with 19 updates in the / directory:
2024.7.42024.8.303.3.23.4.01.2.11.2.23.73.102.1.53.0.23.1.23.2.02.2.22.2.33.0.33.1.23.1.23.2.13.19.23.20.222.0.023.0.07.6.17.6.48.3.28.3.33.2.63.3.15.0.06.0.03.15.03.16.01.7.91.7.101.11.11.13.071.1.0.2024080675.3.0.20241105Updates
certififrom 2024.7.4 to 2024.8.30Commits
325c2fd2024.08.30 (#304)d66bf5fBump actions/upload-artifact from 4.3.5 to 4.3.6 (#302)2150f23Bump actions/upload-artifact from 4.3.4 to 4.3.5 (#301)fc9b771Bump actions/setup-python from 5.1.0 to 5.1.1 (#300)965b239Bump actions/download-artifact from 4.1.7 to 4.1.8 (#297)c1f50ccBump actions/upload-artifact from 4.3.3 to 4.3.4 (#296)Updates
charset-normalizerfrom 3.3.2 to 3.4.0Release notes
Sourced from charset-normalizer's releases.
Changelog
Sourced from charset-normalizer's changelog.
Commits
f3118e3:wrench: change download/upload artifact version to last working version33e67e8:wrench: set compile-generator in generator_generic_slsa3 action73dd24c:wrench: add explicit build deps to setuptools78f1e9b:wrench: attempt to fix cd.yml *356ae702:wrench: attempt to fix cd.yml *29720055:wrench: attempt to fix cd.yml (macos part)1e10d06Update CHANGELOG.md36c103a:bookmark: Release 3.4.0 (#545)7658dfc:arrow_up: Bump github/codeql-action from 3.26.11 to 3.26.12 (#544)ca2535d:arrow_up: Bump github/codeql-action from 3.26.9 to 3.26.11 (#542)Updates
flask-wtffrom 1.2.1 to 1.2.2Release notes
Sourced from flask-wtf's releases.
Changelog
Sourced from flask-wtf's changelog.
Commits
2e14295chore: pre-commit autoupdate552b7a7chore: bump to 1.2.232f1276chore: install 'build' dependency for the release GHA workflowf712367chore: dependencies updateb929162chore: use Flask inspired GHA workflow07049e3Merge pull request #604 from azmeuk/flask-pre-commit49a1380chore: pre-commit configuration insipred from Flaskf2bbd1bMerge pull request #603 from azmeuk/py313d3cd8bfchore: stop support for python 3.8; start support for python 3.130b2e5e4Merge pull request #602 from azmeuk/pallets-ecoUpdates
idnafrom 3.7 to 3.10Release notes
Sourced from idna's releases.
Changelog
Sourced from idna's changelog.
Commits
729225dRelease v3.103eef168Merge pull request #194 from kjd/revert-unicode-16ceca619Revert Unicode 16.0.0 data updatesc43ac75Merge pull request #191 from kjd/release-3.91b8800aRelease v3.9a1fd168Merge pull request #190 from kjd/unicode-167732c61Merge branch 'master' into unicode-164ed183dRefactor membership test762216bFormat with ruff580ece9Implement changes to UTS46 algorithmUpdates
markupsafefrom 2.1.5 to 3.0.2Release notes
Sourced from markupsafe's releases.
Changelog
Sourced from markupsafe's changelog.
Commits
28ace20release version 3.0.26b51fd8build requires at least setuptools 70.1 (#478)99dda9fbuild requires at least setuptools 70.13d8fd8cfix version1933c4bfix versione85aff4relax speedups str check (#477)8cb1691relax speedups str check4dafb7cstart version 3.1.09c44ecfupdate docs build275c769Merge branch '2.1.x' into 3.0.xUpdates
pyparsingfrom 3.1.2 to 3.2.0Changelog
Sourced from pyparsing's changelog.
... (truncated)
Commits
36fc04bFix docstring with invalid esc sequencea46066dPrep for 3.2.0 releasea0c219bDocs cleanup; added new whats_new_* docs for 3.1 and 3.2d9b1f14Rewrite _collapse_string_to_ranges to use _GroupConsecutive class instead of ...0d3c2d7Fix minor internal bug in one_of building regex when all choices are single c...2165ab2Cleanup ambiguous "contains" vs "in" usage in mongodb_query_expression.py25ddb02Prep for dev before final release08846aePrep for release9ee042bRemove deprecated utcnow()a2b2f25Final cleanup on mongodb_query_expression.py and mongodb_query_expression_ste...Updates
urllib3from 2.2.2 to 2.2.3Release notes
Sourced from urllib3's releases.
Changelog
Sourced from urllib3's changelog.
Commits
2458bfcRelease 2.2.39b25db6Only attempt to publish for upstreamb9adeefDrop support for EOL PyPy3.8 and PyPy3.9b1d4649Add explicit support for Python 3.13cc42860Bump cryptography from 42.0.4 to 43.0.1 (#3470)3dae2e9Bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1 (#3469)1e94febRevert "Add TLS settings for HTTP/2 (#3456)" (#3466)aa73abcBump actions/setup-python from 5.1.0 to 5.2.0 (#3468)abbfbcbAdd 1.26.20 to changelog and make the publish workflow the same (#3464)d480615Add TLS settings for HTTP/2 (#3456)Updates
werkzeugfrom 3.0.3 to 3.1.2Release notes
Sourced from werkzeug's releases.
... (truncated)
Changelog
Sourced from werkzeug's changelog.
... (truncated)
Commits
4764684release version 3.1.21803db6Headers is not MutableMapping (#2991)ac87bf8Headers is not MutableMapping1317014TypeConversionDict.get type can be a callable (#2990)acdf7faTypeConversionDict.get type can be a callablef27e476start version 3.1.207af92drelease version 3.1.1 (#2987)82ad306release version 3.1.164d27f7fixstr(request.headers)(#2986)afc4ea7fix str(request.headers)Updates
wtformsfrom 3.1.2 to 3.2.1Release notes
Sourced from wtforms's releases.
Changelog
Sourced from wtforms's changelog.
Commits
f9a999echore: bump to 3.2.16565960Merge pull request #862 from azmeuk/issue-861-selectfieldbaseffccfedfix: SelectFieldBase import6ff08cechore: install 'build' dependency for the release GHA workflow2ce93f2chore: bump to 3.2.0ba21823docs: changelog update05ad5daMerge pull request #860 from azmeuk/flask-gha6867ba9chore: bump to pallets-sphinx-themes 2.2.0a09d53cchore: use Flask inspired GHA workflow3ba396etests: remove useless flake8 related dependency in the style tox envUpdates
zippfrom 3.19.2 to 3.20.2Changelog
Sourced from zipp's changelog.
Commits
a575660Make no assertions about the number. It could be negative.0b3a1b9Finalizea4c7961Make zipp.compat.overlay.zipfile hashable.d66007aMerge https://github.com/jaraco/skeleton3fe8c5bjaraco/skeleton#14681b766cFix an incompatibility (and source of merge conflicts) with projects using Ru...b8a63caMerge pull request #125 from saschanaz/patch-10b95ec7Suppress F8215d2fa66Merge https://github.com/jaraco/skeletona675458Allow the workflow to be triggered manually.Updates
gunicornfrom 22.0.0 to 23.0.0Release notes
Sourced from gunicorn's releases.
Commits
411986dfix doc334392eMerge pull request #2559 from laggardkernel/bugfix/reexec-enve75c353Merge pull request #3189 from pajod/patch-py369357b28keep document user in access_log_format setting79fdef0bump to 23.0.03acd9fbMerge pull request #2620 from talkerbox/improve-access-log-format-docs3f56d76Merge pull request #3192 from pajod/patch-allowed-script-name256d474docs: revert duped directiveffa48b5test: default change was intentional52538cadocs: recommend SCRIPT... _Description has been truncated_