build(deps): bump requests from 2.32.5 to 2.33.0
Metadata
Current evaluation
Merged in debcraft#106 via commit 1aae105, updating requests from 2.32.5 to 2.33.0 in the lockfile; all CI checks passed.
Resolution: closed resolved
Reason: PR #106 was merged as commit 1aae105 with a three-line lockfile update. The approved change had no unresolved review comments, and all listed tests, lint, policy, schema, and security checks passed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base that
uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li>
<li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li>
<li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li>
<li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li>
<li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li>
</ul>
</details>
<br />
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in debcraft#106 via commit 1aae105, updating requests from 2.32.5 to 2.33.0 in the lockfile; all CI checks passed. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged requests 2.33.0 into uv.lock via commit 1aae105, adding CVE-2026-25645 protection and a netrc authentication fix. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged Dependabot PR #122, updating requests from 2.32.5 to 2.33.0 with CVE-2026-25645 protection; CI passed and two reviewers approved. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged Dependabot update bumping requests from 2.32.5 to 2.33.0. Includes CVE-2026-25645 security fix, PEP 517 migration, and Python 3.9 removal. Approved by two reviewers with all CI checks passing before merge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot pull request updating requests from 2.32.5 to 2.33.0. The update applies a security fix for CVE-2026-25645, resolves authentication bugs, and drops Python 3.9 support. Changes were integrated. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #122 build(deps): bump requests from 2.32.5 to 2.33.0 | starflow | merged | Updated requests from 2.32.5 to 2.33.0; PR #122 was merged as commit cf593d0 after two approvals and with all CI checks passing. | |
| #2612 build(deps): bump requests from 2.32.5 to 2.33.0 | charmcraft | merged | Merged charmcraft#2612, updating requests from 2.32.5 to 2.33.0 in commit 3a73fbc1. | |
| #6127 build(deps): bump requests from 2.32.5 to 2.33.0 | snapcraft | merged | Merged #6127 as fce681014, updating requests from 2.32.5 to 2.33.0, including upstream hardening for CVE-2026-25645. | |
| #4813 build(deps): bump requests from 2.31.0 to 2.32.0 | snapcraft | closed | Dependabot's requests 2.32.0 bump was closed unmerged; #5064 later advanced requests from 2.31.0 to 2.32.2 in commit ec4f9b16f. | |
| #2611 build(deps): bump requests from 2.32.4 to 2.33.0 in /tests/spread/ubuntu-24.04/test-cmd | charmcraft | closed | Closed unmerged after repeated CI failures and no review; the requests 2.33.0 upgrade was subsequently merged through canonical/charmcraft#2612. | |
| #348 build(deps): update dependency requests to v2.33.0 [security] (main) | craft-store | merged | Renovate dependency bump of requests 2.32.4 → 2.33.0 in craft-store, fixing CVE-2026-25645 (GHSA-gc5v-m9x4-r6x2). PR approved by 2 reviewers and merged into main as commit c4200cc (+3/-3 in pyproject.toml). | |
| #5553 build(deps): bump requests to 2.32.4 | snapcraft | merged | Merged PR #5553 as commit 3cfe7a1a3, upgrading requests to 2.32.4 and setting it as the minimum version to mitigate a CVE. | |
| #4822 build(deps): bump requests from 2.31.0 to 2.32.2 in /docs | snapcraft | closed | The requests 2.32.2 Dependabot bump for /docs was closed unmerged without CI or review; Dependabot posted only its May 26 closure notice. | |
| #2610 build(deps): bump requests from 2.32.4 to 2.33.0 in /tests/spread/ubuntu-25.10/test-cmd | charmcraft | closed | Closed unmerged: the requests 2.33.0 bump received no reviews and was abandoned with multiple CI failures; Dependabot stopped notifications for the release. | |
| #1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed | craft-parts | closed | Autoclosed without merge after the requests 2.32.4 security bump landed through merged PR canonical/craft-parts#1121 in commit 53f7d360. |