chore(deps): update dependency requests to v2.32.0 [security] - autoclosed
Metadata
Current evaluation
Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2.
Resolution: closed superseded
Reason: The original 2.32.0 update was replaced by merged PR #5064, which updated requests to 2.32.2 in commit ec4f9b16f and remediated CVE-2024-35195.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [requests](https://requests.readthedocs.io) ([source](https://togithub.com/psf/requests), [changelog](https://togithub.com/psf/requests/blob/master/HISTORY.md)) | `==2.31.0` -> `==2.32.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-35195](https://togithub.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56)
When making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same origin will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool.
### Remediation
Any of these options can be used to remediate the current issue, we highly recommend upgrading as the preferred mitigation.
* Upgrade to `requests>=2.32.0`.
* For `requests<2.32.0`, avoid setting `verify=False` for the first request to a host while using a Requests Session.
* For `requests<2.32.0`, call `close()` on `Session` objects to clear existing connections if `verify=False` is used.
### Related Links
* [https://github.com/psf/requests/pull/6655](https://togithub.com/psf/requests/pull/6655)
---
### Release Notes
<details>
<summary>psf/requests (requests)</summary>
### [`v2.32.0`](https://togithub.com/psf/requests/blob/HEAD/HISTORY.md#2320-2024-05-20)
[Compare Source](https://togithub.com/psf/requests/compare/v2.31.0...v2.32.0)
**Security**
- Fixed an issue where setting `verify=False` on the first request from a
Session will cause subsequent requests to the *same origin* to also ignore
cert verification, regardless of the value of `verify`.
(https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56)
**Improvements**
- `verify=True` now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. ([#​6667](https://togithub.com/psf/requests/issues/6667))
- Requests now supports optional use of character detection
(`chardet` or `charset_normalizer`) when repackaged or vendored.
This enables `pip` and other projects to minimize their vendoring
surface area. The `Response.text()` and `apparent_encoding` APIs
will default to `utf-8` if neither library is present. ([#​6702](https://togithub.com/psf/requests/issues/6702))
**Bugfixes**
- Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. ([#​6589](https://togithub.com/psf/requests/issues/6589))
- Fixed deserialization bug in JSONDecodeError. ([#​6629](https://togithub.com/psf/requests/issues/6629))
- Fixed bug where an extra leading `/` (path separator) could lead
urllib3 to unnecessarily reparse the request URI. ([#​6644](https://togithub.com/psf/requests/issues/6644))
**Deprecations**
- Requests has officially added support for CPython 3.12 ([#​6503](https://togithub.com/psf/requests/issues/6503))
- Requests has officially added support for PyPy 3.9 and 3.10 ([#​6641](https://togithub.com/psf/requests/issues/6641))
- Requests has officially dropped support for CPython 3.7 ([#​6642](https://togithub.com/psf/requests/issues/6642))
- Requests has officially dropped support for PyPy 3.7 and 3.8 ([#​6641](https://togithub.com/psf/requests/issues/6641))
**Documentation**
- Various typo fixes and doc improvements.
**Packaging**
- Requests has started adopting some modern packaging practices.
The source files for the projects (formerly `requests`) is now located
in `src/requests` in the Requests sdist. ([#​6506](https://togithub.com/psf/requests/issues/6506))
- Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system
using `hatchling`. This should not impact the average user, but extremely old
versions of packaging utilities may have issues with the new packaging format.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNjMuNSIsInVwZGF0ZWRJblZlciI6IjM3LjM2My41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Renovate PR #4812 was autoclosed unmerged after 856 days; the security upgrade was later delivered by #5064 (commit ec4f9b16f), raising requests from 2.31.0 to 2.32.2. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate's requests 2.31.0→2.32.0 security bump (CVE-2024-35195) was autoclosed unmerged after ~864 days with no reviews or CI. Remediation later landed via merged PR #5064 (requests 2.32.2, commit ec4f9b16f). | |
| stealth/space-bunny-alpha | — | closed stale | Renovate's requests 2.32.0 security bump (CVE-2024-35195) was never merged — no reviews, comments or CI — and was autoclosed by the bot after ~2 years. The same fix landed later in #5064 (ec4f9b16f) at v2.32.2. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s requests 2.32.0 security update was autoclosed unmerged after 856 days without reviews, comments, or CI. The remediation later landed in #5064 via v2.32.2. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate pull request updating requests to v2.32.0 to address CVE-2024-35195 was autoclosed without merging. The dependency update was likely handled separately or the branch expired. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate autoclosed the requests v2.32.0 security update due to disabled automerge and inactivity. The branch was abandoned without merging. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#5064
(confidence 100%)
Merged replacement update to requests 2.32.2 via commit ec4f9b16f.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4856 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | snapcraft | closed | PR #4856 was autoclosed without merge; the same requests 2.32.2 security update later landed via #5064 (ec4f9b16f). | |
| #61 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | imagecraft | closed | Renovate's requests 2.32.2 update was autoclosed unmerged; requests was later updated to 2.33.0 by merged PR #308 (commit cbca1c1). | |
| #1689 chore(deps): update dependency requests to v2.32.0 [security] - autoclosed | charmcraft | closed | Renovate’s requests 2.32.0 security update was autoclosed unmerged after 864 days, with no reviews, comments, or CI checks. | |
| #1111 chore(deps): update dependency requests to v2.31.0 [security] - abandoned | charmcraft | closed | Renovate's requests 2.28.2 -> 2.31.0 security PR was closed empty (0 files) after autoclosing was skipped due to a modified branch; the identical CVE-2023-32681 upgrade landed via merged Dependabot PR #1110 (10d6d55a). | |
| #52 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed | imagecraft | closed | Renovate PR #52 was not merged and was autoclosed; canonical/imagecraft#308 later moved requests to 2.33.0. | |
| #1709 chore(deps): update dependency requests to v2.32.2 [security] | charmcraft | closed | Requests 2.32.2 security update #1709 was closed unmerged due to dependency conflicts; its pin change was not applied. A later merged update reached Requests 2.33.0 in #2612 (3a73fbc1). | |
| #574 chore(deps): update dependency requests to <2.33 | craft-providers | closed | Closed unmerged; the requests<2.33 bump became obsolete when PR #663 (commit fe786e8) replaced requests-unixsocket and removed the upper pin. | |
| #6125 build(deps): update dependency requests to v2.33.0 [security] (main) - autoclosed | snapcraft | closed | Renovate PR #6125 (requests 2.32.5->2.33.0, CVE-2026-25645) was autoclosed as a duplicate; the same bump was merged via Dependabot PR #6127 in commit fce681014. | |
| #4773 chore(deps): update dependency pip to v23 [security] - autoclosed | snapcraft | closed | Renovate PR #4773 was autoclosed without merge; Dependabot PR #4776 superseded it by merging the same pip 22.0.2→23.3 docs upgrade in commit 99387d281. | |
| #1057 chore(deps): update dependency cryptography [security] - autoclosed | charmcraft | closed | Renovate’s cryptography 3.4.8→39/40 update was autoclosed unmerged; PR #1119 (commit 42365b41) later merged 40.0.2→41.0.0, superseding it. |