build(deps): update dependency requests to v2.32.2 [security] (hotfix/8.4)
Metadata
Current evaluation
Renovate's requests 2.31.0 -> 2.32.2 security bump for CVE-2024-35195 was merged into hotfix/8.4 as commit 8a0a3dc62, one line changed in the requirements file.
Resolution: closed resolved
Reason: PR #5067 was approved (2 reviewers) and merged, landing as commit 8a0a3dc62 with the title 'build(deps): update dependency requests to v2.32.2 [security] (hotfix/8.4)'. It patched the same hotfix branch in parallel with #5064 (main, ec4f9b16f) and #5065 (hotfix/7.5, 4df808913), and was later superseded on the branch line by #5551/#5553 (2.32.4) and #6127 (2.33.0 on main).
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [requests](https://requests.readthedocs.io) ([source](https://redirect.github.com/psf/requests), [changelog](https://redirect.github.com/psf/requests/blob/master/HISTORY.md)) | `==2.31.0` -> `==2.32.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-35195](https://redirect.github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56)
When making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same origin will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool.
### Remediation
Any of these options can be used to remediate the current issue, we highly recommend upgrading as the preferred mitigation.
* Upgrade to `requests>=2.32.0`.
* For `requests<2.32.0`, avoid setting `verify=False` for the first request to a host while using a Requests Session.
* For `requests<2.32.0`, call `close()` on `Session` objects to clear existing connections if `verify=False` is used.
### Related Links
* [https://github.com/psf/requests/pull/6655](https://redirect.github.com/psf/requests/pull/6655)
---
### Release Notes
<details>
<summary>psf/requests (requests)</summary>
### [`v2.32.2`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2322-2024-05-21)
[Compare Source](https://redirect.github.com/psf/requests/compare/v2.32.1...v2.32.2)
**Deprecations**
- To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed `_get_connection` to
a new public API, `get_connection_with_tls_context`. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
`get_connection` is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. ([#​6710](https://redirect.github.com/psf/requests/issues/6710))
### [`v2.32.1`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2321-2024-05-20)
[Compare Source](https://redirect.github.com/psf/requests/compare/v2.32.0...v2.32.1)
**Bugfixes**
- Add missing test certs to the sdist distributed on PyPI.
### [`v2.32.0`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2320-2024-05-20)
[Compare Source](https://redirect.github.com/psf/requests/compare/v2.31.0...v2.32.0)
**Security**
- Fixed an issue where setting `verify=False` on the first request from a
Session will cause subsequent requests to the *same origin* to also ignore
cert verification, regardless of the value of `verify`.
(https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56)
**Improvements**
- `verify=True` now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. ([#​6667](https://redirect.github.com/psf/requests/issues/6667))
- Requests now supports optional use of character detection
(`chardet` or `charset_normalizer`) when repackaged or vendored.
This enables `pip` and other projects to minimize their vendoring
surface area. The `Response.text()` and `apparent_encoding` APIs
will default to `utf-8` if neither library is present. ([#​6702](https://redirect.github.com/psf/requests/issues/6702))
**Bugfixes**
- Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. ([#​6589](https://redirect.github.com/psf/requests/issues/6589))
- Fixed deserialization bug in JSONDecodeError. ([#​6629](https://redirect.github.com/psf/requests/issues/6629))
- Fixed bug where an extra leading `/` (path separator) could lead
urllib3 to unnecessarily reparse the request URI. ([#​6644](https://redirect.github.com/psf/requests/issues/6644))
**Deprecations**
- Requests has officially added support for CPython 3.12 ([#​6503](https://redirect.github.com/psf/requests/issues/6503))
- Requests has officially added support for PyPy 3.9 and 3.10 ([#​6641](https://redirect.github.com/psf/requests/issues/6641))
- Requests has officially dropped support for CPython 3.7 ([#​6642](https://redirect.github.com/psf/requests/issues/6642))
- Requests has officially dropped support for PyPy 3.7 and 3.8 ([#​6641](https://redirect.github.com/psf/requests/issues/6641))
**Documentation**
- Various typo fixes and doc improvements.
**Packaging**
- Requests has started adopting some modern packaging practices.
The source files for the projects (formerly `requests`) is now located
in `src/requests` in the Requests sdist. ([#​6506](https://redirect.github.com/psf/requests/issues/6506))
- Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system
using `hatchling`. This should not impact the average user, but extremely old
versions of packaging utilities may have issues with the new packaging format.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC45NC4zIiwidXBkYXRlZEluVmVyIjoiMzguOTcuMCIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC84LjQiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate's requests 2.31.0 -> 2.32.2 security bump for CVE-2024-35195 was merged into hotfix/8.4 as commit 8a0a3dc62, one line changed in the requirements file. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate security hotfix merged into hotfix/8.4 (commit 8a0a3dc62, PR #5067), bumping requests 2.31.0 -> 2.32.2 to fix CVE-2024-35195 (GHSA-9wx4-h78v-vm56). | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR merged into hotfix/8.4 (commit 8a0a3dc62), bumping requests 2.31.0 -> 2.32.2 to fix CVE-2024-35195. Same bump shipped on main (#5064) and hotfix/7.5 (#5065). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #5067 into hotfix/8.4 (commit 8a0a3dc62), upgrading requests from 2.31.0 to 2.32.2 to remediate CVE-2024-35195. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged security hotfix updating requests from v2.31.0 to v2.32.2 to resolve CVE-2024-35195, fixing SSL verification state leakage in HTTP sessions. Approved by two reviewers and passed CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged update to requests v2.32.2 on hotfix/8.4 to resolve CVE-2024-35195, a session certificate verification bypass vulnerability. Automated dependency upgrade applied via Renovate. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/snapcraft#5064
(confidence 92%)
Same requests 2.32.2 security bump merged to main as ec4f9b16f in the same Renovate batch.
-
Related To:
canonical/snapcraft#5065
(confidence 90%)
Same bump backported to hotfix/7.5, merged as 4df808913 (2.28.1 -> 2.32.2).
-
Superseded By:
canonical/snapcraft#5551
(confidence 55%)
Later Renovate bump of requests to 2.32.4 for a different hotfix branch (fc81a5369), superseding the 2.32.2 level on maintained lines.
-
Superseded By:
canonical/snapcraft#6127
(confidence 45%)
Later bump of requests to 2.33.0 on main (fce681014), well past the 2.32.2 pinned by this PR.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5066 build(deps): update dependency requests to v2.32.2 [security] (hotfix/8.3) | snapcraft | closed | Renovate security bump of requests 2.31.0->2.32.2 for hotfix/8.3 (CVE-2024-35195) was closed unmerged after ~724 days of inactivity; same update merged for main (#5064), hotfix/7.5 (#5065) and hotfix/8.4 (#5067). | |
| #5065 build(deps): update dependency requests to v2.32.2 [security] (hotfix/7.5) | snapcraft | merged | Merged into hotfix/7.5 as 4df808913, updating requests from 2.28.1 to 2.32.2 to remediate CVE-2024-35195. | |
| #5549 build(deps): update dependency requests to v2.32.4 [security] (main) | snapcraft | closed | Renovate PR to bump requests 2.32.3 -> 2.32.4 (CVE-2024-47081) on main was closed unmerged; the fix shipped via hotfix PR #5551 (fc81a5369) and reached main in #5557 (3a614faa3). | |
| #6126 build(deps): update dependency requests to v2.33.0 [security] (hotfix/8.14) - autoclosed | snapcraft | closed | Renovate's hotfix/8.14 requests 2.33.0 update was autoclosed unmerged; the same security bump merged via canonical/snapcraft#6127 in fce681014. | |
| #1920 build(deps): update dependency requests to v2.32.2 [security] (main) | charmcraft | closed | Closed unmerged: the requests 2.32.2 security bump was abandoned and that version was ignored by Renovate. A later update, #2612, advanced requests from 2.32.5 to 2.33.0. | |
| #5550 build(deps): update dependency requests to v2.32.4 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Autoclosed unmerged; the requests 2.32.4 security update landed on hotfix/8.9 via merged #5551 (fc81a5369), not hotfix/7.5. | |
| #5551 build(deps): update dependency requests to v2.32.4 [security] (hotfix/8.9) | snapcraft | merged | Merged in fc81a5369, upgrading requests from 2.32.3 to 2.32.4 on hotfix/8.9 to address CVE-2024-47081 credential leakage. | |
| #1519 build(deps): update dependency requests to v2.33.0 [security] (hotfix/2.7) | craft-parts | closed | Closed unmerged after failing checks; the equivalent requests 2.33.0 security update was merged into main by #1516 at commit 3d099307. | |
| #1922 build(deps): update dependency requests to v2.32.2 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Renovate autoclosed the unmerged requests 2.32.2 hotfix after prolonged inactivity; parallel main update #1920 was also closed unmerged. | |
| #1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate PR #1921 proposed requests 2.32.2 for hotfix/2.7 but was autoclosed unmerged after receiving no review or CI. |