This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [urllib3](https://redirect.github.com/urllib3/urllib3) ([changelog](https://redirect.github.com/urllib3/urllib3/blob/main/CHANGES.rst)) | `==1.26.19` -> `==2.5.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2025-50181](https://redirect.github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v) urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows: ```python resp = urllib3.request("GET", "https://httpbin.org/redirect/1", redirect=False) print(resp.status) # 302 ``` However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects: ```python import urllib3 http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response resp = http.request("GET", "https://httpbin.org/redirect/1") ``` However, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects. ## Affected usages Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number. By default, requests and botocore users are not affected. ## Impact Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. ## Remediation You can remediate this vulnerability with the following steps: * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities. * Disable redirects at the `request()` level instead of the `PoolManager()` level. #### [CVE-2025-50182](https://redirect.github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5) urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects. However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior. ## Affected usages Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime. ## Impact Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable. ## Remediation If you use urllib3 in Node.js, upgrade to a patched version of urllib3. Unfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects. --- ### Release Notes <details> <summary>urllib3/urllib3 (urllib3)</summary> ### [`v2.5.0`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#250-2025-06-18) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.4.0...2.5.0) \================== ## Features - Added support for the `compression.zstd` module that is new in Python 3.14. See `PEP 784 <https://peps.python.org/pep-0784/>`\_ for more information. (`#&#8203;3610 <https://github.com/urllib3/urllib3/issues/3610>`\_\_) - Added support for version 0.5 of `hatch-vcs` (`#&#8203;3612 <https://github.com/urllib3/urllib3/issues/3612>`\_\_) ## Bugfixes - Fixed a security issue where restricting the maximum number of followed redirects at the `urllib3.PoolManager` level via the `retries` parameter did not work. - Made the Node.js runtime respect redirect parameters such as `retries` and `redirects`. - Raised exception for `HTTPResponse.shutdown` on a connection already released to the pool. (`#&#8203;3581 <https://github.com/urllib3/urllib3/issues/3581>`\_\_) - Fixed incorrect `CONNECT` statement when using an IPv6 proxy with `connection_from_host`. Previously would not be wrapped in `[]`. (`#&#8203;3615 <https://github.com/urllib3/urllib3/issues/3615>`\_\_) ### [`v2.4.0`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#240-2025-04-10) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.3.0...2.4.0) \================== ## Features - Applied PEP 639 by specifying the license fields in pyproject.toml. (`#&#8203;3522 <https://github.com/urllib3/urllib3/issues/3522>`\__) - Updated exceptions to save and restore more properties during the pickle/serialization process. (`#&#8203;3567 <https://github.com/urllib3/urllib3/issues/3567>`\__) - Added `verify_flags` option to `create_urllib3_context` with a default of `VERIFY_X509_PARTIAL_CHAIN` and `VERIFY_X509_STRICT` for Python 3.13+. (`#&#8203;3571 <https://github.com/urllib3/urllib3/issues/3571>`\__) ## Bugfixes - Fixed a bug with partial reads of streaming data in Emscripten. (`#&#8203;3555 <https://github.com/urllib3/urllib3/issues/3555>`\__) ## Misc - Switched to uv for installing development dependecies. (`#&#8203;3550 <https://github.com/urllib3/urllib3/issues/3550>`\__) - Removed the `multiple.intoto.jsonl` asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (`#&#8203;3566 <https://github.com/urllib3/urllib3/issues/3566>`\__) ### [`v2.3.0`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#230-2024-12-22) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.2.3...2.3.0) \================== ## Features - Added `HTTPResponse.shutdown()` to stop any ongoing or future reads for a specific response. It calls `shutdown(SHUT_RD)` on the underlying socket. This feature was `sponsored by LaunchDarkly <https://opencollective.com/urllib3/contributions/815307>`**. (`#&#8203;2868 <https://github.com/urllib3/urllib3/issues/2868>`**) - Added support for JavaScript Promise Integration on Emscripten. This enables more efficient WebAssembly requests and streaming, and makes it possible to use in Node.js if you launch it as `node --experimental-wasm-stack-switching`. (`#&#8203;3400 <https://github.com/urllib3/urllib3/issues/3400>`\_\_) - Added the `proxy_is_tunneling` property to `HTTPConnection` and `HTTPSConnection`. (`#&#8203;3285 <https://github.com/urllib3/urllib3/issues/3285>`\_\_) - Added pickling support to `NewConnectionError` and `NameResolutionError`. (`#&#8203;3480 <https://github.com/urllib3/urllib3/issues/3480>`\_\_) ## Bugfixes - Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1". (`#&#8203;3489 <https://github.com/urllib3/urllib3/issues/3489>`\_\_) ## Deprecations and Removals - Removed support for Python 3.8. (`#&#8203;3492 <https://github.com/urllib3/urllib3/issues/3492>`\_\_) ### [`v2.2.3`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#223-2024-09-12) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.2.2...2.2.3) \================== ## Features - Added support for Python 3.13. (`#&#8203;3473 <https://github.com/urllib3/urllib3/issues/3473>`\_\_) ## Bugfixes - Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. (`#&#8203;3053 <https://github.com/urllib3/urllib3/issues/3053>`\_\_) - Fixed ResourceWarning on CONNECT with Python < 3.11.4 by backporting [https://github.com/python/cpython/issues/103472](https://redirect.github.com/python/cpython/issues/103472). (`#&#8203;3252 <https://github.com/urllib3/urllib3/issues/3252>`\_\_) - Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI (`#&#8203;3413 <https://github.com/urllib3/urllib3/issues/3413>`\_\_) - Fixed a crash where certain standard library hash functions were absent in restricted environments. (`#&#8203;3432 <https://github.com/urllib3/urllib3/issues/3432>`\_\_) - Fixed mypy error when adding to `HTTPConnection.default_socket_options`. (`#&#8203;3448 <https://github.com/urllib3/urllib3/issues/3448>`\_\_) ## HTTP/2 (experimental) HTTP/2 support is still in early development. - Excluded Transfer-Encoding: chunked from HTTP/2 request body (`#&#8203;3425 <https://github.com/urllib3/urllib3/issues/3425>`\_\_) - Added version checking for `h2` (https://pypi.org/project/h2/) usage. Now only accepting supported h2 major version 4.x.x. (`#&#8203;3290 <https://github.com/urllib3/urllib3/issues/3290>`\_\_) - Added a probing mechanism for determining whether a given target origin supports HTTP/2 via ALPN. (`#&#8203;3301 <https://github.com/urllib3/urllib3/issues/3301>`\_\_) - Add support for sending a request body with HTTP/2 (`#&#8203;3302 <https://github.com/urllib3/urllib3/issues/3302>`\_\_) ## Deprecations and Removals - Note for downstream distributors: the `_version.py` file has been removed and is now created at build time by hatch-vcs. (`#&#8203;3412 <https://github.com/urllib3/urllib3/issues/3412>`\_\_) - Drop support for end-of-life PyPy3.8 and PyPy3.9. (`#&#8203;3475 <https://github.com/urllib3/urllib3/issues/3475>`\_\_) ### [`v2.2.2`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#222-2024-06-17) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.2.1...2.2.2) \================== - Added the `Proxy-Authorization` header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via `Retry.remove_headers_on_redirect`. - Allowed passing negative integers as `amt` to read methods of `http.client.HTTPResponse` as an alternative to `None`. (`#&#8203;3122 <https://github.com/urllib3/urllib3/issues/3122>`\_\_) - Fixed return types representing copying actions to use `typing.Self`. (`#&#8203;3363 <https://github.com/urllib3/urllib3/issues/3363>`\_\_) ### [`v2.2.1`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#221-2024-02-16) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.2.0...2.2.1) \================== - Fixed issue where `InsecureRequestWarning` was emitted for HTTPS connections when using Emscripten. (`#&#8203;3331 <https://github.com/urllib3/urllib3/issues/3331>`\_\_) - Fixed `HTTPConnectionPool.urlopen` to stop automatically casting non-proxy headers to `HTTPHeaderDict`. This change was premature as it did not apply to proxy headers and `HTTPHeaderDict` does not handle byte header values correctly yet. (`#&#8203;3343 <https://github.com/urllib3/urllib3/issues/3343>`\_\_) - Changed `InvalidChunkLength` to `ProtocolError` when response terminates before the chunk length is sent. (`#&#8203;2860 <https://github.com/urllib3/urllib3/issues/2860>`\_\_) - Changed `ProtocolError` to be more verbose on incomplete reads with excess content. (`#&#8203;3261 <https://github.com/urllib3/urllib3/issues/3261>`\_\_) ### [`v2.2.0`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#220-2024-01-30) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.1.0...2.2.0) \================== - Added support for `Emscripten and Pyodide <https://urllib3.readthedocs.io/en/latest/reference/contrib/emscripten.html>`**, including streaming support in cross-origin isolated browser environments where threading is enabled. (`#&#8203;2951 <https://github.com/urllib3/urllib3/issues/2951>`**) - Added support for `HTTPResponse.read1()` method. (`#&#8203;3186 <https://github.com/urllib3/urllib3/issues/3186>`\_\_) - Added rudimentary support for HTTP/2. (`#&#8203;3284 <https://github.com/urllib3/urllib3/issues/3284>`\_\_) - Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. (`#&#8203;2244 <https://github.com/urllib3/urllib3/issues/2244>`\_\_) - Fixed `HTTPConnection.proxy_is_verified` and `HTTPSConnection.proxy_is_verified` to be always set to a boolean after connecting to a proxy. It could be `None` in some cases previously. (`#&#8203;3130 <https://github.com/urllib3/urllib3/issues/3130>`\_\_) - Fixed an issue where `headers` passed in a request with `json=` would be mutated (`#&#8203;3203 <https://github.com/urllib3/urllib3/issues/3203>`\_\_) - Fixed `HTTPSConnection.is_verified` to be set to `False` when connecting from a HTTPS proxy to an HTTP target. It was set to `True` previously. (`#&#8203;3267 <https://github.com/urllib3/urllib3/issues/3267>`\_\_) - Fixed handling of new error message from OpenSSL 3.2.0 when configuring an HTTP proxy as HTTPS (`#&#8203;3268 <https://github.com/urllib3/urllib3/issues/3268>`\_\_) - Fixed TLS 1.3 post-handshake auth when the server certificate validation is disabled (`#&#8203;3325 <https://github.com/urllib3/urllib3/issues/3325>`\_\_) - Note for downstream distributors: To run integration tests, you now need to run the tests a second time with the `--integration` pytest flag. (`#&#8203;3181 <https://github.com/urllib3/urllib3/issues/3181>`\_\_) ### [`v2.1.0`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#210-2023-11-13) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.7...2.1.0) \================== - Removed support for the deprecated urllib3\[secure] extra. (`#&#8203;2680 <https://github.com/urllib3/urllib3/issues/2680>`\_\_) - Removed support for the deprecated SecureTransport TLS implementation. (`#&#8203;2681 <https://github.com/urllib3/urllib3/issues/2681>`\_\_) - Removed support for the end-of-life Python 3.7. (`#&#8203;3143 <https://github.com/urllib3/urllib3/issues/3143>`\_\_) - Allowed loading CA certificates from memory for proxies. (`#&#8203;3065 <https://github.com/urllib3/urllib3/issues/3065>`\_\_) - Fixed decoding Gzip-encoded responses which specified `x-gzip` content-encoding. (`#&#8203;3174 <https://github.com/urllib3/urllib3/issues/3174>`\_\_) ### [`v2.0.7`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#207-2023-10-17) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.6...2.0.7) \================== - Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. ### [`v2.0.6`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#206-2023-10-02) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.5...2.0.6) \================== - Added the `Cookie` header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via `Retry.remove_headers_on_redirect`. ### [`v2.0.5`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#205-2023-09-20) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.4...2.0.5) \================== - Allowed pyOpenSSL third-party module without any deprecation warning. (`#&#8203;3126 <https://github.com/urllib3/urllib3/issues/3126>`\_\_) - Fixed default `blocksize` of `HTTPConnection` classes to match high-level classes. Previously was 8KiB, now 16KiB. (`#&#8203;3066 <https://github.com/urllib3/urllib3/issues/3066>`\_\_) ### [`v2.0.4`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#204-2023-07-19) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.3...2.0.4) \================== - Added support for union operators to `HTTPHeaderDict` (`#&#8203;2254 <https://github.com/urllib3/urllib3/issues/2254>`\_\_) - Added `BaseHTTPResponse` to `urllib3.__all__` (`#&#8203;3078 <https://github.com/urllib3/urllib3/issues/3078>`\_\_) - Fixed `urllib3.connection.HTTPConnection` to raise the `http.client.connect` audit event to have the same behavior as the standard library HTTP client (`#&#8203;2757 <https://github.com/urllib3/urllib3/issues/2757>`\_\_) - Relied on the standard library for checking hostnames in supported PyPy releases (`#&#8203;3087 <https://github.com/urllib3/urllib3/issues/3087>`\_\_) ### [`v2.0.3`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#203-2023-06-07) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.2...2.0.3) \================== - Allowed alternative SSL libraries such as LibreSSL, while still issuing a warning as we cannot help users facing issues with implementations other than OpenSSL. (`#&#8203;3020 <https://github.com/urllib3/urllib3/issues/3020>`\_\_) - Deprecated URLs which don't have an explicit scheme (`#&#8203;2950 <https://github.com/urllib3/urllib3/pull/2950>`\_) - Fixed response decoding with Zstandard when compressed data is made of several frames. (`#&#8203;3008 <https://github.com/urllib3/urllib3/issues/3008>`\_\_) - Fixed `assert_hostname=False` to correctly skip hostname check. (`#&#8203;3051 <https://github.com/urllib3/urllib3/issues/3051>`\_\_) ### [`v2.0.2`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#202-2023-05-03) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.1...2.0.2) \================== - Fixed `HTTPResponse.stream()` to continue yielding bytes if buffered decompressed data was still available to be read even if the underlying socket is closed. This prevents a compressed response from being truncated. (`#&#8203;3009 <https://github.com/urllib3/urllib3/issues/3009>`\_\_) ### [`v2.0.1`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#201-2023-04-30) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/2.0.0...2.0.1) \================== - Fixed a socket leak when fingerprint or hostname verifications fail. (`#&#8203;2991 <https://github.com/urllib3/urllib3/issues/2991>`\_\_) - Fixed an error when `HTTPResponse.read(0)` was the first `read` call or when the internal response body buffer was otherwise empty. (`#&#8203;2998 <https://github.com/urllib3/urllib3/issues/2998>`\_\_) ### [`v2.0.0`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#200-2023-04-26) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/1.26.20...2.0.0) \================== Read the `v2.0 migration guide <https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html>`\_\_ for help upgrading to the latest version of urllib3. ## Removed - Removed support for Python 2.7, 3.5, and 3.6 (`#&#8203;883 <https://github.com/urllib3/urllib3/issues/883>`**, `#&#8203;2336 <https://github.com/urllib3/urllib3/issues/2336>`**). - Removed fallback on certificate `commonName` in `match_hostname()` function. This behavior was deprecated in May 2000 in RFC 2818. Instead only `subjectAltName` is used to verify the hostname by default. To enable verifying the hostname against `commonName` use `SSLContext.hostname_checks_common_name = True` (`#&#8203;2113 <https://github.com/urllib3/urllib3/issues/2113>`\_\_). - Removed support for Python with an `ssl` module compiled with LibreSSL, CiscoSSL, wolfSSL, and all other OpenSSL alternatives. Python is moving to require OpenSSL with PEP 644 (`#&#8203;2168 <https://github.com/urllib3/urllib3/issues/2168>`\_\_). - Removed support for OpenSSL versions earlier than 1.1.1 or that don't have SNI support. When an incompatible OpenSSL version is detected an `ImportError` is raised (`#&#8203;2168 <https://github.com/urllib3/urllib3/issues/2168>`\_\_). - Removed the list of default ciphers for OpenSSL 1.1.1+ and SecureTransport as their own defaults are already secure (`#&#8203;2082 <https://github.com/urllib3/urllib3/issues/2082>`\_\_). - Removed `urllib3.contrib.appengine.AppEngineManager` and support for Google App Engine Standard Environment (`#&#8203;2044 <https://github.com/urllib3/urllib3/issues/2044>`\_\_). - Removed deprecated `Retry` options `method_whitelist`, `DEFAULT_REDIRECT_HEADERS_BLACKLIST` (`#&#8203;2086 <https://github.com/urllib3/urllib3/issues/2086>`\_\_). - Removed `urllib3.HTTPResponse.from_httplib` (`#&#8203;2648 <https://github.com/urllib3/urllib3/issues/2648>`\_\_). - Removed default value of `None` for the `request_context` parameter of `urllib3.PoolManager.connection_from_pool_key`. This change should have no effect on users as the default value of `None` was an invalid option and was never used (`#&#8203;1897 <https://github.com/urllib3/urllib3/issues/1897>`\_\_). - Removed the `urllib3.request` module. `urllib3.request.RequestMethods` has been made a private API. This change was made to ensure that `from urllib3 import request` imported the top-level `request()` function instead of the `urllib3.request` module (`#&#8203;2269 <https://github.com/urllib3/urllib3/issues/2269>`\_\_). - Removed support for SSLv3.0 from the `urllib3.contrib.pyopenssl` even when support is available from the compiled OpenSSL library (`#&#8203;2233 <https://github.com/urllib3/urllib3/issues/2233>`\_\_). - Removed the deprecated `urllib3.contrib.ntlmpool` module (`#&#8203;2339 <https://github.com/urllib3/urllib3/issues/2339>`\_\_). - Removed `DEFAULT_CIPHERS`, `HAS_SNI`, `USE_DEFAULT_SSLCONTEXT_CIPHERS`, from the private module `urllib3.util.ssl_` (`#&#8203;2168 <https://github.com/urllib3/urllib3/issues/2168>`\_\_). - Removed `urllib3.exceptions.SNIMissingWarning` (`#&#8203;2168 <https://github.com/urllib3/urllib3/issues/2168>`\_\_). - Removed the `_prepare_conn` method from `HTTPConnectionPool`. Previously this was only used to call `HTTPSConnection.set_cert()` by `HTTPSConnectionPool` (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Removed `tls_in_tls_required` property from `HTTPSConnection`. This is now determined from the `scheme` parameter in `HTTPConnection.set_tunnel()` (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Removed the `strict` parameter/attribute from `HTTPConnection`, `HTTPSConnection`, `HTTPConnectionPool`, `HTTPSConnectionPool`, and `HTTPResponse` (`#&#8203;2064 <https://github.com/urllib3/urllib3/issues/2064>`\_\_). ## Deprecated - Deprecated `HTTPResponse.getheaders()` and `HTTPResponse.getheader()` which will be removed in urllib3 v2.1.0. Instead use `HTTPResponse.headers` and `HTTPResponse.headers.get(name, default)`. (`#&#8203;1543 <https://github.com/urllib3/urllib3/issues/1543>`**, `#&#8203;2814 <https://github.com/urllib3/urllib3/issues/2814>`**). - Deprecated `urllib3.contrib.pyopenssl` module which will be removed in urllib3 v2.1.0 (`#&#8203;2691 <https://github.com/urllib3/urllib3/issues/2691>`\_\_). - Deprecated `urllib3.contrib.securetransport` module which will be removed in urllib3 v2.1.0 (`#&#8203;2692 <https://github.com/urllib3/urllib3/issues/2692>`\_\_). - Deprecated `ssl_version` option in favor of `ssl_minimum_version`. `ssl_version` will be removed in urllib3 v2.1.0 (`#&#8203;2110 <https://github.com/urllib3/urllib3/issues/2110>`\_\_). - Deprecated the `strict` parameter of `PoolManager.connection_from_context()` as it's not longer needed in Python 3.x. It will be removed in urllib3 v2.1.0 (`#&#8203;2267 <https://github.com/urllib3/urllib3/issues/2267>`\_\_) - Deprecated the `NewConnectionError.pool` attribute which will be removed in urllib3 v2.1.0 (`#&#8203;2271 <https://github.com/urllib3/urllib3/issues/2271>`\_\_). - Deprecated `format_header_param_html5` and `format_header_param` in favor of `format_multipart_header_param` (`#&#8203;2257 <https://github.com/urllib3/urllib3/issues/2257>`\_\_). - Deprecated `RequestField.header_formatter` parameter which will be removed in urllib3 v2.1.0 (`#&#8203;2257 <https://github.com/urllib3/urllib3/issues/2257>`\_\_). - Deprecated `HTTPSConnection.set_cert()` method. Instead pass parameters to the `HTTPSConnection` constructor (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Deprecated `HTTPConnection.request_chunked()` method which will be removed in urllib3 v2.1.0. Instead pass `chunked=True` to `HTTPConnection.request()` (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). ## Added - Added top-level `urllib3.request` function which uses a preconfigured module-global `PoolManager` instance (`#&#8203;2150 <https://github.com/urllib3/urllib3/issues/2150>`\_\_). - Added the `json` parameter to `urllib3.request()`, `PoolManager.request()`, and `ConnectionPool.request()` methods to send JSON bodies in requests. Using this parameter will set the header `Content-Type: application/json` if `Content-Type` isn't already defined. Added support for parsing JSON response bodies with `HTTPResponse.json()` method (`#&#8203;2243 <https://github.com/urllib3/urllib3/issues/2243>`\_\_). - Added type hints to the `urllib3` module (`#&#8203;1897 <https://github.com/urllib3/urllib3/issues/1897>`\_\_). - Added `ssl_minimum_version` and `ssl_maximum_version` options which set `SSLContext.minimum_version` and `SSLContext.maximum_version` (`#&#8203;2110 <https://github.com/urllib3/urllib3/issues/2110>`\_\_). - Added support for Zstandard (RFC 8878) when `zstandard` 1.18.0 or later is installed. Added the `zstd` extra which installs the `zstandard` package (`#&#8203;1992 <https://github.com/urllib3/urllib3/issues/1992>`\_\_). - Added `urllib3.response.BaseHTTPResponse` class. All future response classes will be subclasses of `BaseHTTPResponse` (`#&#8203;2083 <https://github.com/urllib3/urllib3/issues/2083>`\_\_). - Added `FullPoolError` which is raised when `PoolManager(block=True)` and a connection is returned to a full pool (`#&#8203;2197 <https://github.com/urllib3/urllib3/issues/2197>`\_\_). - Added `HTTPHeaderDict` to the top-level `urllib3` namespace (`#&#8203;2216 <https://github.com/urllib3/urllib3/issues/2216>`\_\_). - Added support for configuring header merging behavior with HTTPHeaderDict When using a `HTTPHeaderDict` to provide headers for a request, by default duplicate header values will be repeated. But if `combine=True` is passed into a call to `HTTPHeaderDict.add`, then the added header value will be merged in with an existing value into a comma-separated list (`X-My-Header: foo, bar`) (`#&#8203;2242 <https://github.com/urllib3/urllib3/issues/2242>`\_\_). - Added `NameResolutionError` exception when a DNS error occurs (`#&#8203;2305 <https://github.com/urllib3/urllib3/issues/2305>`\_\_). - Added `proxy_assert_hostname` and `proxy_assert_fingerprint` kwargs to `ProxyManager` (`#&#8203;2409 <https://github.com/urllib3/urllib3/issues/2409>`\_\_). - Added a configurable `backoff_max` parameter to the `Retry` class. If a custom `backoff_max` is provided to the `Retry` class, it will replace the `Retry.DEFAULT_BACKOFF_MAX` (`#&#8203;2494 <https://github.com/urllib3/urllib3/issues/2494>`\_\_). - Added the `authority` property to the Url class as per RFC 3986 3.2. This property should be used in place of `netloc` for users who want to include the userinfo (auth) component of the URI (`#&#8203;2520 <https://github.com/urllib3/urllib3/issues/2520>`\_\_). - Added the `scheme` parameter to `HTTPConnection.set_tunnel` to configure the scheme of the origin being tunnelled to (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Added the `is_closed`, `is_connected` and `has_connected_to_proxy` properties to `HTTPConnection` (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Added optional `backoff_jitter` parameter to `Retry`. (`#&#8203;2952 <https://github.com/urllib3/urllib3/issues/2952>`\_\_) ## Changed - Changed `urllib3.response.HTTPResponse.read` to respect the semantics of `io.BufferedIOBase` regardless of compression. Specifically, this method: - Only returns an empty bytes object to indicate EOF (that is, the response has been fully consumed). - Never returns more bytes than requested. - Can issue any number of system calls: zero, one or multiple. If you want each `urllib3.response.HTTPResponse.read` call to issue a single system call, you need to disable decompression by setting `decode_content=False` (`#&#8203;2128 <https://github.com/urllib3/urllib3/issues/2128>`\_\_). - Changed `urllib3.HTTPConnection.getresponse` to return an instance of `urllib3.HTTPResponse` instead of `http.client.HTTPResponse` (`#&#8203;2648 <https://github.com/urllib3/urllib3/issues/2648>`\_\_). - Changed `ssl_version` to instead set the corresponding `SSLContext.minimum_version` and `SSLContext.maximum_version` values. Regardless of `ssl_version` passed `SSLContext` objects are now constructed using `ssl.PROTOCOL_TLS_CLIENT` (`#&#8203;2110 <https://github.com/urllib3/urllib3/issues/2110>`\_\_). - Changed default `SSLContext.minimum_version` to be `TLSVersion.TLSv1_2` in line with Python 3.10 (`#&#8203;2373 <https://github.com/urllib3/urllib3/issues/2373>`\_\_). - Changed `ProxyError` to wrap any connection error (timeout, TLS, DNS) that occurs when connecting to the proxy (`#&#8203;2482 <https://github.com/urllib3/urllib3/pull/2482>`\_\_). - Changed `urllib3.util.create_urllib3_context` to not override the system cipher suites with a default value. The new default will be cipher suites configured by the operating system (`#&#8203;2168 <https://github.com/urllib3/urllib3/issues/2168>`\_\_). - Changed `multipart/form-data` header parameter formatting matches the WHATWG HTML Standard as of 2021-06-10. Control characters in filenames are no longer percent encoded (`#&#8203;2257 <https://github.com/urllib3/urllib3/issues/2257>`\_\_). - Changed the error raised when connecting via HTTPS when the `ssl` module isn't available from `SSLError` to `ImportError` (`#&#8203;2589 <https://github.com/urllib3/urllib3/issues/2589>`\_\_). - Changed `HTTPConnection.request()` to always use lowercase chunk boundaries when sending requests with `Transfer-Encoding: chunked` (`#&#8203;2515 <https://github.com/urllib3/urllib3/issues/2515>`\_\_). - Changed `enforce_content_length` default to True, preventing silent data loss when reading streamed responses (`#&#8203;2514 <https://github.com/urllib3/urllib3/issues/2514>`\_\_). - Changed internal implementation of `HTTPHeaderDict` to use `dict` instead of `collections.OrderedDict` for better performance (`#&#8203;2080 <https://github.com/urllib3/urllib3/issues/2080>`\_\_). - Changed the `urllib3.contrib.pyopenssl` module to wrap `OpenSSL.SSL.Error` with `ssl.SSLError` in `PyOpenSSLContext.load_cert_chain` (`#&#8203;2628 <https://github.com/urllib3/urllib3/issues/2628>`\_\_). - Changed usage of the deprecated `socket.error` to `OSError` (`#&#8203;2120 <https://github.com/urllib3/urllib3/issues/2120>`\_\_). - Changed all parameters in the `HTTPConnection` and `HTTPSConnection` constructors to be keyword-only except `host` and `port` (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Changed `HTTPConnection.getresponse()` to set the socket timeout from `HTTPConnection.timeout` value before reading data from the socket. This previously was done manually by the `HTTPConnectionPool` calling `HTTPConnection.sock.settimeout(...)` (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Changed the `_proxy_host` property to `_tunnel_host` in `HTTPConnectionPool` to more closely match how the property is used (value in `HTTPConnection.set_tunnel()`) (`#&#8203;1985 <https://github.com/urllib3/urllib3/issues/1985>`\_\_). - Changed name of `Retry.BACK0FF_MAX` to be `Retry.DEFAULT_BACKOFF_MAX`. - Changed TLS handshakes to use `SSLContext.check_hostname` when possible (`#&#8203;2452 <https://github.com/urllib3/urllib3/pull/2452>`\_\_). - Changed `server_hostname` to behave like other parameters only used by `HTTPSConnectionPool` (`#&#8203;2537 <https://github.com/urllib3/urllib3/pull/2537>`\_\_). - Changed the default `blocksize` to 16KB to match OpenSSL's default read amounts (`#&#8203;2348 <https://github.com/urllib3/urllib3/pull/2348>`\_\_). - Changed `HTTPResponse.read()` to raise an error when calling with `decode_content=False` after using `decode_content=True` to prevent data loss (`#&#8203;2800 <https://github.com/urllib3/urllib3/issues/2800>`\_\_). ## Fixed - Fixed thread-safety issue where accessing a `PoolManager` with many distinct origins would cause connection pools to be closed while requests are in progress (`#&#8203;1252 <https://github.com/urllib3/urllib3/issues/1252>`\_\_). - Fixed an issue where an `HTTPConnection` instance would erroneously reuse the socket read timeout value from reading the previous response instead of a newly configured connect timeout. Instead now if `HTTPConnection.timeout` is updated before sending the next request the new timeout value will be used (`#&#8203;2645 <https://github.com/urllib3/urllib3/issues/2645>`\_\_). - Fixed `socket.error.errno` when raised from pyOpenSSL's `OpenSSL.SSL.SysCallError` (`#&#8203;2118 <https://github.com/urllib3/urllib3/issues/2118>`\_\_). - Fixed the default value of `HTTPSConnection.socket_options` to match `HTTPConnection` (`#&#8203;2213 <https://github.com/urllib3/urllib3/issues/2213>`\_\_). - Fixed a bug where `headers` would be modified by the `remove_headers_on_redirect` feature (`#&#8203;2272 <https://github.com/urllib3/urllib3/issues/2272>`\_\_). - Fixed a reference cycle bug in `urllib3.util.connection.create_connection()` (`#&#8203;2277 <https://github.com/urllib3/urllib3/issues/2277>`\_\_). - Fixed a socket leak if `HTTPConnection.connect()` fails (`#&#8203;2571 <https://github.com/urllib3/urllib3/pull/2571>`\_\_). - Fixed `urllib3.contrib.pyopenssl.WrappedSocket` and `urllib3.contrib.securetransport.WrappedSocket` close methods (`#&#8203;2970 <https://github.com/urllib3/urllib3/issues/2970>`\_\_) ### [`v1.26.20`](https://redirect.github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#12620-2024-08-29) [Compare Source](https://redirect.github.com/urllib3/urllib3/compare/1.26.19...1.26.20) \==================== - Fixed a crash where certain standard library hash functions were absent in FIPS-compliant environments. (`#&#8203;3432 <https://github.com/urllib3/urllib3/issues/3432>`\_\_) - Replaced deprecated dash-separated setuptools entries in `setup.cfg`. (`#&#8203;3461 <https://github.com/urllib3/urllib3/pull/3461>`\_\_) - Took into account macOS setting `ECONNRESET` instead of `EPROTOTYPE` in its newer versions. (`#&#8203;3416 <https://github.com/urllib3/urllib3/pull/3416>`\_\_) - Backported changes to our tests and CI configuration from v2.x to support testing with CPython 3.12 and 3.13. (`#&#8203;3436 <https://github.com/urllib3/urllib3/pull/3436>`\_\_) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42MC4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjAuMSIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC83LjUiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->