build(deps): update dependency requests to v2.33.0 [security] (main) - autoclosed
Metadata
Current evaluation
Renovate automatically closed the requests v2.33.0 security update without merging. The PR was abandoned due to inactivity and unresolved CI checks, leaving the dependency outdated.
Suggested action: —
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [requests](https://redirect.github.com/psf/requests) ([changelog](https://redirect.github.com/psf/requests/blob/master/HISTORY.md)) | `2.32.5` → `2.33.0` |  |  |
### GitHub Vulnerability Alerts
#### [CVE-2026-25645](https://redirect.github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2)
### Impact
The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.
### Affected usages
**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.
### Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.
---
### Release Notes
<details>
<summary>psf/requests (requests)</summary>
### [`v2.33.0`](https://redirect.github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25)
[Compare Source](https://redirect.github.com/psf/requests/compare/v2.32.5...v2.33.0)
**Announcements**
- 📣 Requests is adding inline types. If you have a typed code base that
uses Requests, please take a look at [#​7271](https://redirect.github.com/psf/requests/issues/7271). Give it a try, and report
any gaps or feedback you may have in the issue. 📣
**Security**
- CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.
**Improvements**
- Migrated to a PEP 517 build system using setuptools. ([#​7012](https://redirect.github.com/psf/requests/issues/7012))
**Bugfixes**
- Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. ([#​7205](https://redirect.github.com/psf/requests/issues/7205))
**Deprecations**
- Dropped support for Python 3.9 following its end of support. ([#​7196](https://redirect.github.com/psf/requests/issues/7196))
**Documentation**
- Various typo fixes and doc improvements.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45MS41IiwidXBkYXRlZEluVmVyIjoiNDMuOTEuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Renovate automatically closed the requests v2.33.0 security update without merging. The PR was abandoned due to inactivity and unresolved CI checks, leaving the dependency outdated. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The dependency update for requests to v2.33.0 addressing CVE-2026-25645 was autoclosed without merging. The security patch was abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate autoclosed the dependency update to requests v2.33.0 addressing CVE-2026-25645 without merging. The security patch was abandoned. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed | craft-parts | closed | Renovate autoclosed the pull request updating requests to v2.32.4 for CVE-2024-47081. The security update was automatically closed and unmerged, likely due to CI failures or being superseded. | |
| #6126 build(deps): update dependency requests to v2.33.0 [security] (hotfix/8.14) - autoclosed | snapcraft | closed | Automated dependency update to requests v2.33.0 was abandoned and autoclosed without merging due to failing CI checks and unreviewed status. | |
| #1920 build(deps): update dependency requests to v2.32.2 [security] (main) | charmcraft | closed | The requests security update to v2.32.2 was abandoned and closed without merging. Renovate confirmed the change was intentionally ignored, leaving the dependency at v2.31.0 until a newer version triggers a replacement pull request. | |
| #1517 build(deps): update dependency requests to v2.33.0 [security] (hotfix/2.20) | craft-parts | closed | Updating requests to v2.33.0 for security was closed without merging. Multiple CI checks failed across tests, linters, and scanners, resulting in the PR being abandoned. | |
| #1518 build(deps): update dependency requests to v2.33.0 [security] (hotfix/2.28) - autoclosed | craft-parts | closed | The dependency update to requests v2.33.0 for CVE-2026-25645 was autoclosed by Renovate and never merged. The automation tool abandoned the change, leaving the security patch unapplied in the hotfix branch. | |
| #1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate bot pull request updating requests to v2.32.2 to address CVE-2024-35195 was autoclosed. The dependency update was not merged and remains abandoned, likely due to branch deletion or being superseded by another resolution. | |
| #5066 build(deps): update dependency requests to v2.32.2 [security] (hotfix/8.3) | snapcraft | closed | Closed without merging. The requests security update to v2.32.2 was abandoned due to inactivity, with no reviewer comments or CI checks. Likely superseded by a newer dependency update. | |
| #1119 build(deps): update dependency requests to v2.32.4 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | A dependency update to requests v2.32.4 addressing CVE-2024-47081 was autoclosed by the Renovate bot. The security patch was abandoned or superseded without merging. | |
| #1922 build(deps): update dependency requests to v2.32.2 [security] (hotfix/3.2) - autoclosed | charmcraft | closed | Automated update to requests v2.32.2 for CVE-2024-35195 on the hotfix/3.2 branch. The pull request was autoclosed without review or merge, indicating it was abandoned or superseded. | |
| #5550 build(deps): update dependency requests to v2.32.4 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Automated dependency update to requests v2.32.4 for CVE-2024-47081 was autoclosed without merging. The security patch was abandoned and not applied to the repository. |