Skip to content

Bump the pip group across 1 directory with 10 updates#1

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-6fdb4d45b7
Open

Bump the pip group across 1 directory with 10 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-6fdb4d45b7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 3, 2026

Copy link
Copy Markdown

Bumps the pip group with 10 updates in the / directory:

Package From To
babel 2.6.0 2.9.1
certifi 2018.8.24 2024.7.4
cryptography 2.3.1 48.0.1
gitpython 2.1.11 3.1.50
idna 2.7 3.15
jinja2 2.10 3.1.6
protobuf 3.6.1 5.29.6
pyopenssl 18.0.0 26.0.0
requests 2.19.1 2.33.0
urllib3 1.23 2.7.0

Updates babel from 2.6.0 to 2.9.1

Release notes

Sourced from babel's releases.

Version 2.9.1

Bugfixes

  • The internal locale-data loading functions now validate the name of the locale file to be loaded and only allow files within Babel's data directory. Thank you to Chris Lyne of Tenable, Inc. for discovering the issue!

Version 2.9.0

Upcoming version support changes

  • This version, Babel 2.9, is the last version of Babel to support Python 2.7, Python 3.4, and Python 3.5.

Improvements

  • CLDR: Use CLDR 37 – Aarni Koskela (#734)
  • Dates: Handle ZoneInfo objects in get_timezone_location, get_timezone_name - Alessio Bogon (#741)
  • Numbers: Add group_separator feature in number formatting - Abdullah Javed Nesar (#726)

Bugfixes

  • Dates: Correct default Format().timedelta format to 'long' to mute deprecation warnings – Aarni Koskela
  • Import: Simplify iteration code in "import_cldr.py" – Felix Schwarz
  • Import: Stop using deprecated ElementTree methods "getchildren()" and "getiterator()" – Felix Schwarz
  • Messages: Fix unicode printing error on Python 2 without TTY. – Niklas Hambüchen
  • Messages: Introduce invariant that _invalid_pofile() takes unicode line. – Niklas Hambüchen
  • Tests: fix tests when using Python 3.9 – Felix Schwarz
  • Tests: Remove deprecated 'sudo: false' from Travis configuration – Jon Dufresne
  • Tests: Support Py.test 6.x – Aarni Koskela
  • Utilities: LazyProxy: Handle AttributeError in specified func – Nikiforov Konstantin (#724)
  • Utilities: Replace usage of parser.suite with ast.parse – Miro Hrončok

Documentation

  • Update parse_number comments – Brad Martin (#708)
  • Add iter to Catalog documentation – @​CyanNani123

Version 2.8.1

This patch version only differs from 2.8.0 in that it backports in #752.

Version 2.8.0

Improvements

  • CLDR: Upgrade to CLDR 36.0 - Aarni Koskela (#679)
  • Messages: Don't even open files with the "ignore" extraction method - @​sebleblanc (#678)

Bugfixes

  • Numbers: Fix formatting very small decimals when quantization is disabled - Lev Lybin, @​miluChen (#662)
  • Messages: Attempt to sort all messages – Mario Frasca (#651, #606)

Docs

... (truncated)

Changelog

Sourced from babel's changelog.

Version 2.9.1

Bugfixes


* The internal locale-data loading functions now validate the name of the locale file to be loaded and only
  allow files within Babel's data directory.  Thank you to Chris Lyne of Tenable, Inc. for discovering the issue!

Version 2.9.0


Upcoming version support changes

  • This version, Babel 2.9, is the last version of Babel to support Python 2.7, Python 3.4, and Python 3.5.

Improvements


* CLDR: Use CLDR 37 – Aarni Koskela (:gh:`734`)
* Dates: Handle ZoneInfo objects in get_timezone_location, get_timezone_name - Alessio Bogon (:gh:`741`)
* Numbers: Add group_separator feature in number formatting - Abdullah Javed Nesar (:gh:`726`)

Bugfixes



* Dates: Correct default Format().timedelta format to 'long' to mute deprecation warnings – Aarni Koskela
* Import: Simplify iteration code in "import_cldr.py" – Felix Schwarz
* Import: Stop using deprecated ElementTree methods "getchildren()" and "getiterator()" – Felix Schwarz
* Messages: Fix unicode printing error on Python 2 without TTY. – Niklas Hambüchen
* Messages: Introduce invariant that _invalid_pofile() takes unicode line. – Niklas Hambüchen
* Tests: fix tests when using Python 3.9 – Felix Schwarz
* Tests: Remove deprecated 'sudo: false' from Travis configuration – Jon Dufresne
* Tests: Support Py.test 6.x – Aarni Koskela
* Utilities: LazyProxy: Handle AttributeError in specified func – Nikiforov Konstantin (:gh:`724`)
* Utilities: Replace usage of parser.suite with ast.parse – Miro Hrončok

Documentation

</code></pre>

<ul>

<li>Update parse_number comments – Brad Martin (:gh:<code>708</code>)</li>

<li>Add <strong>iter</strong> to Catalog documentation – <a href="https://github.com/CyanNani123&quot;&gt;&lt;code&gt;@​CyanNani123&lt;/code&gt;&lt;/a&gt;&lt;/li>

</ul>

<h2>Version 2.8.1</h2>

<p>This is solely a patch release to make running tests on Py.test 6+ possible.</p>

<p>Bugfixes</p>

<!-- raw HTML omitted -->

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>


<ul>

<li><a href="https://github.com/python-babel/babel/commit/a99fa2474c808b51ebdabea18db871e389751559&quot;&gt;&lt;code&gt;a99fa24&lt;/code&gt;&lt;/a> Use 2.9.0's setup.py for 2.9.1</li>

<li><a href="https://github.com/python-babel/babel/commit/60b33e083801109277cb068105251e76d0b7c14e&quot;&gt;&lt;code&gt;60b33e0&lt;/code&gt;&lt;/a> Become 2.9.1</li>

<li><a href="https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb6aac98d9b3&quot;&gt;&lt;code&gt;412015e&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/python-babel/babel/issues/782&quot;&gt;#782&lt;/a> from python-babel/locale-basename</li>

<li><a href="https://github.com/python-babel/babel/commit/5caf717ceca4bd235552362b4fbff88983c75d8c&quot;&gt;&lt;code&gt;5caf717&lt;/code&gt;&lt;/a> Disallow special filenames on Windows</li>

<li><a href="https://github.com/python-babel/babel/commit/3a700b5b8b53606fd98ef8294a56f9510f7290f8&quot;&gt;&lt;code&gt;3a700b5&lt;/code&gt;&lt;/a> Run locale identifiers through <code>os.path.basename()</code></li>

<li><a href="https://github.com/python-babel/babel/commit/5afe2b2f11dcdd6090c00231d342c2e9cd1bdaab&quot;&gt;&lt;code&gt;5afe2b2&lt;/code&gt;&lt;/a> Merge pull request <a href="https://redirect.github.com/python-babel/babel/issues/754&quot;&gt;#754&lt;/a> from python-babel/github-ci</li>

<li><a href="https://github.com/python-babel/babel/commit/58de8342f865df88697a4a166191e880e3c84d82&quot;&gt;&lt;code&gt;58de834&lt;/code&gt;&lt;/a> Replace Travis + Appveyor with GitHub Actions (WIP)</li>

<li><a href="https://github.com/python-babel/babel/commit/d1bbc08e845d03d8e1f0dfa0e04983d755f39cb5&quot;&gt;&lt;code&gt;d1bbc08&lt;/code&gt;&lt;/a> import_cldr: use logging; add -q option</li>

<li><a href="https://github.com/python-babel/babel/commit/156b7fb9f377ccf58c71cf01dc69fb10c7b69314&quot;&gt;&lt;code&gt;156b7fb&lt;/code&gt;&lt;/a> Quiesce CLDR download progress bar if requested (or not a TTY)</li>

<li><a href="https://github.com/python-babel/babel/commit/613dc1700f91c3d40b081948c0dd6023d8ece057&quot;&gt;&lt;code&gt;613dc17&lt;/code&gt;&lt;/a> Make the import warnings about unsupported number systems less verbose</li>

<li>Additional commits viewable in <a href="https://github.com/python-babel/babel/compare/v2.6.0...v2.9.1&quot;&gt;compare view</a></li>

</ul>

</details>


<br />


Updates certifi from 2018.8.24 to 2024.7.4



Commits






Updates cryptography from 2.3.1 to 48.0.1



Changelog

Sourced from cryptography's changelog.




48.0.1 - 2026-06-09



* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.

.. _v48-0-0:


48.0.0 - 2026-05-04




    

  • 

    BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed.
cryptography now requires Python 3.9 or later.
    

    • 

  • 

    BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
TBSCertList.signature algorithm does not match the outer
signatureAlgorithm now raises ValueError. Previously, such CRLs
were parsed successfully and only rejected during signature validation.
    

    • 

  • 

    Added support for :doc:/hazmat/primitives/asymmetric/mlkem and
:doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or
later, in addition to the existing AWS-LC and BoringSSL support. This means
post-quantum algorithms are now available to users of our wheels.
    

      

    • Note: Going forward, we do not guarantee that all functionality
in cryptography will be available when building against
OpenSSL. See :doc:/statements/state-of-openssl for more information.
      • 

    

    • 



.. _v47-0-0:


47.0.0 - 2026-04-24



* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table> 





... (truncated)





Commits






Updates gitpython from 2.1.11 to 3.1.50



Release notes

Sourced from gitpython's releases.




3.1.50


What's Changed



New Contributors



Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.49...3.1.50


3.1.49 - Security


What's Changed



Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.48...3.1.49


3.1.48 - Security


Accidentally deleted the previous GH release, it did mention the advisory this fixes.


What's Changed



Full Changelog: https://github.com/gitpython-developers/GitPython/compare/3.1.47...3.1.48


3.1.47 - with security fixes


Advisories



What's Changed






... (truncated)





Commits






Updates idna from 2.7 to 3.15



Release notes

Sourced from idna's releases.




v3.15


No release notes provided.


v3.14


No release notes provided.


v3.13


No release notes provided.


v3.12


No release notes provided.


v3.11


No release notes provided.


v3.10


No release notes provided.


v3.9


No release notes provided.


v3.8


What's Changed


    

  • Fix regression where IDNAError exception was not being produced for certain inputs.
    • 

  • Add support for Python 3.13, drop support for Python 3.5 as it is no longer testable.
    • 

  • Documentation improvements
    • 

  • Updates to package testing using Github actions
    • 



Thanks to Hugo van Kemenade for contributions to this release.


Full Changelog: https://github.com/kjd/idna/compare/v3.7...v3.8


v3.7


What's Changed


    

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]
    • 



Thanks to Guido Vranken for reporting the issue.


Full Changelog: https://github.com/kjd/idna/compare/v3.6...v3.7







Changelog

Sourced from idna's changelog.




3.15 (2026-05-12)


    

  • Enforce DNS-length cap on individual labels early in check_label,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.
    • 

  • Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared _unicode_dots_re from
idna.core in the codec module.
    • 

  • Use raise ... from err for proper exception chaining and
switch internal string formatting to f-strings.
    • 

  • Allow flit_core 4.x in the build backend.
    • 

  • Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.
    • 

  • Add Dependabot configuration for GitHub Actions.
    • 

  • Convert README and HISTORY from reStructuredText to Markdown.
    • 

  • Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.
    • 



Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.


3.14 (2026-05-10)


    

  • Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]
    • 



Thanks to Stan Ulbrych for reporting the issue.


3.13 (2026-04-22)


    

  • Correct classification error for codepoint U+A7F1
    • 



3.12 (2026-04-21)


    

  • Update to Unicode 17.0.0.
    • 

  • Issue a deprecation warning for the transitional argument.
    • 

  • Added lazy-loading to provide some performance improvements.
    • 

  • Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.
    • 



Thanks to Rodrigo Nogueira for contributions to this release.


3.11 (2025-10-12)


    

  • Update to Unicode 16.0.0, including significant changes to UTS46
processing. As a result of Unicode ending support for it, transitional
processing no longer has an effect and returns the same result.
    • 






... (truncated)





Commits

    

  • af30a09 Release 3.15
    • 

  • 30314d4 Pre-release 3.15rc0
    • 

  • 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
    • 

  • 2987fdb Convert README and HISTORY from reStructuredText to Markdown
    • 

  • 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
    • 

  • def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
    • 

  • bbd8004 Merge pull request #234 from StanFromIreland/patch-1
    • 

  • edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
    • 

  • 5557db0 Merge branch 'master' into patch-1
    • 

  • f11746c Merge pull request #235 from StanFromIreland/patch-2
    • 

  • Additional commits viewable in compare view
    • 







Updates jinja2 from 2.10 to 3.1.6



Release notes

Sourced from jinja2's releases.




3.1.6


This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.


PyPI: https://pypi.org/project/Jinja2/3.1.6/
Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6



3.1.5


This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.


PyPI: https://pypi.org/project/Jinja2/3.1.5/
Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5
Milestone: https://github.com/pallets/jinja/milestone/16?closed=1


    

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h
    • 

  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699
    • 

  • Sandbox does not allow clear and pop on known mutable sequence types. #2032
    • 

  • Calling sync render for an async template uses asyncio.run. #1952
    • 

  • Avoid unclosed auto_aiter warnings. #1960
    • 

  • Return an aclose-able AsyncGenerator from Template.generate_async. #1960
    • 

  • Avoid leaving root_render_func() unclosed in Template.generate_async. #1960
    • 

  • Avoid leaving async generators unclosed in blocks, includes and extends. #1960
    • 

  • The runtime uses the correct concat function for the current environment when calling block references. #1701
    • 

  • Make |unique async-aware, allowing it to be used after another async-aware filter. #1781
    • 

  • |int filter handles OverflowError from scientific notation. #1921
    • 

  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021
    • 

  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025
    • 

  • Fix copy/pickle support for the internal missing object. #2027
    • 

  • Environment.overlay(enable_async) is applied correctly. #2061
    • 

  • The error message from FileSystemLoader includes the paths that were searched. #1661
    • 

  • PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705
    • 

  • Improve annotations for methods returning copies. #1880
    • 

  • urlize does not add mailto: to values like @a@b. #1870
    • 

  • Tests decorated with @pass_context can be used with the |select filter. #1624
    • 

  • Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413
    • 

  • Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253
    • 



3.1.4


This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.


PyPI: https://pypi.org/project/Jinja2/3.1.4/
Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4


    

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
    • 



3.1.3


This is a fix release for the 3.1.x feature branch.


    

  • Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.
    • 






... (truncated)





Changelog

Sourced from jinja2's changelog.




Version 3.1.6


Released 2025-03-05


    

  • The |attr filter does not bypass the environment's attribute lookup,
allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7
    • 



Version 3.1.5


Released 2024-12-21


    

  • The sandboxed environment handles indirect calls to str.format, such as
by passing a stored reference to a filter that calls its argument.
:ghsa:q2x7-8rv6-6q7h
    • 

  • Escape template name before formatting it into error messages, to avoid
issues with names that contain f-string syntax.
:issue:1792, :ghsa:gmj6-6f8f-6699
    • 

  • Sandbox does not allow clear and pop on known mutable sequence
types. :issue:2032
    • 

  • Calling sync render for an async template uses asyncio.run.
:pr:1952
    • 

  • Avoid unclosed auto_aiter warnings. :pr:1960
    • 

  • Return an aclose-able AsyncGenerator from
Template.generate_async. :pr:1960
    • 

  • Avoid leaving root_render_func() unclosed in
Template.generate_async. :pr:1960
    • 

  • Avoid leaving async generators unclosed in blocks, includes and extends.
:pr:1960
    • 

  • The runtime uses the correct concat function for the current environment
when calling block references. :issue:1701
    • 

  • Make |unique async-aware, allowing it to be used after another
async-aware filter. :issue:1781
    • 

  • |int filter handles OverflowError from scientific notation.
:issue:1921
    • 

  • Make compiling deterministic for tuple unpacking in a {% set ... %}
call. :issue:2021
    • 

  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined
objects. :issue:2025
    • 

  • Fix copy/pickle support for the internal missing object.
:issue:2027
    • 

  • Environment.overlay(enable_async) is applied correctly. :pr:2061
    • 

  • The error message from FileSystemLoader includes the paths that were
searched. :issue:1661
    • 

  • PackageLoader shows a clearer error message when the package does not
contain the templates directory. :issue:1705
    • 

  • Improve annotations for methods returning copies. :pr:1880
    • 

  • urlize does not add mailto: to values like @a@b. :pr:1870
    • 






... (truncated)





Commits






Updates protobuf from 3.6.1 to 5.29.6



Release notes

Sourced from protobuf's releases.




Protocol Buffers v34.0-rc1


Announcements



Bazel



Compiler



C++






... (truncated)





Commits






Updates pyopenssl from 18.0.0 to 26.0.0



Changelog

Sourced from pyopenssl's changelog.




26.0.0 (2026-03-15)


Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


    

  • Dropped support for Python 3.7.
    • 

  • The minimum cryptography version is now 46.0.0.
    • 



Deprecations:
^^^^^^^^^^^^^


Changes:
^^^^^^^^


    

  • Added support for using aws-lc instead of OpenSSL.
    • 

  • Properly raise an error if a DTLS cookie callback returned a cookie longer than DTLS1_COOKIE_LENGTH bytes. Previously this would result in a buffer-overflow. Credit to dark_haxor for reporting the issue. CVE-2026-27459
    • 

  • Added OpenSSL.SSL.Connection.get_group_name to determine which group name was negotiated.
    • 

  • Context.set_tlsext_servername_callback now handles exceptions raised in the callback by calling sys.excepthook and returning a fatal TLS alert. Previously, exceptions were silently swallowed and the handshake would proceed as if the callback had succeeded. Credit to Leury Castillo for reporting this issue. CVE-2026-27448
    • 



25.3.0 (2025-09-16)


Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


Deprecations:
^^^^^^^^^^^^^


Changes:
^^^^^^^^


    

  • Maximum supported cryptography version is now 46.x.
    • 



25.2.0 (2025-09-14)


Backward-incompatible changes:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


    

  • The minimum cryptography version is now 45.0.7.
    • 



Deprecations:
^^^^^^^^^^^^^


Changes:
^^^^^^^^


    

  • pyOpenSSL now sets SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER on connections by default, matching CPython's behavior.
    • 






... (truncated)





Commits

    

  • 358cbf2 Prepare for 26.0.0 release (#1487)
    • 

  • a8d28e7 Bump actions/cache from 4 to 5 (#1486)
    • 

  • 6fefff0 Add aws-lc compatibility to tests and CI (#1476)
    • 

  • a739f96 Bump actions/download-artifact from 8.0.0 to 8.0.1 (#1485)
    • 

  • 8b4c66b Bump actions/upload-artifact in /.github/actions/upload-coverage (#1484)
    • 

  • 02a5c78 Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#1483)
    • 

  • d973387 Bump actions/download-artifact from 7.0.0 to 8.0.0 (#1482)
    • 

  • 57f09bb Fix buffer overflow in DTLS cookie generation callback (#1479)
    • 

  • d41a814 Handle exceptions in set_tlsext_servername_callback callbacks (#1478)
    • 

  • 7b29beb Fix not using a cryptography wheel on uv (#1475)
    • 

  • Additional commits viewable in compare view
    • 







Updates requests from 2.19.1 to 2.33.0



Release notes

Sourced from requests's releases.




v2.33.0


2.33.0 (2026-03-25)


Announcements


    

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣
    • 



Security


    

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.
    • 



Improvements


    

  • Migrated to a PEP 517 build system using setuptools. (#7012)
    • 



Bugfixes


    

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)
    • 



Deprecations


    

  • Dropped support for Python 3.9 following its end of support. (#7196)
    • 



Documentation


    

  • Various typo fixes and doc improvements.
    • 



New Contributors

@dependabot
Bump the pip group across 1 directory with 10 updates
3a29953 
Bumps the pip group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [babel](https://github.com/python-babel/babel) | `2.6.0` | `2.9.1` |
| [certifi](https://github.com/certifi/python-certifi) | `2018.8.24` | `2024.7.4` |
| [cryptography](https://github.com/pyca/cryptography) | `2.3.1` | `48.0.1` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `2.1.11` | `3.1.50` |
| [idna](https://github.com/kjd/idna) | `2.7` | `3.15` |
| [jinja2](https://github.com/pallets/jinja) | `2.10` | `3.1.6` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `3.6.1` | `5.29.6` |
| [pyopenssl](https://github.com/pyca/pyopenssl) | `18.0.0` | `26.0.0` |
| [requests](https://github.com/psf/requests) | `2.19.1` | `2.33.0` |
| [urllib3](https://github.com/urllib3/urllib3) | `1.23` | `2.7.0` |



Updates `babel` from 2.6.0 to 2.9.1
- [Release notes](https://github.com/python-babel/babel/releases)
- [Changelog](https://github.com/python-babel/babel/blob/master/CHANGES.rst)
- [Commits](python-babel/babel@v2.6.0...v2.9.1)

Updates `certifi` from 2018.8.24 to 2024.7.4
- [Commits](certifi/python-certifi@2018.08.24...2024.07.04)

Updates `cryptography` from 2.3.1 to 48.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@2.3.1...48.0.1)

Updates `gitpython` from 2.1.11 to 3.1.50
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@2.1.11...3.1.50)

Updates `idna` from 2.7 to 3.15
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v2.7...v3.15)

Updates `jinja2` from 2.10 to 3.1.6
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@2.10...3.1.6)

Updates `protobuf` from 3.6.1 to 5.29.6
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pyopenssl` from 18.0.0 to 26.0.0
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pyopenssl@18.0.0...26.0.0)

Updates `requests` from 2.19.1 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.19.1...v2.33.0)

Updates `urllib3` from 1.23 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@1.23...2.7.0)

---
updated-dependencies:
- dependency-name: babel
  dependency-version: 2.9.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2024.7.4
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gitpython
  dependency-version: 3.1.50
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: idna
  dependency-version: '3.15'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: jinja2
  dependency-version: 3.1.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: protobuf
  dependency-version: 5.29.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyopenssl
  dependency-version: 26.0.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants