Update all minor versions (master) (minor) by renovate[bot] · Pull Request #22 · camptocamp/docker-swisstopo-light-basemap

renovate · 2024-11-08T09:57:59Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
lxml (source, changelog)	`==4.7.1` → `==4.9.4`	packages	minor
openresty/openresty	`1.21.4.3-2-jammy` → `1.31.1.1-2-jammy`	final	minor
pipenv	`==2022.1.8` → `==2022.12.19`		minor
requests (changelog)	`==2.27.1` → `==2.34.2`	packages	minor

Release Notes

lxml/lxml (lxml)

`v4.9.4`

Compare Source

==================

Features added

Character escaping in C14N2 serialisation now uses a single pass over the text
instead of searching for each unescaped character separately.
Early support for Python 3.13a2 was added.

Bugs fixed

LP#1976304: The Element.addnext() method previously inserted the new element
before existing tail text. The tail text of both sibling elements now stays on
the respective elements.
LP#1980767, GH#379: TreeBuilder.close() could fail with a TypeError after
parsing incorrect input. Original patch by Enrico Minack.
Element.itertext(with_tail=False) returned the tail text of comments and
processing instructions, despite the explicit option.
GH#370: A crash with recent libxml2 2.11.x versions was resolved.
Patch by Michael Schlenker.
A compile problem with recent libxml2 2.12.x versions was resolved.
The internal exception handling in C callbacks was improved for Cython 3.0.
The exception declarations of xmlInputReadCallback, xmlInputCloseCallback,
xmlOutputWriteCallback and xmlOutputCloseCallback in tree.pxd were
corrected to prevent running Python code or calling into the C-API with a live
exception set.
GH#385: The long deprecated unittest.m̀akeSuite() function is no longer used.
Patch by Miro Hrončok.
LP#1522052: A file-system specific test is now optional and should no longer fail
on systems that don't support it.
GH#392: Some tests were adapted for libxml2 2.13.
Patch by Nick Wellnhofer.
Contains all fixes from lxml 4.9.4.

Other changes

LP#1742885: lxml no longer expands external entities (XXE) by default to prevent
the security risk of loading arbitrary files and URLs. If this feature is needed,
it can be enabled in a backwards compatible way by using a parser with the option
resolve_entities=True. The new default is resolve_entities='internal'.
With libxml2 2.10.4 and later (as provided by the lxml 5.0 binary wheels),
parsing HTML tags with "prefixes" no longer builds a namespace dictionary
in nsmap but considers the prefix:name string the actual tag name.
With older libxml2 versions, since 2.9.11, the prefix was removed. Before
that, the prefix was parsed as XML prefix.

lxml 5.0 does not try to hide this difference but now changes the ElementPath
implementation to let element.find("part1:part2") search for the tag
part1:part2 in documents parsed as HTML, instead of looking only for part2.
LP#2024343: The validation of the schema file itself is now optional in the
ISO-Schematron implementation. This was done because some lxml distributions
discard the RNG validation schema file due to licensing issues. The validation
can now always be disabled with Schematron(..., validate_schema=False).
It is enabled by default if available and disabled otherwise. The module
constant lxml.isoschematron.schematron_schema_valid_supported can be used
to detect whether schema file validation is available.
Some redundant and long deprecated methods were removed:
parser.setElementClassLookup(),
xslt_transform.apply(),
xpath.evaluate().
Some incorrect declarations were removed from python.pxd. In general, this file
should not be used by external Cython code. Use the C-API declarations provided by
Cython itself instead.
Binary wheels use the library versions libxml2 2.12.3 and libxslt 1.1.39.
Built with Cython 3.0.7, updated to follow recent changes in Cython 3.1-dev.

`v4.9.3`

Compare Source

==================

Bugs fixed

LP#2008911: lxml.objectify accepted non-decimal numbers like ²²² as integers.
A memory leak in lxml.html.clean was resolved by switching to Cython 0.29.34+.
GH#348: URL checking in the HTML cleaner was improved.
Patch by Tim McCormack.
GH#371, GH#373: Some regex strings were changed to raw strings to fix Python warnings.
Patches by Jakub Wilk and Anthony Sottile.

Other changes

Wheels include zlib 1.2.13, libxml2 2.10.3 and libxslt 1.1.38
(zlib 1.2.12, libxml2 2.10.3 and libxslt 1.1.37 on Windows).
Built with Cython 0.29.36 to adapt to changes in Python 3.12.

`v4.9.2`

Compare Source

==================

Bugs fixed

CVE-2022-2309: A Bug in libxml2 2.9.1[0-4] could let namespace declarations
from a failed parser run leak into later parser runs. This bug was worked around
in lxml and resolved in libxml2 2.10.0.
https://gitlab.gnome.org/GNOME/libxml2/-/issues/378

Other changes

LP#1981760: Element.attrib now registers as collections.abc.MutableMapping.
lxml now has a static build setup for macOS on ARM64 machines (not used for building wheels).
Patch by Quentin Leffray.

`v4.9.1`

Compare Source

==================

Bugs fixed

A crash was resolved when using iterwalk() (or canonicalize())
after parsing certain incorrect input. Note that iterwalk() can crash
on valid input parsed with the same parser after failing to parse the
incorrect input.

`v4.9.0`

Compare Source

==================

Bugs fixed

GH#341: The mixin inheritance order in lxml.html was corrected.
Patch by xmo-odoo.

Other changes

Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12.
Wheels include zlib 1.2.12, libxml2 2.9.14 and libxslt 1.1.35
(libxml2 2.9.12+ and libxslt 1.1.34 on Windows).
GH#343: Windows-AArch64 build support in Visual Studio.
Patch by Steve Dower.

`v4.8.0`

Compare Source

==================

Features added

GH#337: Path-like objects are now supported throughout the API instead of just strings.
Patch by Henning Janssen.
The ElementMaker now supports QName values as tags, which always override
the default namespace of the factory.

Bugs fixed

GH#338: In lxml.objectify, the XSI float annotation "nan" and "inf" were spelled in
lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively.
Patch by Tobias Deiminger.

Other changes

Built with Cython 0.29.28.

pypa/pipenv (pipenv)

`v2022.12.19`

Compare Source

Bug Fixes

Fix for requirementslib hanging during install of remote wheels files. #5546

`v2022.12.17`

Compare Source

Bug Fixes

virtualenv creation no longer uses --creator=venv by default; introduced two environment variables:
PIPENV_VIRTUALENV_CREATOR -- May be specified to instruct virtualenv which --creator= to use.
PIPENV_VIRTUALENV_COPIES -- When specified as truthy, instructs virtualenv to not use symlinks. #5477
Fix regression where path is not propagated to the Pipfile.lock. #5479
Solve issue where null markers were getting added to lock file when extras were provided. #5486
Fix: update --outdated raises NonExistentKey with outdated dev packages #5540

Vendored Libraries

Vendor in pip==22.3.1 which is currently the latest version of pip. #5520
- Bump version of requirementslib to 2.2.1
- Bump version of vistir to 0.7.5
- Bump version of colorama to 0.4.6 #5522
Bump plette version to 0.4.4 #5539

`v2022.11.30`

Compare Source

Bug Fixes

Fix regression: pipenv does not sync indexes to lockfile. #5508

`v2022.11.25`

Compare Source

Bug Fixes

Solving issue where pipenv check command has been broken in the published wheel distribution. #5493

`v2022.11.24`

Compare Source

Bug Fixes

Stop building universal wheels since Python 2 is no longer supported. #5496

`v2022.11.23`

Compare Source

Features & Improvements

Find nushell activate scripts. #5470

Vendored Libraries

- Drop unused code from cerberus
- Drop unused module wheel #5467
- Replace yaspin spinner with rich spinner.
- Bump vistir version to 0.7.4 #5468
Bump version of requirementslib to 2.2.0
Drop yaspin which is no longer used.
Bump vistir to version 0.7.4
Remove parse.
Remove termcolor.
Remove idna. #5481

`v2022.11.11`

Compare Source

Bug Fixes

Fix regression of lock generation that caused the keep-outdated behavior to be default. #5456

`v2022.11.5`

Compare Source

Bug Fixes

Rollback the change in version of colorama due to regressions in core functionality. #5459

`v2022.11.4`

Compare Source

Features & Improvements

Allow pipenv settings to be explicitly disabled more easily by assigning to the environment variable a falsy value. #5451

Bug Fixes

Provide an install iteration per index when install_search_all_sources is false (default behavior).
This fixes regression where install phase was using unexpected index after updating pip==22.3 #5444

Vendored Libraries

Drop tomli, which is not used anymore.
Bump attrs version see #5449.
Drop distlib, colorama and platformdirs - use the ones from pip._vendor. #5450

`v2022.10.25`

Compare Source

Features & Improvements

Add support to export requirements file for a specified set of categories. #5431

Vendored Libraries

Remove appdirs.py in favor of platformdirs. #5420

Removals and Deprecations

Remove usage of vistir.cmdparse in favor of pipenv.cmdparse #5419

`v2022.10.12`

Compare Source

Improved Documentation

Update pipenv docs for with example for callabale package functions in Pipfile scripts #5396

`v2022.10.11`

Compare Source

Bug Fixes

Revert decision to change the default isolation level because it caused problems with existing workflows; solution is to recommend users that have issues requiring pre-requisites to pass --extra-pip-args="--no-build-isolation" in their install or sync commands. #5399

`v2022.10.10`

Compare Source

Features & Improvements

Add ability for callable scripts in Pipfile under [scripts]. Callables can now be added like: <pathed.module>:<func> and can also take arguments. For example: func = {call = "package.module:func('arg1', 'arg2')"} then this can be activated in the shell with pipenv run func #5294

Bug Fixes

Fixes regression from 2022.10.9 where Pipfile with pipenv section began generating new hash,
and also fix regression where lock phase did not update the hash value. #5394

`v2022.10.9`

Compare Source

Features & Improvements

Add ability for callable scripts in Pipfile under [scripts]. Callables can now be added like: <pathed.module>:<func> and can also take arguments. For example: func = {call = "package.module:func('arg1', 'arg2')"} then this can be activated in the shell with pipenv run func #5294

Bug Fixes

Fixes regression from 2022.10.9 where Pipfile with pipenv section began generating new hash,
and also fix regression where lock phase did not update the hash value. #5394

`v2022.10.4`

Compare Source

Bug Fixes

Use --creator=venv when creating virtual environments to avoid issue with sysconfig posix_prefix on some systems. #5075
Prefer to use the lockfile sources if available during the install phase. #5380

Vendored Libraries

Drop vendored six - we no longer depend on this library, as we migrated from pipfile to plette. #5187

`v2022.9.24`

Compare Source

Bug Fixes

Update requirementslib==2.0.3 to always evaluate the requirement markers fresh (without lru_cache) to fix marker determinism issue. #4660

`v2022.9.21`

Compare Source

Bug Fixes

Fix regression to install --skip-lock with update to plette. #5368

`v2022.9.20`

Compare Source

Behavior Changes

Remove usage of pipfile module in favour of Plette.
pipfile is not actively maintained anymore. Plette is actively maintained,
and has stricter checking of the Pipefile and Pipefile.lock. As a result,
Pipefile with unnamed package indices will fail to lock. If a Pipefile
was hand crafeted, and the source is anonymous an error will be thrown.
The solution is simple, add a name to your index, e.g, replace:
```
[[source]]
url = "https://pypi.acme.com/simple"
verify_ssl = true
```
With:
```
[[source]]
url = "https://pypi.acme.com/simple"
verify_ssl = true
name = acmes_private_index  `#&#8203;5339 <https://github.com/pypa/pipenv/issues/5339>`_
```

Bug Fixes

Modernize pipenv path patch with importlib.util to eliminate import of pkg_resources #5349

Vendored Libraries

Remove iso8601 from vendored packages since it was not used. #5346

`v2022.9.8`

Compare Source

Features & Improvements

It is now possible to supply additional arguments to pip install by supplying --extra-pip-args="<arg1> <arg2>"
See the updated documentation Supplying additional arguments to pip for more details. #5283

Bug Fixes

Make editable detection better because not everyone specifies editable entry in the Pipfile for local editable installs. #4784
Add error handling for when the installed package setup.py does not contain valid markers. #5329
Load the dot env earlier so that PIPENV_CUSTOM_VENV_NAME is more useful across projects. #5334

Vendored Libraries

Bump version of shellingham to support nushell. #5336
Bump plette to version v0.3.0 #5337
Bump version of pipdeptree #5343

Removals and Deprecations

Add deprecation warning to the --three flag. Pipenv now uses python3 by default. #5328

Relates to dev process changes

Convert the test runner to use pypiserver as a standalone process for all tests that referencce internal pypi artifacts.
General refactoring of some test cases to create more variety in packages selected--preferring lighter weight packages--in existing test cases.

`v2022.9.4`

Compare Source

Bug Fixes

Fix the issue from 2022.9.2 where tarball URL packages were being skipped on batch_install. #5306

`v2022.9.2`

Compare Source

Bug Fixes

Update requirementslib==2.0.3 to always evaluate the requirement markers fresh (without lru_cache) to fix marker determinism issue. #4660

`v2022.8.31`

Compare Source

Features & Improvements

Performance optimization to batch_install results in a faster and less CPU intensive pipenv sync or pipenv install experience. #5301

Bug Fixes

pipenv now uses a NamedTemporaryFile for rsolver constraints and drops internal env var PIPENV_PACKAGES. #4925

Removals and Deprecations

Remove no longer used method which_pip. #5314
Drop progress bar file due to recent performance optimization to combine batch_install requirements in at most two invocations of pip install.
To see progress of install pass --verbose flag and pip progress will be output in realtime. #5315

`v2022.8.30`

Compare Source

Bug Fixes

Fix an issue when using pipenv install --system on systems that having the python executable pointing to Python 2 and a Python 3 executable being python3. #5296
Sorting constraints before resolving, which fixes pipenv lock generates nondeterminism environment markers. #5299
Fix #5273, use our own method for checking if a package is a valid constraint. #5309

Vendored Libraries

Vendor in requirementslib==2.0.1 which fixes issue with local install not marked editable, and vendor in vistir==0.6.1 which drops python2 support.
Drops orderedmultidict from vendoring. #5308

`v2022.8.24`

Compare Source

Bug Fixes

Remove eager and unnecessary importing of setuptools and pkg_resources to avoid conflict upgrading setuptools.
Roll back sysconfig patch of pip because it was problematic for some --system commands. #5228

Vendored Libraries

Vendor in requirementslib==2.0.0 and drop pip-shims entirely. #5228
Vendor in pythonfinder==1.3.1 #5292

`v2022.8.19`

Compare Source

Bug Fixes

Fix issue where resolver is provided with install_requires constraints from setup.py that depend on editable dependencies and could not resolve them. #5271
Fix for pipenv lock fails for packages with extras as of 2022.8.13. #5274
Revert the exclusion of BAD_PACKAGES from batch_install in order for pipenv to install specific versions of setuptools.
To prevent issue upgrading setuptools this patches _USE_SYSCONFIG_DEFAULT to use sysconfig for 3.7 and above whereas pip default behavior was 3.10 and above. #5275

`v2022.8.17`

Compare Source

Bug Fixes

Fix "The Python interpreter can't be found" error when running pipenv install --system with a python3 but no python. #5261
Revise pip import patch to include only pipenv from site-packages and removed --ignore-installed argument from pip install in order to fix regressions with --use-site-packages. #5265

`v2022.8.15`

Compare Source

Bug Fixes

pip_install method was using a different way of finding the python executable than other pipenv commands, which caused an issue with skipping package installation if it was already installed in site-packages. #5254

`v2022.8.14`

Compare Source

Bug Fixes

Removed packaging library from BAD_PACKAGES constant to allow it to be installed, which fixes regression from pipenv==2022.8.13. #5247

`v2022.8.13`

Compare Source

Bug Fixes

Fix issue where resolver is provided with install_requires constraints from setup.py that depend on editable dependencies and could not resolve them. #5271
Fix for pipenv lock fails for packages with extras as of 2022.8.13. #5274
Revert the exclusion of BAD_PACKAGES from batch_install in order for pipenv to install specific versions of setuptools.
To prevent issue upgrading setuptools this patches _USE_SYSCONFIG_DEFAULT to use sysconfig for 3.7 and above whereas pip default behavior was 3.10 and above. #5275

`v2022.8.5`

Compare Source

Features & Improvements

support PIPENV_CUSTOM_VENV_NAME to be the venv name if specified, update relevant docs. #4974

Bug Fixes

Remove usages of pip_shims from the non vendored pipenv code, but retain initialization for requirementslib still has usages. #5204
Fix case sensitivity of color name red in exception when getting hashes from pypi in _get_hashes_from_pypi. #5206
Write output from subprocess_run directly to stdout instead of creating temporary file.
Remove deprecated distutils.sysconfig, use sysconfig. #5210

Vendored Libraries

- Rename patched notpip to pip in order to be clear that its a patched version of pip.
- Remove the part of _post_pip_import.patch that overrode the standalone pip to be the user installed pip, now we fully rely on our vendored and patched pip, even for all types of installs.
- Vendor in the next newest version of pip==22.2
- Modify patch for pipdeptree to not use pip-shims #5188
- Remove vendored urllib3 in favor of using it from vendored version in pip._vendor #5215

Removals and Deprecations

Remove tests that have been for a while been marked skipped and are no longer relevant. #5165

`v2022.7.24`

Compare Source

Bug Fixes

Re-enabled three installs tests again on the Windows CI as recent refactor work has fixed them. #5064
Support ANSI NO_COLOR environment variable and deprecate PIPENV_COLORBLIND variable, which will be removed after this release. #5158
Fixed edge case where a non-editable file, url or vcs would overwrite the value no_deps for all other requirements in the loop causing a retry condition. #5164
Vendor in latest requirementslib for fix to lock when using editable VCS module with specific @ git reference. #5179

Vendored Libraries

Remove crayons and replace with click.secho and click.styles per #3741 #3741
Vendor in latest version of pip==22.1.2 which upgrades pipenv from pip==22.0.4.
Vendor in latest version of requirementslib==1.6.7 which includes a fix for tracebacks on encountering Annotated variables.
Vendor in latest version of pip-shims==0.7.3 such that imports could be rewritten to utilize packaging from vendor'd pip.
Drop the packaging requirement from the vendor directory in pipenv. #5147
Remove unused vendored dependency normailze-charset. #5161
Remove obsolete package funcsigs. #5168
Bump vendored dependency pyparsing==3.0.9. #5170

`v2022.7.4`

Compare Source

Behavior Changes

Adjust pipenv requirements to add markers and add an --exclude-markers option to allow the exclusion of markers. #5092

Bug Fixes

Stopped expanding environment variables when using pipenv requirements #5134

Vendored Libraries

Depend on requests and certifi from vendored pip and remove them as explicit vendor dependencies. #5000
Vendor in the latest version of requirementslib==1.6.5 which includes bug fixes for beta python versions, projects with an at sign (@) in the path, and a setuptools deprecation warning. #5132

Relates to dev process changes

Switch from using type comments to type annotations.

`v2022.6.7`

Compare Source

What's Changed

More vistir drops makefile improvements by @oz123 in #5102
Make pipenv work with the venv install scheme if it is detected by @torsava in #5096

Full Changelog: pypa/pipenv@v2022.5.2...v2022.6.7

`v2022.5.2`

Compare Source

Bug Fixes

Fixes issue of pipenv lock -r command printing to stdout instead of stderr. #5091

`v2022.4.30`

Compare Source

Bug Fixes

Fixes issue of requirements command problem by modifying to print -e and path of the editable package. #5070
Revert specifier of setuptools requirement in setup.py back to what it was in order to fix FileNotFoundError: [Errno 2] issue report. #5075
Fixes issue of requirements command where git requirements cause the command to fail, solved by using existing convert_deps_to_pip function. #5076

Vendored Libraries

Vendor in requirementslib==1.6.4 to Fix SetuptoolsDeprecationWarning setuptools.config.read_configuration became deprecated. #5081

Removals and Deprecations

Remove more usage of misc functions of vistir. Many of this function are available in the STL or in another dependency of pipenv. #5078

`v2022.4.21`

Compare Source

Removals and Deprecations

Updated setup.py to remove support for python 3.6 from built pipenv packages' Metadata. #5065

`v2022.4.20`

Compare Source

Features & Improvements

Added new Pipenv option install_search_all_sources that allows installation of packages from an
existing Pipfile.lock to search all defined indexes for the constrained package version and hash signatures. #5041

Bug Fixes

allow the user to disable the no_input flag, so the use of e.g Google Artifact Registry is possible. #4706
Fixes case where packages could fail to install and the exit code was successful. #5031

Vendored Libraries

Updated vendor version of pip from 21.2.2 to 22.0.4 which fixes a number of bugs including
several reports of pipenv locking for an infinite amount of time when using certain package constraints.
This also drops support for python 3.6 as it is EOL and support was removed in pip 22.x #4995

Removals and Deprecations

Removed the vendor dependency more-itertools as it was originally added for zipp, which since stopped using it. #5044
Removed all usages of pipenv.vendor.vistir.compat.fs_str, since this function was used for PY2-PY3 compatibility and is no longer needed. #5062

Relates to dev process changes

Added pytest-cov and basic configuration to the project for generating html testing coverage reports.
Make all CI jobs run only after the lint stage. Also added a makefile target for vendoring the packages.

`v2022.4.8`

Compare Source

Features & Improvements

Implements a pipenv requirements command which generates a requirements.txt compatible output without locking. #4959
Internal to pipenv, the utils.py was split into a utils module with unused code removed. #4992

Bug Fixes

Pipenv will now ignore .venv in the project when PIPENV_VENV_IN_PROJECT variable is False.
Unset variable maintains the existing behavior of preferring to use the project's .venv should it exist. #2763
Fix an edge case of hash collection in index restricted packages whereby the hashes for some packages would
be missing from the Pipfile.lock following package index restrictions added in pipenv==2022.3.23. #5023

Improved Documentation

Pipenv CLI documentation generation has been fixed. It had broke when click was vendored into the project in
2021.11.9 because by default sphinx-click could no longer determine the CLI inherited from click. #4778
Improve documentation around extra indexes and index restricted packages. #5022

Removals and Deprecations

Removes the optional install argument --extra-index-url as it was not compatible with index restricted packages.
Using the --index argument is the correct way to specify a package should be pulled from the non-default index. #5022

Relates to dev process changes

Added code linting using pre-commit-hooks, black, flake8, isort, pygrep-hooks, news-fragments and check-manifest.
Very similar to pip's configuration; adds a towncrier new's type process for change to Development processes.

`v2022.3.28`

Compare Source

Bug Fixes

Environment variables were not being loaded when the --quiet flag was set #5010
It would appear that requirementslib was not fully specifying the subdirectory to build_pep517 and
and when a new version of setuptools was released, the test test_lock_nested_vcs_direct_url
broke indicating the Pipfile.lock no longer contained the extra dependencies that should have been resolved.
This regression affected pipenv>=2021.11.9 but has been fixed by a patch to requirementslib. #5019

Vendored Libraries

Vendor in pip==21.2.4 (from 21.2.2) in order to bring in requested bug fix for python3.6. Note: support for 3.6 will be dropped in a subsequent release. #5008

`v2022.3.24`

Compare Source

Features & Improvements

It is now possible to silence the Loading .env environment variables message on pipenv run
with the --quiet flag or the PIPENV_QUIET environment variable. #4027

Bug Fixes

Fixes issue with new index safety restriction, whereby an unnamed extra sources index
caused and error to be thrown during install. #5002
The text Loading .env environment variables... has been switched back to stderr as to not
break requirements.txt generation. Also it only prints now when a .env file is actually present. #5003

`v2022.3.23`

Compare Source

Features & Improvements

Implements a pipenv requirements command which generates a requirements.txt compatible output without locking. #4959
Internal to pipenv, the utils.py was split into a utils module with unused code removed. #4992

Bug Fixes

Pipenv will now ignore .venv in the project when PIPENV_VENV_IN_PROJECT variable is False.
Unset variable maintains the existing behavior of preferring to use the project's .venv should it exist. #2763
Fix an edge case of hash collection in index restricted packages whereby the hashes for some packages would
be missing from the Pipfile.lock following package index restrictions added in pipenv==2022.3.23. #5023

Improved Documentation

Pipenv CLI documentation generation has been fixed. It had broke when click was vendored into the project in
2021.11.9 because by default sphinx-click could no longer determine the CLI inherited from click. #4778
Improve documentation around extra indexes and index restricted packages. #5022

Removals and Deprecations

Removes the optional install argument --extra-index-url as it was not compatible with index restricted packages.
Using the --index argument is the correct way to specify a package should be pulled from the non-default index. #5022

Relates to dev process changes

Added code linting using pre-commit-hooks, black, flake8, isort, pygrep-hooks, news-fragments and check-manifest.
Very similar to pip's configuration; adds a towncrier new's type process for change to Development processes.

psf/requests (requests)

`v2.34.2`

Compare Source

Moved headers input type back to Mapping to avoid invariance issues
with MutableMapping and inferred dict types. Users calling
Request.headers.update() may need to narrow typing in their code. (#7441)

`v2.34.1`

Compare Source

Bugfixes

Widened json input type from dict and list to Mapping
and Sequence. (#7436)
Changed headers input type to MutableMapping and removed None from
Request.headers typing to improve handling for users. (#7431)
Response.reason moved from str | None to str to improve handling
for users. (#7437)
Fixed a bug where some bodies with custom __getattr__ implementations
weren't being properly detected as Iterables. (#7433)

`v2.34.0`

Compare Source

Announcements

Requests 2.34.0 introduces inline types, replacing those provided by
typeshed. Public API types should be fully compatible with mypy, pyright,
and ty. We believe types are comprehensive but if you find issues, please
report them to the pinned tracking issue.

Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for
helping review and test the types ahead of the release. (#7272)

Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify
security considerations. (#7310)
Requests added support for Python 3.15 based on beta1. Downstream projects
should be able to start testing prior to its release in October. (#7422)
Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing
accidental looping when traversing the history list. (#7328)
Requests no longer performs greedy matching on no_proxy domains. The
proxy_bypass implementation has been updated with CPython's fix from
bpo-39057. (#7427)
Requests no longer incorrectly strips duplicate leading slashes in
URI paths. This should address user issues with specific presigned
URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

`v2.33.1`

Compare Source

Bugfixes

Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
files in the tmp directory. (#7305)
Fixed Content-Type header parsing for malformed values. (#7309)
Improved error consistency for malformed header values. (#7308)

`v2.33.0`

Compare Source

Announcements

📣 Requests is adding inline types. If you have a typed code base that
uses Requests, please take a look at #7271. Give it a try, and report
any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

`v2.32.5`

Compare Source

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created
a new class of issues in Requests that have had negative impact across a number
of use cases. The Requests team has decided to revert this feature as long term
maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.
Dropped support for Python 3.8 following its end of support.

`v2.32.4`

Compare Source

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
environment will retrieve credentials for the wrong hostname/machine from a
netrc file.

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS.
Dropped support for pypy 3.9 following its end of support.

`v2.32.3`

Compare Source

Bugfixes

Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of
HTTPAdapter. (#6716)
Fixed issue where Requests started failing to run on Python versions compiled
without the ssl module. (#6724)

`v2.32.2`

Compare Source

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)

`v2.32.1`

Compare Source

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

`v2.32.0`

Compare Source

Security

Fixed an issue where setting verify=False on the first request from a
Session will cause subsequent requests to the same origin to also ignore
cert verification, regardless of the value of verify.
(GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)

Deprecations

Requests has officially added support for CPython 3.12 (#6503)
Requests has officially added support for PyPy 3.9 and 3.10 (#6641)
Requests has officially dropped support for CPython 3.7 (#6642)
Requests has officially dropped support for PyPy 3.7 and 3.8 ([#66

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Zurich)

Branch creation
- "after 5pm on the first day of the month"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-11-08T09:58:02Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance_tests/Pipfile.lock

Command failed: pipenv lock
Creating a virtualenv for this project
Pipfile: 
/tmp/renovate/repos/github/camptocamp/docker-swisstopo-light-basemap/acceptance_
tests/Pipfile
Using default python from 
/opt/containerbase/tools/pipenv/2026.8.0/3.14.7/bin/python 3.14.7 to create 
virtualenv...
created virtual environment CPython3.14.7.final.0-64-x86_64 in 363ms
  creator 
CPython3Posix(dest=/runner/cache/others/virtualenvs/acceptance_tests-1-rjUl5l, 
clear=False, no_vcs_ignore=False, global=False)
  seeder FromAppData(download=False, pip=bundle, via=copy, 
app_data_dir=/tmp/containerbase/cache/.cache/virtualenv)
    added seed packages: pip==26.2.1
  activators 
BashActivator,CShellActivator,FishActivator,NushellActivator,PowerShellActivator
,PythonActivator,XonshActivator

Successfully created virtual environment!
Virtualenv location: /runner/cache/others/virtualenvs/acceptance_tests-1-rjUl5l
Locking  dependencies...
ERROR: Failed to build 'lxml' when getting requirements to build wheel
Traceback (most recent call last):
  File 
"/opt/containerbase/tools/pipenv/2026.8.0/3.14.7/lib/python3.14/site-packages/pi
penv/routines/lock.py", line 408, in do_lock
    venv_resolve_deps(
    ~~~~~~~~~~~~~~~~~^
        packages,
        ^^^^^^^^^
    ...<12 lines>...
        resolver_backend=resolver,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File 
"/opt/containerbase/tools/pipenv/2026.8.0/3.14.7/lib/python3.14/site-packages/pi
penv/utils/resolver.py", line 2061, in venv_resolve_deps
    results = _run_resolver_subprocess(
        request=request,
    ...<2 lines>...
        st=st,
    )
  File 
"/opt/containerbase/tools/pipenv/2026.8.0/3.14.7/lib/python3.14/site-packages/pi
penv/utils/resolver.py", line 1679, in _run_resolver_subprocess
    locked = _dispatch_resolver_response(response, st)
  File 
"/opt/containerbase/tools/pipenv/2026.8.0/3.14.7/lib/python3.14/site-packages/pi
penv/utils/resolver.py", line 1793, in _dispatch_resolver_response
    raise exc
pipenv.exceptions.ResolutionFailure: ERROR: ERROR: Failed to build 'lxml' when 
getting requirements to build wheel

renovate Bot added the dependencies label Nov 8, 2024

renovate Bot force-pushed the renovate/master-all-minor-versions branch 2 times, most recently from 7af390c to 3753e10 Compare November 9, 2024 10:04

renovate Bot force-pushed the renovate/master-all-minor-versions branch from 3753e10 to 5e58b6a Compare February 2, 2025 01:06

renovate Bot force-pushed the renovate/master-all-minor-versions branch from 5e58b6a to 1341ce9 Compare February 26, 2025 05:29

renovate Bot force-pushed the renovate/master-all-minor-versions branch 2 times, most recently from b0f4e8f to 384c411 Compare June 9, 2025 23:57

renovate Bot force-pushed the renovate/master-all-minor-versions branch from 384c411 to be0ac4c Compare August 19, 2025 01:48

renovate Bot force-pushed the renovate/master-all-minor-versions branch 2 times, most recently from 3931c0d to 6c3ba3e Compare October 2, 2025 04:26

renovate Bot force-pushed the renovate/master-all-minor-versions branch 2 times, most recently from c9767ca to 38d9407 Compare December 2, 2025 00:58

renovate Bot force-pushed the renovate/master-all-minor-versions branch 2 times, most recently from 525394d to 1e352d7 Compare March 30, 2026 17:27

renovate Bot force-pushed the renovate/master-all-minor-versions branch from 1e352d7 to 58c008c Compare April 2, 2026 00:50

renovate Bot force-pushed the renovate/master-all-minor-versions branch from 58c008c to 0bd7565 Compare April 15, 2026 12:59

renovate Bot force-pushed the renovate/master-all-minor-versions branch 3 times, most recently from 00ca0f0 to 668132b Compare May 14, 2026 20:52

renovate Bot force-pushed the renovate/master-all-minor-versions branch from 668132b to cc1c1d3 Compare July 10, 2026 09:53

renovate Bot force-pushed the renovate/master-all-minor-versions branch from cc1c1d3 to a713ec5 Compare August 1, 2026 22:02

Update all minor versions

d3794c4

renovate Bot force-pushed the renovate/master-all-minor-versions branch from a713ec5 to d3794c4 Compare September 1, 2026 21:59

Navigation Menu

Uh oh!

Update all minor versions (master) (minor) - #22

Update all minor versions (master) (minor)#22
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-all-minor-versions

renovate Bot commented Nov 8, 2024 •

edited

Loading

Uh oh!

renovate Bot commented Nov 8, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Nov 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features added

Bugs fixed

Other changes

Bugs fixed

Other changes

Bugs fixed

Other changes

Bugs fixed

Bugs fixed

Other changes

Features added

Bugs fixed

Other changes

Bug Fixes

Bug Fixes

Vendored Libraries

Bug Fixes

Bug Fixes

Bug Fixes

Features & Improvements

Vendored Libraries

Bug Fixes

Bug Fixes

Features & Improvements

Bug Fixes

Vendored Libraries

Features & Improvements

Vendored Libraries

Removals and Deprecations

Improved Documentation

Bug Fixes

Features & Improvements

Bug Fixes

Features & Improvements

Bug Fixes

Bug Fixes

Vendored Libraries

Bug Fixes

Bug Fixes

Behavior Changes

Bug Fixes

Vendored Libraries

Features & Improvements

Bug Fixes

Vendored Libraries

Removals and Deprecations

Relates to dev process changes

Bug Fixes

Bug Fixes

Features & Improvements

Bug Fixes

Removals and Deprecations

Bug Fixes

Vendored Libraries

Bug Fixes

Vendored Libraries

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features & Improvements

Bug Fixes

Vendored Libraries

Removals and Deprecations

Bug Fixes

Vendored Libraries

Behavior Changes

Bug Fixes

Vendored Libraries

Relates to dev process changes

What's Changed

Bug Fixes

Bug Fixes

Vendored Libraries

renovate Bot commented Nov 8, 2024 •

edited

Loading