)]}'
{
  "commit": "3b99ebcb25b8a2192d2ba1eac163ad7065884dad",
  "tree": "2d0bbe3f186be646cda39879061f3f983ccaaaee",
  "parents": [
    "4a64b37937a0d656d2c36b5da8a620361cdb72cc"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Sun Aug 23 03:07:48 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Sun Aug 23 03:07:48 2026 +0000"
  },
  "message": "build(deps): bump the pip group across 3 directories with 7 updates (#4096)\n\nBumps the pip group with 3 updates in the /examples/bzlmod directory:\n[idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /examples/wheel directory:\n[pip](https://github.com/pypa/pip).\nBumps the pip group with 6 updates in the\n/gazelle/examples/bzlmod_build_file_generation directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [idna](https://github.com/kjd/idna) | `2.10` | `3.15` |\n| [requests](https://github.com/psf/requests) | `2.25.1` | `2.33.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `1.26.13` | `2.7.0` |\n| [django](https://github.com/django/django) | `4.2.20` | `5.2.16` |\n| [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.5.2` |\n`0.6.0` |\n| [setuptools](https://github.com/pypa/setuptools) | `65.6.3` | `83.0.0`\n|\n\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.25.1...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.18 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.18...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pip` from 24.0 to 26.1.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/pip/blob/main/NEWS.rst\"\u003epip\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e26.1.2 (2026-05-31)\u003c/h1\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject \u003ccode\u003econsole_scripts\u003c/code\u003e and \u003ccode\u003egui_scripts\u003c/code\u003e\nentry points whose name would\ninstall a script outside the scripts directory.\n(\u003ccode\u003e[#14000](https://github.com/pypa/pip/issues/14000)\n\u0026lt;https://github.com/pypa/pip/issues/14000\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFix installation incorrectly failing when the target path contains a\ndoubled\nslash, such as with \u003ccode\u003epip install --root //...\u003c/code\u003e.\n(\u003ccode\u003e[#14001](https://github.com/pypa/pip/issues/14001)\n\u0026lt;https://github.com/pypa/pip/issues/14001\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eSend a consistent \u003ccode\u003eAccept-Encoding\u003c/code\u003e header to avoid a\nspurious \u003ccode\u003eCache entry deserialization failed\u003c/code\u003e warning.\n(\u003ccode\u003e[#14012](https://github.com/pypa/pip/issues/14012)\n\u0026lt;https://github.com/pypa/pip/issues/14012\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e26.1.1 (2026-05-04)\u003c/h1\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where uninstallation left behind empty directories. Revert\nthe\nremoval of the adjacent \u003ccode\u003e__pycache__\u003c/code\u003e directory when a .py\nfile is removed.\n(\u003ccode\u003e[#13973](https://github.com/pypa/pip/issues/13973)\n\u0026lt;https://github.com/pypa/pip/issues/13973\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e26.1 (2026-04-26)\u003c/h1\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.9.\n(\u003ccode\u003e[#13795](https://github.com/pypa/pip/issues/13795)\n\u0026lt;https://github.com/pypa/pip/issues/13795\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd experimental support to read requirements from standardized\npylock.toml files (\u003ccode\u003e-r pylock.toml\u003c/code\u003e).\n(\u003ccode\u003e[#13876](https://github.com/pypa/pip/issues/13876)\n\u0026lt;https://github.com/pypa/pip/issues/13876\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003e--uploaded-prior-to\u003c/code\u003e to accept a duration in days\n(e.g., \u003ccode\u003eP3D\u003c/code\u003e for 3 days ago).\n(\u003ccode\u003e[#13674](https://github.com/pypa/pip/issues/13674)\n\u0026lt;https://github.com/pypa/pip/issues/13674\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up dependency resolution when there are complex conflicts.\n(\u003ccode\u003e[#13859](https://github.com/pypa/pip/issues/13859)\n\u0026lt;https://github.com/pypa/pip/issues/13859\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eReduce memory usage when resolving large dependency trees.\n(\u003ccode\u003e[#13843](https://github.com/pypa/pip/issues/13843)\n\u0026lt;https://github.com/pypa/pip/issues/13843\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eEmit a deprecation warning when pip imports an unexpected module\nafter\ninstallation of a distribution has started.\n(\u003ccode\u003e[#13912](https://github.com/pypa/pip/issues/13912)\n\u0026lt;https://github.com/pypa/pip/issues/13912\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eAllow URL constraints to apply to requirements with extras.\n(\u003ccode\u003e[#12018](https://github.com/pypa/pip/issues/12018)\n\u0026lt;https://github.com/pypa/pip/issues/12018\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eAllow unpinned requirements to use hashes from constraints.\nConstraints\nlike \u003ccode\u003e{name}\u003d\u003d{version} --hash\u003d...\u003c/code\u003e feeds into hash\nverification for\na corresponding requirement.\n(\u003ccode\u003e[#9243](https://github.com/pypa/pip/issues/9243)\n\u0026lt;https://github.com/pypa/pip/issues/9243\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eImprove conflict reports that involve direct URLs.\n(\u003ccode\u003e[#13932](https://github.com/pypa/pip/issues/13932)\n\u0026lt;https://github.com/pypa/pip/issues/13932\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eShow all errors instead of first error for faulty\n\u003ccode\u003edependency_groups\u003c/code\u003e definitions.\n(\u003ccode\u003e[#13917](https://github.com/pypa/pip/issues/13917)\n\u0026lt;https://github.com/pypa/pip/issues/13917\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/31d7d168953668aad85154d6121879d07fbeac27\"\u003e\u003ccode\u003e31d7d16\u003c/code\u003e\u003c/a\u003e\nBump for release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/79f348c86a149adec5a9852788dcc13114b29d3c\"\u003e\u003ccode\u003e79f348c\u003c/code\u003e\u003c/a\u003e\nUpdate AUTHORS.txt\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/237a9258813636b7b1ead05e2cb0d509b44f67ee\"\u003e\u003ccode\u003e237a925\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14001\"\u003e#14001\u003c/a\u003e from\nnotatallshaw/fix-is-within-directory\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/34d0285d548bbd644bfabfede2dfabed23c240db\"\u003e\u003ccode\u003e34d0285\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14006\"\u003e#14006\u003c/a\u003e from\nlaymonage/fix-requirements_from_scripts-space-...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/09d3e07066c56e20b4ab2b3133e29f02f19be5e9\"\u003e\u003ccode\u003e09d3e07\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14012\"\u003e#14012\u003c/a\u003e from\nnotatallshaw/stable-accept-encoding\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/fa7854f6b37113a2c4698cdde902e1fcc9bebdd5\"\u003e\u003ccode\u003efa7854f\u003c/code\u003e\u003c/a\u003e\nUse is_within_directory for entry point check\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/d01b46c273e08bf4299feb81899c9bd0b3e7029b\"\u003e\u003ccode\u003ed01b46c\u003c/code\u003e\u003c/a\u003e\nNEWS ENTRY\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5\"\u003e\u003ccode\u003e7ff8bdd\u003c/code\u003e\u003c/a\u003e\nFix is_within_directory for doubled-slash roots\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/7ea3466fb51ccc729e67ea85809df5a4dda1987b\"\u003e\u003ccode\u003e7ea3466\u003c/code\u003e\u003c/a\u003e\nNEWS ENTRY\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/85673eaa109f343658f9904f4045ff009378ae08\"\u003e\u003ccode\u003e85673ea\u003c/code\u003e\u003c/a\u003e\nFix Accept-Encoding to gzip, deflate\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pypa/pip/compare/24.0...26.1.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.25.1...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.13 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.18...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django` from 4.2.20 to 5.2.16\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/6c8eee41f778da87bdd17e27381d3705ed2d068b\"\u003e\u003ccode\u003e6c8eee4\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Bumped version for 5.2.16 release.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e\"\u003e\u003ccode\u003ed5d60ed\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted\nin Dom...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc\"\u003e\u003ccode\u003e6c66eb8\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when\ncreating...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7\"\u003e\u003ccode\u003e721685a\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set\ncooki...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/61a829d13aa5589cc12b10cc96194125f84f2e69\"\u003e\u003ccode\u003e61a829d\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Added stub release notes and release date 5.2.16.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/21af510eabd0a2e4a95d58bccfec1453453571c5\"\u003e\u003ccode\u003e21af510\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Avoided breaking sha1sum verification in the generated\nchecksum.txt f...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/039df55c3abf070b190937802b8cdae318c52e11\"\u003e\u003ccode\u003e039df55\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Replaced the defunct pgp.mit.edu keyserver with GitHub for key\nimport.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/2b3093ff431de73cd23023110ccd86f310d3d29d\"\u003e\u003ccode\u003e2b3093f\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed \u003ca\nhref\u003d\"https://redirect.github.com/django/django/issues/29187\"\u003e#29187\u003c/a\u003e\n-- Fixed flaky receiver count assertion in signals tests.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/4abc595b1a25fe723f6d5ec30e505a474f6605c9\"\u003e\u003ccode\u003e4abc595\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Refs \u003ca\nhref\u003d\"https://redirect.github.com/django/django/issues/16281\"\u003e#16281\u003c/a\u003e\n-- Fixed isolation of admin_views.ViewOnSiteTests.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/f87add967ec0aa644353cb7e1e1659ca9262f691\"\u003e\u003ccode\u003ef87add9\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Added CVE-2026-6873, CVE-2026-7666, CVE-2026-8404,\nCVE-2026-35193, an...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/django/django/compare/4.2.20...5.2.16\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sqlparse` from 0.5.2 to 0.6.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG\"\u003esqlparse\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 0.6.0 (Aug 13, 2026)\u003c/h2\u003e\n\u003cp\u003eNotable Changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.8 and 3.9. Python 3.10+ is now\nrequired.\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) in the\nlexer,\nwhich consumed CPU quadratically on statements containing many unclosed\ndollar-quoted literals or multiline comments (CVE-2026-59893). See the\nsecurity advisory for details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr\u003c/a\u003e\nThe vulnerability was discovered by EQSTLab, min8282 and 7thpark.\nThanks for reporting!\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) when\ngrouping\ndeeply nested or very wide statements. Building a token group re-read\nthe\nwhole group on every step, so a small statement could keep a worker busy\nfor a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) in\n\u003ccode\u003eformat(sql, reindent\u003dTrue)\u003c/code\u003e, which consumed CPU\nquadratically on long\nlists of tuples. See the security advisory for details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) on\nstatements\nthat consist only of comments (CVE-2026-71491). See the security\nadvisory\nfor details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p\u003c/a\u003e\nThe vulnerability was discovered by \u003ca\nhref\u003d\"https://github.com/sanktjodel\"\u003e\u003ccode\u003e@​sanktjodel\u003c/code\u003e\u003c/a\u003e.\nThanks for reporting!\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Backslashes are now escaped in the \u003ccode\u003epython\u003c/code\u003e\nand \u003ccode\u003ephp\u003c/code\u003e output\nformats. Without escaping, SQL containing a backslash could break out of\nthe generated string literal (CVE-2026-59894). See the security advisory\nfor details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x\u003c/a\u003e\nThe vulnerability was discovered by \u003ca\nhref\u003d\"https://github.com/7thParkk\"\u003e\u003ccode\u003e@​7thParkk\u003c/code\u003e\u003c/a\u003e. Thanks\nfor reporting!\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eEnhancements\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eModernize type annotations in top-level API functions using PEP 585\nand\nPEP 604 syntax.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eEND FOR\u003c/code\u003e and \u003ccode\u003eEND CASE\u003c/code\u003e are now recognized as\nkeywords.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eBug Fixes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eStatement splitting was rewritten on a stack-based architecture.\nThis fixes\nsplitting of statements with nested BEGIN ... END blocks\n(issue845).\u003c/li\u003e\n\u003cli\u003eFix function grouping being skipped in \u003ccode\u003eCREATE TABLE ... AS\nSELECT\u003c/code\u003e\nstatements when the \u003ccode\u003eas\u003c/code\u003e keyword is lowercase (pr867 by\nOsamaali313).\u003c/li\u003e\n\u003cli\u003eRecognize \u003ccode\u003eROW_FORMAT\u003c/code\u003e as a keyword so that \u003ccode\u003eALTER\nTABLE ... ROW_FORMAT\u003d...\u003c/code\u003e\nno longer merges the table name and the option into a single identifier\n(issue773, pr860 by apoorvdarshan).\u003c/li\u003e\n\u003cli\u003eRecognize \u003ccode\u003eMATERIALIZED\u003c/code\u003e as a keyword so it is parsed and\nformatted\nconsistently in \u003ccode\u003eCREATE MATERIALIZED VIEW\u003c/code\u003e statements\n(issue752, pr854 by\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/2f40da99b50d81135aecf96f6b08fcfa338a96de\"\u003e\u003ccode\u003e2f40da9\u003c/code\u003e\u003c/a\u003e\nUpdate version number.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/5753f1570d3aa7366652cdd91577eb9e74533cfb\"\u003e\u003ccode\u003e5753f15\u003c/code\u003e\u003c/a\u003e\nAlign the changelog entries for this release with previous ones\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/b9588d973a7403cd8075873511e610dac4a58b2e\"\u003e\u003ccode\u003eb9588d9\u003c/code\u003e\u003c/a\u003e\nUnify the benchmark scripts on a shared harness\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/519e41698a172add8aa7b54ab4e94daad0af213e\"\u003e\u003ccode\u003e519e416\u003c/code\u003e\u003c/a\u003e\nPair comment/dollar-quote delimiters at the lexer position\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b\"\u003e\u003ccode\u003ea51df6d\u003c/code\u003e\u003c/a\u003e\nMeasure reindent offsets backwards to avoid quadratic CPU use\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/73d9ccddf21d73a68e3f99517a3918fd21eb81fa\"\u003e\u003ccode\u003e73d9ccd\u003c/code\u003e\u003c/a\u003e\nUpdate CHANGELOG\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e\"\u003e\u003ccode\u003ed1d8060\u003c/code\u003e\u003c/a\u003e\nFix uncontrolled CPU consumption (ReDoS) in the lexer\u0027s handling of\ndollar-qu...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87\"\u003e\u003ccode\u003eef2012a\u003c/code\u003e\u003c/a\u003e\nFix quadratic DoS in group_comments (GHSA-f2ff-p2ww-7p4p)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/26112ddb139361cc76218b3e3b50067652678fec\"\u003e\u003ccode\u003e26112dd\u003c/code\u003e\u003c/a\u003e\nUpdate Changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63\"\u003e\u003ccode\u003e53ff44b\u003c/code\u003e\u003c/a\u003e\nEscape backslashes in output formatters.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/compare/0.5.2...0.6.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `setuptools` from 65.6.3 to 83.0.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/setuptools/blob/main/NEWS.rst\"\u003esetuptools\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev83.0.0\u003c/h1\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRequire Python 3.10 or later...\n\n_Description has been truncated_\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "69ef9be3c58d1bd829e4ad439db93f58d263909a",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/MODULE.bazel",
      "new_id": "a93acfaa83491348dbdfea098cfe5967a0ca71c6",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/MODULE.bazel"
    },
    {
      "type": "modify",
      "old_id": "3a52410d2229bb970c69574ebe70d2c2f814d8d3",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/patches/requests_metadata.patch",
      "new_id": "d6bed2807ee80f01e8f87c06c3977aac624e34d2",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/patches/requests_metadata.patch"
    },
    {
      "type": "modify",
      "old_id": "01675103b8bf90ed74082d81d692957361b997e9",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/patches/requests_record.patch",
      "new_id": "678765bf3d519842281bb324495134d736f20f32",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/patches/requests_record.patch"
    },
    {
      "type": "modify",
      "old_id": "cb33ca57b4f1d8cf51a93e3b3d7ee714dde24f69",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements.in",
      "new_id": "f52904daa61d3f7ff4680f9f68d131ea67db05d7",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements.in"
    },
    {
      "type": "modify",
      "old_id": "191c1812afbd02ee19f82084ea9369eea721f883",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_lock_3_10.txt",
      "new_id": "5e80d72eaf2e194645656a9fba3add2ded05580e",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_lock_3_10.txt"
    },
    {
      "type": "modify",
      "old_id": "143755c0591201764908fa65222a5f39ca352e0c",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_lock_3_12.txt",
      "new_id": "09da1aef08eae2a4b8db7ba9cf670b50796b8c8b",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_lock_3_12.txt"
    },
    {
      "type": "modify",
      "old_id": "669110fff6ad5de9e45a52710ea2c2d0dd7ee34f",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_lock_3_13.txt",
      "new_id": "d104aeec67f9c776ba1ed9826c7be5829fc60168",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_lock_3_13.txt"
    },
    {
      "type": "modify",
      "old_id": "332ad14f30c7a13aa5754460e5679d18b5453e4f",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_lock_3_14.txt",
      "new_id": "a40d8de9f45ef4d075220a6aae9009bfb1b7a96c",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_lock_3_14.txt"
    },
    {
      "type": "modify",
      "old_id": "08d2d8eba8bbd65419f4e22bcb217655528948d8",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_windows_3_10.txt",
      "new_id": "bbb26d06f478692bb7b483828dd020f0c6203ff3",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_windows_3_10.txt"
    },
    {
      "type": "modify",
      "old_id": "f9e0ee1fcd624f11adf49f8514a34fab569a1606",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_windows_3_12.txt",
      "new_id": "b9bece64cde15d7ab5e74d76e21db8f2a133d161",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_windows_3_12.txt"
    },
    {
      "type": "modify",
      "old_id": "30addb1da67b9f12f6327ea4bff373fd2533a5b6",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_windows_3_13.txt",
      "new_id": "2062bf337d76d20838a4e8019f9b22e18d771acf",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_windows_3_13.txt"
    },
    {
      "type": "modify",
      "old_id": "cb2a9c70563ddc61b282d9d6b45eb983d51a21c6",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/requirements_windows_3_14.txt",
      "new_id": "9f6ca0f2056477a2cf0a07772c60b1f0a0b132db",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/requirements_windows_3_14.txt"
    },
    {
      "type": "modify",
      "old_id": "c7070d4b22f9199c24ac9b5d545b554aa4e67b3e",
      "old_mode": 33188,
      "old_path": "examples/bzlmod/whl_mods/pip_whl_mods_test.py",
      "new_id": "c8840a47afa7d44632fd822819a789203404991b",
      "new_mode": 33188,
      "new_path": "examples/bzlmod/whl_mods/pip_whl_mods_test.py"
    },
    {
      "type": "modify",
      "old_id": "7324131a7c281c60b739e27f8d0421d92d6f3350",
      "old_mode": 33188,
      "old_path": "examples/wheel/requirements_server.txt",
      "new_id": "7df82354257202e1b21a5bb8e066accc6058cf46",
      "new_mode": 33188,
      "new_path": "examples/wheel/requirements_server.txt"
    },
    {
      "type": "modify",
      "old_id": "b729aa431e8761f8618dd7daf9c8ec218b295adf",
      "old_mode": 33188,
      "old_path": "gazelle/examples/bzlmod_build_file_generation/gazelle_python.yaml",
      "new_id": "f2d8aa8b902be3a9e924f08f39e772c2e8ce30b9",
      "new_mode": 33188,
      "new_path": "gazelle/examples/bzlmod_build_file_generation/gazelle_python.yaml"
    },
    {
      "type": "modify",
      "old_id": "9107730184c1bfc96b3a0338205353e71b107a60",
      "old_mode": 33188,
      "old_path": "gazelle/examples/bzlmod_build_file_generation/gazelle_python_with_types.yaml",
      "new_id": "f5c94a08bddcf40ecca8ef1cb298e5d54a2613db",
      "new_mode": 33188,
      "new_path": "gazelle/examples/bzlmod_build_file_generation/gazelle_python_with_types.yaml"
    },
    {
      "type": "modify",
      "old_id": "fb3b45176cb43320e15a255fe38a18a10b4b94fe",
      "old_mode": 33188,
      "old_path": "gazelle/examples/bzlmod_build_file_generation/requirements.in",
      "new_id": "a3387cc7b96c4cc8edf299c328c07df23816e1bc",
      "new_mode": 33188,
      "new_path": "gazelle/examples/bzlmod_build_file_generation/requirements.in"
    },
    {
      "type": "modify",
      "old_id": "0bb91848babb2a4b58346e6c45e60b9c27f91702",
      "old_mode": 33188,
      "old_path": "gazelle/examples/bzlmod_build_file_generation/requirements_lock.txt",
      "new_id": "08dec60a335da92e6ecb7a9f54a8dec60768dd78",
      "new_mode": 33188,
      "new_path": "gazelle/examples/bzlmod_build_file_generation/requirements_lock.txt"
    },
    {
      "type": "modify",
      "old_id": "d4c36b8bca6f8c04626f79c2b9502a4481980ede",
      "old_mode": 33188,
      "old_path": "gazelle/examples/bzlmod_build_file_generation/requirements_windows.txt",
      "new_id": "6c9fe11b28b6628173bb63a52236ea917155dc01",
      "new_mode": 33188,
      "new_path": "gazelle/examples/bzlmod_build_file_generation/requirements_windows.txt"
    },
    {
      "type": "modify",
      "old_id": "e24834fe1eb1aab17cbbad5c143048016c0f2c78",
      "old_mode": 33188,
      "old_path": "sphinxdocs/dev/requirements.txt",
      "new_id": "8a0597bfba2c1ff6530308a205f4b35052552160",
      "new_mode": 33188,
      "new_path": "sphinxdocs/dev/requirements.txt"
    }
  ]
}