)]}'
{
  "commit": "657c49a0cdf4c052e7790f4b7f463de6d455df1d",
  "tree": "0f965b966be6ad19ab8326c2acea60151299a578",
  "parents": [
    "acc5f94db1c41c4974220878f5eed26c179fc5bf"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Mon Oct 05 03:04:46 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Oct 05 03:04:46 2026 +0000"
  },
  "message": "build(deps): bump the pip group across 10 directories with 2 updates (#4204)\n\nBumps the pip group with 1 update in the /dev directory:\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /examples/build_file_generation\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /examples/bzlmod directory:\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /examples/pip_parse directory:\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /examples/pip_parse_vendored\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 2 updates in the\n/gazelle/examples/bzlmod_build_file_generation directory:\n[urllib3](https://github.com/urllib3/urllib3) and\n[django](https://github.com/django/django).\nBumps the pip group with 1 update in the /sphinxdocs/dev directory:\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /tests/multiple_inputs\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /tests/uv/lock/pyproject_toml\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /tests/uv/lock/workspaces\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\n\nUpdates `urllib3` from 2.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.8.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project. If your company or\norganization uses Python and would benefit from HTTP/2 support in\nRequests, pip, cloud SDKs, and thousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden. (High severity, GHSA-8988-9cw3-xx77)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size line of unbounded length in memory. (High\nseverity, GHSA-vxq7-64xx-v4gw)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity, GHSA-gh4c-6fx4-qh6g)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nurllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\u003c/p\u003e\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e. Destination client certificates\nand identity overrides no longer apply to HTTPS forwarding proxy\nconnections.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nCVE IDs had not yet been assigned to these advisories at the time of\nrelease due to a backlog at GitHub\u0027s CNA.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption \u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5044\"\u003e#5044\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience properties to the\nresult of \u003ccode\u003eparse_url()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4945\"\u003e#4945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5092\"\u003e#5092\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFixed response header handling to replace obsolete folded header\nlines (\u003ccode\u003eobs-fold\u003c/code\u003e) with spaces in accordance with RFC 9112,\npreventing raw CRLF sequences from appearing in header values such as\n\u003ccode\u003eSet-Cookie\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/1362\"\u003e#1362\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed usage of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e with\n\u003ccode\u003eProxyManager\u003c/code\u003e when\n\u003ccode\u003euse_forwarding_for_https\u003dTrue\u003c/code\u003e. Passing\n\u003ccode\u003essl_context\u003c/code\u003e instead of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e for\nHTTPS proxies in this configuration now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e and will raise an error in v3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/2577\"\u003e#2577\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eChanged behavior of the default \u003ccode\u003eConnectionPool.pool\u003c/code\u003e\ninitialization. \u003ccode\u003eLifoQueue\u003c/code\u003e is now resolved from the\n\u003ccode\u003equeue\u003c/code\u003e module after the \u003ccode\u003eConnectionPool\u003c/code\u003e is\ninstantiated instead of using the default cached \u003ccode\u003eQueueCls\u003c/code\u003e\nclass property. This is done because sometimes the\n\u003ccode\u003equeue.LifoQueue\u003c/code\u003e is monkey-patched late in the program, such\nas by gevent. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRaised \u003ccode\u003eUnrewindableBodyError\u003c/code\u003e instead of\n\u003ccode\u003eValueError\u003c/code\u003e when retrying a request whose body had\n\u003ccode\u003etell()\u003c/code\u003e but not \u003ccode\u003eseek()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3779\"\u003e#3779\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDecoded percent-encoded SOCKS proxy credentials before authenticating\nwith the proxy server. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3785\"\u003e#3785\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e to discard unread\nresponse data in 64 KiB chunks (same as the default \u003ccode\u003eamt\u003c/code\u003e\nwhen doing \u003ccode\u003eHTTPResponse.stream(...)\u003c/code\u003e). (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5019\"\u003e#5019\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eis_ipaddress()\u003c/code\u003e to detect non-standard IPv4 forms\naccepted by \u003ccode\u003esocket.connect\u003c/code\u003e, such as hex\n(\u003ccode\u003e0x7f000001\u003c/code\u003e), octal (\u003ccode\u003e0177.0.0.1\u003c/code\u003e), and decimal\nintegers (\u003ccode\u003e2130706433\u003c/code\u003e), ensuring SSL certificate\nverification uses the correct mode for these addresses. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5029\"\u003e#5029\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen\u003c/code\u003e raising a misleading\n\u003ccode\u003eFullPoolError\u003c/code\u003e instead of \u003ccode\u003eValueError\u003c/code\u003e when\ncalled with an invalid \u003ccode\u003etimeout\u003c/code\u003e argument on a pool created\nwith \u003ccode\u003eblock\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5059\"\u003e#5059\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed port-zero handling to preserve explicit \u003ccode\u003e:0\u003c/code\u003e values\ninstead of substituting the default ports 80 or 443 in URL parsing, pool\nselection, proxy configuration, \u003ccode\u003econnection_from_url()\u003c/code\u003e, and\nHTTP/2 request authority. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5071\"\u003e#5071\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5101\"\u003e#5101\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed a bug where \u003ccode\u003ePoolManager\u003c/code\u003e passed the\n\u003ccode\u003eassert_hostname\u003c/code\u003e and \u003ccode\u003eassert_fingerprint\u003c/code\u003e\nparameters to HTTP connection pools. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5077\"\u003e#5077\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e and HTTP proxy\nforwarding to strip URL fragments from absolute request targets before\nsending requests. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5079\"\u003e#5079\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded safeguards to the proxy tunneling code to prevent potential\nsecurity issues when handling invalid characters in the proxy host and\nHTTP headers. This change affects users of Python 3.10, Python 3.11, and\nPython 3.12 when the standard library does not contain the fix; those on\nnewer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the\nsame security fixes. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5091\"\u003e#5091\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPSConnection.connect()\u003c/code\u003e overriding\n\u003ccode\u003eProxyConfig.ssl_context\u003c/code\u003e\u0027s certificate policy and proxy\nidentity checks with the target connection\u0027s TLS settings when\nforwarding through an HTTPS proxy.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eHTTPSConnection\u003c/code\u003e no longer applies target SNI,\nassertions, or client credentials to forwarding proxy handshakes and\ncontinues to use its \u003ccode\u003essl_context\u003c/code\u003e as a fallback when an\nHTTPS proxy forwards an HTTP target. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5093\"\u003e#5093\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed URL parsing to more strictly enforce RFC 3986 host syntax,\nrejecting invalid host input such as raw spaces and control characters,\nmalformed percent-encodings, and percent-encoded control characters in\nHTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel\ntargets. Host normalization now also follows RFC 3986 normalization\nrules for percent-encoded octets by decoding percent-encoded unreserved\ncharacters and uppercasing the hexadecimal digits of retained\npercent-encoded octets. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5095\"\u003e#5095\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.8.0 (2026-09-15)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden.\n(High severity, \u003ccode\u003eGHSA-8988-9cw3-xx77\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size\nline of unbounded length in memory. (High severity,\n\u003ccode\u003eGHSA-vxq7-64xx-v4gw\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity,\n\u003ccode\u003eGHSA-gh4c-6fx4-qh6g\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. caution::\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003eurllib3 2.8.0 fixes HTTPS proxy TLS configuration being\nignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e.\nDestination client certificates and identity overrides no longer\napply to HTTPS forwarding proxy connections.\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption\n\u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb.\n(\u003ccode\u003e[#5044](https://github.com/urllib3/urllib3/issues/5044)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5044\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience\nproperties to the result of \u003ccode\u003eparse_url()\u003c/code\u003e.\n(\u003ccode\u003e[#4945](https://github.com/urllib3/urllib3/issues/4945)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4945\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e.\n(\u003ccode\u003e[#5092](https://github.com/urllib3/urllib3/issues/5092)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5092\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a\"\u003e\u003ccode\u003eb1d30ab\u003c/code\u003e\u003c/a\u003e\nRelease 2.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e\"\u003e\u003ccode\u003e9016d7e\u003c/code\u003e\u003c/a\u003e\nSkip \u003ccode\u003etest_read_chunked_with_trailing_data_does_not_hang\u003c/code\u003e for\nbrotlicffi (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5258\"\u003e#5258\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533\"\u003e\u003ccode\u003e9101f58\u003c/code\u003e\u003c/a\u003e\nFix \u003ccode\u003enox -s docs\u003c/code\u003e warning (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5256\"\u003e#5256\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed\"\u003e\u003ccode\u003ecd770b0\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f\"\u003e\u003ccode\u003eea2ad7b\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8\"\u003e\u003ccode\u003e0716e31\u003c/code\u003e\u003c/a\u003e\nFix loading unencrypted client keys with a password in pyOpenSSL (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5255\"\u003e#5255\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d\"\u003e\u003ccode\u003e43c68c8\u003c/code\u003e\u003c/a\u003e\nTest pickling of \u003ccode\u003eInvalidChunkLength\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5247\"\u003e#5247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817\"\u003e\u003ccode\u003e308b279\u003c/code\u003e\u003c/a\u003e\nShare security policy between GitHub and Read the Docs (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5253\"\u003e#5253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706\"\u003e\u003ccode\u003e53fa073\u003c/code\u003e\u003c/a\u003e\nAdd policy on duplicate pull requests (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5252\"\u003e#5252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267\"\u003e\u003ccode\u003e5f2a6a8\u003c/code\u003e\u003c/a\u003e\nAssert on the ALPN extension in test_tunnel_sets_http_11_alpn (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5232\"\u003e#5232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.8.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project. If your company or\norganization uses Python and would benefit from HTTP/2 support in\nRequests, pip, cloud SDKs, and thousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden. (High severity, GHSA-8988-9cw3-xx77)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size line of unbounded length in memory. (High\nseverity, GHSA-vxq7-64xx-v4gw)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity, GHSA-gh4c-6fx4-qh6g)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nurllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\u003c/p\u003e\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e. Destination client certificates\nand identity overrides no longer apply to HTTPS forwarding proxy\nconnections.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nCVE IDs had not yet been assigned to these advisories at the time of\nrelease due to a backlog at GitHub\u0027s CNA.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption \u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5044\"\u003e#5044\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience properties to the\nresult of \u003ccode\u003eparse_url()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4945\"\u003e#4945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5092\"\u003e#5092\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFixed response header handling to replace obsolete folded header\nlines (\u003ccode\u003eobs-fold\u003c/code\u003e) with spaces in accordance with RFC 9112,\npreventing raw CRLF sequences from appearing in header values such as\n\u003ccode\u003eSet-Cookie\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/1362\"\u003e#1362\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed usage of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e with\n\u003ccode\u003eProxyManager\u003c/code\u003e when\n\u003ccode\u003euse_forwarding_for_https\u003dTrue\u003c/code\u003e. Passing\n\u003ccode\u003essl_context\u003c/code\u003e instead of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e for\nHTTPS proxies in this configuration now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e and will raise an error in v3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/2577\"\u003e#2577\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eChanged behavior of the default \u003ccode\u003eConnectionPool.pool\u003c/code\u003e\ninitialization. \u003ccode\u003eLifoQueue\u003c/code\u003e is now resolved from the\n\u003ccode\u003equeue\u003c/code\u003e module after the \u003ccode\u003eConnectionPool\u003c/code\u003e is\ninstantiated instead of using the default cached \u003ccode\u003eQueueCls\u003c/code\u003e\nclass property. This is done because sometimes the\n\u003ccode\u003equeue.LifoQueue\u003c/code\u003e is monkey-patched late in the program, such\nas by gevent. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRaised \u003ccode\u003eUnrewindableBodyError\u003c/code\u003e instead of\n\u003ccode\u003eValueError\u003c/code\u003e when retrying a request whose body had\n\u003ccode\u003etell()\u003c/code\u003e but not \u003ccode\u003eseek()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3779\"\u003e#3779\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDecoded percent-encoded SOCKS proxy credentials before authenticating\nwith the proxy server. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3785\"\u003e#3785\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e to discard unread\nresponse data in 64 KiB chunks (same as the default \u003ccode\u003eamt\u003c/code\u003e\nwhen doing \u003ccode\u003eHTTPResponse.stream(...)\u003c/code\u003e). (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5019\"\u003e#5019\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eis_ipaddress()\u003c/code\u003e to detect non-standard IPv4 forms\naccepted by \u003ccode\u003esocket.connect\u003c/code\u003e, such as hex\n(\u003ccode\u003e0x7f000001\u003c/code\u003e), octal (\u003ccode\u003e0177.0.0.1\u003c/code\u003e), and decimal\nintegers (\u003ccode\u003e2130706433\u003c/code\u003e), ensuring SSL certificate\nverification uses the correct mode for these addresses. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5029\"\u003e#5029\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen\u003c/code\u003e raising a misleading\n\u003ccode\u003eFullPoolError\u003c/code\u003e instead of \u003ccode\u003eValueError\u003c/code\u003e when\ncalled with an invalid \u003ccode\u003etimeout\u003c/code\u003e argument on a pool created\nwith \u003ccode\u003eblock\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5059\"\u003e#5059\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed port-zero handling to preserve explicit \u003ccode\u003e:0\u003c/code\u003e values\ninstead of substituting the default ports 80 or 443 in URL parsing, pool\nselection, proxy configuration, \u003ccode\u003econnection_from_url()\u003c/code\u003e, and\nHTTP/2 request authority. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5071\"\u003e#5071\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5101\"\u003e#5101\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed a bug where \u003ccode\u003ePoolManager\u003c/code\u003e passed the\n\u003ccode\u003eassert_hostname\u003c/code\u003e and \u003ccode\u003eassert_fingerprint\u003c/code\u003e\nparameters to HTTP connection pools. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5077\"\u003e#5077\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e and HTTP proxy\nforwarding to strip URL fragments from absolute request targets before\nsending requests. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5079\"\u003e#5079\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded safeguards to the proxy tunneling code to prevent potential\nsecurity issues when handling invalid characters in the proxy host and\nHTTP headers. This change affects users of Python 3.10, Python 3.11, and\nPython 3.12 when the standard library does not contain the fix; those on\nnewer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the\nsame security fixes. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5091\"\u003e#5091\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPSConnection.connect()\u003c/code\u003e overriding\n\u003ccode\u003eProxyConfig.ssl_context\u003c/code\u003e\u0027s certificate policy and proxy\nidentity checks with the target connection\u0027s TLS settings when\nforwarding through an HTTPS proxy.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eHTTPSConnection\u003c/code\u003e no longer applies target SNI,\nassertions, or client credentials to forwarding proxy handshakes and\ncontinues to use its \u003ccode\u003essl_context\u003c/code\u003e as a fallback when an\nHTTPS proxy forwards an HTTP target. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5093\"\u003e#5093\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed URL parsing to more strictly enforce RFC 3986 host syntax,\nrejecting invalid host input such as raw spaces and control characters,\nmalformed percent-encodings, and percent-encoded control characters in\nHTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel\ntargets. Host normalization now also follows RFC 3986 normalization\nrules for percent-encoded octets by decoding percent-encoded unreserved\ncharacters and uppercasing the hexadecimal digits of retained\npercent-encoded octets. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5095\"\u003e#5095\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.8.0 (2026-09-15)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden.\n(High severity, \u003ccode\u003eGHSA-8988-9cw3-xx77\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size\nline of unbounded length in memory. (High severity,\n\u003ccode\u003eGHSA-vxq7-64xx-v4gw\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity,\n\u003ccode\u003eGHSA-gh4c-6fx4-qh6g\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. caution::\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003eurllib3 2.8.0 fixes HTTPS proxy TLS configuration being\nignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e.\nDestination client certificates and identity overrides no longer\napply to HTTPS forwarding proxy connections.\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption\n\u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb.\n(\u003ccode\u003e[#5044](https://github.com/urllib3/urllib3/issues/5044)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5044\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience\nproperties to the result of \u003ccode\u003eparse_url()\u003c/code\u003e.\n(\u003ccode\u003e[#4945](https://github.com/urllib3/urllib3/issues/4945)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4945\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e.\n(\u003ccode\u003e[#5092](https://github.com/urllib3/urllib3/issues/5092)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5092\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a\"\u003e\u003ccode\u003eb1d30ab\u003c/code\u003e\u003c/a\u003e\nRelease 2.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e\"\u003e\u003ccode\u003e9016d7e\u003c/code\u003e\u003c/a\u003e\nSkip \u003ccode\u003etest_read_chunked_with_trailing_data_does_not_hang\u003c/code\u003e for\nbrotlicffi (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5258\"\u003e#5258\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533\"\u003e\u003ccode\u003e9101f58\u003c/code\u003e\u003c/a\u003e\nFix \u003ccode\u003enox -s docs\u003c/code\u003e warning (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5256\"\u003e#5256\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed\"\u003e\u003ccode\u003ecd770b0\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f\"\u003e\u003ccode\u003eea2ad7b\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8\"\u003e\u003ccode\u003e0716e31\u003c/code\u003e\u003c/a\u003e\nFix loading unencrypted client keys with a password in pyOpenSSL (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5255\"\u003e#5255\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d\"\u003e\u003ccode\u003e43c68c8\u003c/code\u003e\u003c/a\u003e\nTest pickling of \u003ccode\u003eInvalidChunkLength\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5247\"\u003e#5247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817\"\u003e\u003ccode\u003e308b279\u003c/code\u003e\u003c/a\u003e\nShare security policy between GitHub and Read the Docs (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5253\"\u003e#5253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706\"\u003e\u003ccode\u003e53fa073\u003c/code\u003e\u003c/a\u003e\nAdd policy on duplicate pull requests (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5252\"\u003e#5252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267\"\u003e\u003ccode\u003e5f2a6a8\u003c/code\u003e\u003c/a\u003e\nAssert on the ALPN extension in test_tunnel_sets_http_11_alpn (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5232\"\u003e#5232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.8.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project. If your company or\norganization uses Python and would benefit from HTTP/2 support in\nRequests, pip, cloud SDKs, and thousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden. (High severity, GHSA-8988-9cw3-xx77)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size line of unbounded length in memory. (High\nseverity, GHSA-vxq7-64xx-v4gw)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity, GHSA-gh4c-6fx4-qh6g)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nurllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\u003c/p\u003e\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e. Destination client certificates\nand identity overrides no longer apply to HTTPS forwarding proxy\nconnections.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nCVE IDs had not yet been assigned to these advisories at the time of\nrelease due to a backlog at GitHub\u0027s CNA.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption \u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5044\"\u003e#5044\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience properties to the\nresult of \u003ccode\u003eparse_url()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4945\"\u003e#4945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5092\"\u003e#5092\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFixed response header handling to replace obsolete folded header\nlines (\u003ccode\u003eobs-fold\u003c/code\u003e) with spaces in accordance with RFC 9112,\npreventing raw CRLF sequences from appearing in header values such as\n\u003ccode\u003eSet-Cookie\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/1362\"\u003e#1362\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed usage of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e with\n\u003ccode\u003eProxyManager\u003c/code\u003e when\n\u003ccode\u003euse_forwarding_for_https\u003dTrue\u003c/code\u003e. Passing\n\u003ccode\u003essl_context\u003c/code\u003e instead of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e for\nHTTPS proxies in this configuration now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e and will raise an error in v3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/2577\"\u003e#2577\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eChanged behavior of the default \u003ccode\u003eConnectionPool.pool\u003c/code\u003e\ninitialization. \u003ccode\u003eLifoQueue\u003c/code\u003e is now resolved from the\n\u003ccode\u003equeue\u003c/code\u003e module after the \u003ccode\u003eConnectionPool\u003c/code\u003e is\ninstantiated instead of using the default cached \u003ccode\u003eQueueCls\u003c/code\u003e\nclass property. This is done because sometimes the\n\u003ccode\u003equeue.LifoQueue\u003c/code\u003e is monkey-patched late in the program, such\nas by gevent. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRaised \u003ccode\u003eUnrewindableBodyError\u003c/code\u003e instead of\n\u003ccode\u003eValueError\u003c/code\u003e when retrying a request whose body had\n\u003ccode\u003etell()\u003c/code\u003e but not \u003ccode\u003eseek()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3779\"\u003e#3779\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDecoded percent-encoded SOCKS proxy credentials before authenticating\nwith the proxy server. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3785\"\u003e#3785\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e to discard unread\nresponse data in 64 KiB chunks (same as the default \u003ccode\u003eamt\u003c/code\u003e\nwhen doing \u003ccode\u003eHTTPResponse.stream(...)\u003c/code\u003e). (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5019\"\u003e#5019\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eis_ipaddress()\u003c/code\u003e to detect non-standard IPv4 forms\naccepted by \u003ccode\u003esocket.connect\u003c/code\u003e, such as hex\n(\u003ccode\u003e0x7f000001\u003c/code\u003e), octal (\u003ccode\u003e0177.0.0.1\u003c/code\u003e), and decimal\nintegers (\u003ccode\u003e2130706433\u003c/code\u003e), ensuring SSL certificate\nverification uses the correct mode for these addresses. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5029\"\u003e#5029\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen\u003c/code\u003e raising a misleading\n\u003ccode\u003eFullPoolError\u003c/code\u003e instead of \u003ccode\u003eValueError\u003c/code\u003e when\ncalled with an invalid \u003ccode\u003etimeout\u003c/code\u003e argument on a pool created\nwith \u003ccode\u003eblock\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5059\"\u003e#5059\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed port-zero handling to preserve explicit \u003ccode\u003e:0\u003c/code\u003e values\ninstead of substituting the default ports 80 or 443 in URL parsing, pool\nselection, proxy configuration, \u003ccode\u003econnection_from_url()\u003c/code\u003e, and\nHTTP/2 request authority. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5071\"\u003e#5071\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5101\"\u003e#5101\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed a bug where \u003ccode\u003ePoolManager\u003c/code\u003e passed the\n\u003ccode\u003eassert_hostname\u003c/code\u003e and \u003ccode\u003eassert_fingerprint\u003c/code\u003e\nparameters to HTTP connection pools. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5077\"\u003e#5077\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e and HTTP proxy\nforwarding to strip URL fragments from absolute request targets before\nsending requests. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5079\"\u003e#5079\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded safeguards to the proxy tunneling code to prevent potential\nsecurity issues when handling invalid characters in the proxy host and\nHTTP headers. This change affects users of Python 3.10, Python 3.11, and\nPython 3.12 when the standard library does not contain the fix; those on\nnewer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the\nsame security fixes. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5091\"\u003e#5091\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPSConnection.connect()\u003c/code\u003e overriding\n\u003ccode\u003eProxyConfig.ssl_context\u003c/code\u003e\u0027s certificate policy and proxy\nidentity checks with the target connection\u0027s TLS settings when\nforwarding through an HTTPS proxy.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eHTTPSConnection\u003c/code\u003e no longer applies target SNI,\nassertions, or client credentials to forwarding proxy handshakes and\ncontinues to use its \u003ccode\u003essl_context\u003c/code\u003e as a fallback when an\nHTTPS proxy forwards an HTTP target. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5093\"\u003e#5093\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed URL parsing to more strictly enforce RFC 3986 host syntax,\nrejecting invalid host input such as raw spaces and control characters,\nmalformed percent-encodings, and percent-encoded control characters in\nHTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel\ntargets. Host normalization now also follows RFC 3986 normalization\nrules for percent-encoded octets by decoding percent-encoded unreserved\ncharacters and uppercasing the hexadecimal digits of retained\npercent-encoded octets. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5095\"\u003e#5095\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.8.0 (2026-09-15)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden.\n(High severity, \u003ccode\u003eGHSA-8988-9cw3-xx77\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size\nline of unbounded length in memory. (High severity,\n\u003ccode\u003eGHSA-vxq7-64xx-v4gw\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity,\n\u003ccode\u003eGHSA-gh4c-6fx4-qh6g\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. caution::\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003eurllib3 2.8.0 fixes HTTPS proxy TLS configuration being\nignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e.\nDestination client certificates and identity overrides no longer\napply to HTTPS forwarding proxy connections.\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption\n\u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb.\n(\u003ccode\u003e[#5044](https://github.com/urllib3/urllib3/issues/5044)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5044\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience\nproperties to the result of \u003ccode\u003eparse_url()\u003c/code\u003e.\n(\u003ccode\u003e[#4945](https://github.com/urllib3/urllib3/issues/4945)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4945\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e.\n(\u003ccode\u003e[#5092](https://github.com/urllib3/urllib3/issues/5092)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5092\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a\"\u003e\u003ccode\u003eb1d30ab\u003c/code\u003e\u003c/a\u003e\nRelease 2.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e\"\u003e\u003ccode\u003e9016d7e\u003c/code\u003e\u003c/a\u003e\nSkip \u003ccode\u003etest_read_chunked_with_trailing_data_does_not_hang\u003c/code\u003e for\nbrotlicffi (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5258\"\u003e#5258\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533\"\u003e\u003ccode\u003e9101f58\u003c/code\u003e\u003c/a\u003e\nFix \u003ccode\u003enox -s docs\u003c/code\u003e warning (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5256\"\u003e#5256\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed\"\u003e\u003ccode\u003ecd770b0\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f\"\u003e\u003ccode\u003eea2ad7b\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8\"\u003e\u003ccode\u003e0716e31\u003c/code\u003e\u003c/a\u003e\nFix loading unencrypted client keys with a password in pyOpenSSL (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5255\"\u003e#5255\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d\"\u003e\u003ccode\u003e43c68c8\u003c/code\u003e\u003c/a\u003e\nTest pickling of \u003ccode\u003eInvalidChunkLength\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5247\"\u003e#5247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817\"\u003e\u003ccode\u003e308b279\u003c/code\u003e\u003c/a\u003e\nShare security policy between GitHub and Read the Docs (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5253\"\u003e#5253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706\"\u003e\u003ccode\u003e53fa073\u003c/code\u003e\u003c/a\u003e\nAdd policy on duplicate pull requests (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5252\"\u003e#5252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267\"\u003e\u003ccode\u003e5f2a6a8\u003c/code\u003e\u003c/a\u003e\nAssert on the ALPN extension in test_tunnel_sets_http_11_alpn (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5232\"\u003e#5232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.8.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project. If your company or\norganization uses Python and would benefit from HTTP/2 support in\nRequests, pip, cloud SDKs, and thousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden. (High severity, GHSA-8988-9cw3-xx77)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size line of unbounded length in memory. (High\nseverity, GHSA-vxq7-64xx-v4gw)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity, GHSA-gh4c-6fx4-qh6g)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nurllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\u003c/p\u003e\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e. Destination client certificates\nand identity overrides no longer apply to HTTPS forwarding proxy\nconnections.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nCVE IDs had not yet been assigned to these advisories at the time of\nrelease due to a backlog at GitHub\u0027s CNA.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption \u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5044\"\u003e#5044\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience properties to the\nresult of \u003ccode\u003eparse_url()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4945\"\u003e#4945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5092\"\u003e#5092\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFixed response header handling to replace obsolete folded header\nlines (\u003ccode\u003eobs-fold\u003c/code\u003e) with spaces in accordance with RFC 9112,\npreventing raw CRLF sequences from appearing in header values such as\n\u003ccode\u003eSet-Cookie\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/1362\"\u003e#1362\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed usage of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e with\n\u003ccode\u003eProxyManager\u003c/code\u003e when\n\u003ccode\u003euse_forwarding_for_https\u003dTrue\u003c/code\u003e. Passing\n\u003ccode\u003essl_context\u003c/code\u003e instead of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e for\nHTTPS proxies in this configuration now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e and will raise an error in v3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/2577\"\u003e#2577\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eChanged behavior of the default \u003ccode\u003eConnectionPool.pool\u003c/code\u003e\ninitialization. \u003ccode\u003eLifoQueue\u003c/code\u003e is now resolved from the\n\u003ccode\u003equeue\u003c/code\u003e module after the \u003ccode\u003eConnectionPool\u003c/code\u003e is\ninstantiated instead of using the default cached \u003ccode\u003eQueueCls\u003c/code\u003e\nclass property. This is done because sometimes the\n\u003ccode\u003equeue.LifoQueue\u003c/code\u003e is monkey-patched late in the program, such\nas by gevent. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRaised \u003ccode\u003eUnrewindableBodyError\u003c/code\u003e instead of\n\u003ccode\u003eValueError\u003c/code\u003e when retrying a request whose body had\n\u003ccode\u003etell()\u003c/code\u003e but not \u003ccode\u003eseek()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3779\"\u003e#3779\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDecoded percent-encoded SOCKS proxy credentials before authenticating\nwith the proxy server. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3785\"\u003e#3785\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e to discard unread\nresponse data in 64 KiB chunks (same as the default \u003ccode\u003eamt\u003c/code\u003e\nwhen doing \u003ccode\u003eHTTPResponse.stream(...)\u003c/code\u003e). (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5019\"\u003e#5019\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eis_ipaddress()\u003c/code\u003e to detect non-standard IPv4 forms\naccepted by \u003ccode\u003esocket.connect\u003c/code\u003e, such as hex\n(\u003ccode\u003e0x7f000001\u003c/code\u003e), octal (\u003ccode\u003e0177.0.0.1\u003c/code\u003e), and decimal\nintegers (\u003ccode\u003e2130706433\u003c/code\u003e), ensuring SSL certificate\nverification uses the correct mode for these addresses. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5029\"\u003e#5029\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen\u003c/code\u003e raising a misleading\n\u003ccode\u003eFullPoolError\u003c/code\u003e instead of \u003ccode\u003eValueError\u003c/code\u003e when\ncalled with an invalid \u003ccode\u003etimeout\u003c/code\u003e argument on a pool created\nwith \u003ccode\u003eblock\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5059\"\u003e#5059\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed port-zero handling to preserve explicit \u003ccode\u003e:0\u003c/code\u003e values\ninstead of substituting the default ports 80 or 443 in URL parsing, pool\nselection, proxy configuration, \u003ccode\u003econnection_from_url()\u003c/code\u003e, and\nHTTP/2 request authority. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5071\"\u003e#5071\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5101\"\u003e#5101\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed a bug where \u003ccode\u003ePoolManager\u003c/code\u003e passed the\n\u003ccode\u003eassert_hostname\u003c/code\u003e and \u003ccode\u003eassert_fingerprint\u003c/code\u003e\nparameters to HTTP connection pools. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5077\"\u003e#5077\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e and HTTP proxy\nforwarding to strip URL fragments from absolute request targets before\nsending requests. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5079\"\u003e#5079\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded safeguards to the proxy tunneling code to prevent potential\nsecurity issues when handling invalid characters in the proxy host and\nHTTP headers. This change affects users of Python 3.10, Python 3.11, and\nPython 3.12 when the standard library does not contain the fix; those on\nnewer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the\nsame security fixes. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5091\"\u003e#5091\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPSConnection.connect()\u003c/code\u003e overriding\n\u003ccode\u003eProxyConfig.ssl_context\u003c/code\u003e\u0027s certificate policy and proxy\nidentity checks with the target connection\u0027s TLS settings when\nforwarding through an HTTPS proxy.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eHTTPSConnection\u003c/code\u003e no longer applies target SNI,\nassertions, or client credentials to forwarding proxy handshakes and\ncontinues to use its \u003ccode\u003essl_context\u003c/code\u003e as a fallback when an\nHTTPS proxy forwards an HTTP target. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5093\"\u003e#5093\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed URL parsing to more strictly enforce RFC 3986 host syntax,\nrejecting invalid host input such as raw spaces and control characters,\nmalformed percent-encodings, and percent-encoded control characters in\nHTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel\ntargets. Host normalization now also follows RFC 3986 normalization\nrules for percent-encoded octets by decoding percent-encoded unreserved\ncharacters and uppercasing the hexadecimal digits of retained\npercent-encoded octets. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5095\"\u003e#5095\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.8.0 (2026-09-15)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden.\n(High severity, \u003ccode\u003eGHSA-8988-9cw3-xx77\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size\nline of unbounded length in memory. (High severity,\n\u003ccode\u003eGHSA-vxq7-64xx-v4gw\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity,\n\u003ccode\u003eGHSA-gh4c-6fx4-qh6g\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. caution::\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003eurllib3 2.8.0 fixes HTTPS proxy TLS configuration being\nignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e.\nDestination client certificates and identity overrides no longer\napply to HTTPS forwarding proxy connections.\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption\n\u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb.\n(\u003ccode\u003e[#5044](https://github.com/urllib3/urllib3/issues/5044)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5044\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience\nproperties to the result of \u003ccode\u003eparse_url()\u003c/code\u003e.\n(\u003ccode\u003e[#4945](https://github.com/urllib3/urllib3/issues/4945)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4945\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e.\n(\u003ccode\u003e[#5092](https://github.com/urllib3/urllib3/issues/5092)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5092\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a\"\u003e\u003ccode\u003eb1d30ab\u003c/code\u003e\u003c/a\u003e\nRelease 2.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e\"\u003e\u003ccode\u003e9016d7e\u003c/code\u003e\u003c/a\u003e\nSkip \u003ccode\u003etest_read_chunked_with_trailing_data_does_not_hang\u003c/code\u003e for\nbrotlicffi (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5258\"\u003e#5258\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533\"\u003e\u003ccode\u003e9101f58\u003c/code\u003e\u003c/a\u003e\nFix \u003ccode\u003enox -s docs\u003c/code\u003e warning (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5256\"\u003e#5256\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed\"\u003e\u003ccode\u003ecd770b0\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f\"\u003e\u003ccode\u003eea2ad7b\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8\"\u003e\u003ccode\u003e0716e31\u003c/code\u003e\u003c/a\u003e\nFix loading unencrypted client keys with a password in pyOpenSSL (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5255\"\u003e#5255\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d\"\u003e\u003ccode\u003e43c68c8\u003c/code\u003e\u003c/a\u003e\nTest pickling of \u003ccode\u003eInvalidChunkLength\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5247\"\u003e#5247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817\"\u003e\u003ccode\u003e308b279\u003c/code\u003e\u003c/a\u003e\nShare security policy between GitHub and Read the Docs (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5253\"\u003e#5253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706\"\u003e\u003ccode\u003e53fa073\u003c/code\u003e\u003c/a\u003e\nAdd policy on duplicate pull requests (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5252\"\u003e#5252\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267\"\u003e\u003ccode\u003e5f2a6a8\u003c/code\u003e\u003c/a\u003e\nAssert on the ALPN extension in test_tunnel_sets_http_11_alpn (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5232\"\u003e#5232\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.8.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project. If your company or\norganization uses Python and would benefit from HTTP/2 support in\nRequests, pip, cloud SDKs, and thousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden. (High severity, GHSA-8988-9cw3-xx77)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size line of unbounded length in memory. (High\nseverity, GHSA-vxq7-64xx-v4gw)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity, GHSA-gh4c-6fx4-qh6g)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!IMPORTANT]\nurllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\u003c/p\u003e\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e. Destination client certificates\nand identity overrides no longer apply to HTTPS forwarding proxy\nconnections.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[!NOTE]\nCVE IDs had not yet been assigned to these advisories at the time of\nrelease due to a backlog at GitHub\u0027s CNA.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption \u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5044\"\u003e#5044\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience properties to the\nresult of \u003ccode\u003eparse_url()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4945\"\u003e#4945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5092\"\u003e#5092\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFixed response header handling to replace obsolete folded header\nlines (\u003ccode\u003eobs-fold\u003c/code\u003e) with spaces in accordance with RFC 9112,\npreventing raw CRLF sequences from appearing in header values such as\n\u003ccode\u003eSet-Cookie\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/1362\"\u003e#1362\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed usage of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e with\n\u003ccode\u003eProxyManager\u003c/code\u003e when\n\u003ccode\u003euse_forwarding_for_https\u003dTrue\u003c/code\u003e. Passing\n\u003ccode\u003essl_context\u003c/code\u003e instead of \u003ccode\u003eproxy_ssl_context\u003c/code\u003e for\nHTTPS proxies in this configuration now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e and will raise an error in v3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/2577\"\u003e#2577\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eChanged behavior of the default \u003ccode\u003eConnectionPool.pool\u003c/code\u003e\ninitialization. \u003ccode\u003eLifoQueue\u003c/code\u003e is now resolved from the\n\u003ccode\u003equeue\u003c/code\u003e module after the \u003ccode\u003eConnectionPool\u003c/code\u003e is\ninstantiated instead of using the default cached \u003ccode\u003eQueueCls\u003c/code\u003e\nclass property. This is done because sometimes the\n\u003ccode\u003equeue.LifoQueue\u003c/code\u003e is monkey-patched late in the program, such\nas by gevent. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eRaised \u003ccode\u003eUnrewindableBodyError\u003c/code\u003e instead of\n\u003ccode\u003eValueError\u003c/code\u003e when retrying a request whose body had\n\u003ccode\u003etell()\u003c/code\u003e but not \u003ccode\u003eseek()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3779\"\u003e#3779\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDecoded percent-encoded SOCKS proxy credentials before authenticating\nwith the proxy server. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3785\"\u003e#3785\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e to discard unread\nresponse data in 64 KiB chunks (same as the default \u003ccode\u003eamt\u003c/code\u003e\nwhen doing \u003ccode\u003eHTTPResponse.stream(...)\u003c/code\u003e). (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5019\"\u003e#5019\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eis_ipaddress()\u003c/code\u003e to detect non-standard IPv4 forms\naccepted by \u003ccode\u003esocket.connect\u003c/code\u003e, such as hex\n(\u003ccode\u003e0x7f000001\u003c/code\u003e), octal (\u003ccode\u003e0177.0.0.1\u003c/code\u003e), and decimal\nintegers (\u003ccode\u003e2130706433\u003c/code\u003e), ensuring SSL certificate\nverification uses the correct mode for these addresses. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5029\"\u003e#5029\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen\u003c/code\u003e raising a misleading\n\u003ccode\u003eFullPoolError\u003c/code\u003e instead of \u003ccode\u003eValueError\u003c/code\u003e when\ncalled with an invalid \u003ccode\u003etimeout\u003c/code\u003e argument on a pool created\nwith \u003ccode\u003eblock\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5059\"\u003e#5059\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed port-zero handling to preserve explicit \u003ccode\u003e:0\u003c/code\u003e values\ninstead of substituting the default ports 80 or 443 in URL parsing, pool\nselection, proxy configuration, \u003ccode\u003econnection_from_url()\u003c/code\u003e, and\nHTTP/2 request authority. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5071\"\u003e#5071\u003c/a\u003e,\n\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5101\"\u003e#5101\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed a bug where \u003ccode\u003ePoolManager\u003c/code\u003e passed the\n\u003ccode\u003eassert_hostname\u003c/code\u003e and \u003ccode\u003eassert_fingerprint\u003c/code\u003e\nparameters to HTTP connection pools. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5077\"\u003e#5077\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e and HTTP proxy\nforwarding to strip URL fragments from absolute request targets before\nsending requests. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5079\"\u003e#5079\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded safeguards to the proxy tunneling code to prevent potential\nsecurity issues when handling invalid characters in the proxy host and\nHTTP headers. This change affects users of Python 3.10, Python 3.11, and\nPython 3.12 when the standard library does not contain the fix; those on\nnewer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the\nsame security fixes. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5091\"\u003e#5091\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eHTTPSConnection.connect()\u003c/code\u003e overriding\n\u003ccode\u003eProxyConfig.ssl_context\u003c/code\u003e\u0027s certificate policy and proxy\nidentity checks with the target connection\u0027s TLS settings when\nforwarding through an HTTPS proxy.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eHTTPSConnection\u003c/code\u003e no longer applies target SNI,\nassertions, or client credentials to forwarding proxy handshakes and\ncontinues to use its \u003ccode\u003essl_context\u003c/code\u003e as a fallback when an\nHTTPS proxy forwards an HTTP target. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5093\"\u003e#5093\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed URL parsing to more strictly enforce RFC 3986 host syntax,\nrejecting invalid host input such as raw spaces and control characters,\nmalformed percent-encodings, and percent-encoded control characters in\nHTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel\ntargets. Host normalization now also follows RFC 3986 normalization\nrules for percent-encoded octets by decoding percent-encoded unreserved\ncharacters and uppercasing the hexadecimal digits of retained\npercent-encoded octets. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5095\"\u003e#5095\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.8.0 (2026-09-15)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eFixed the following security issues:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe TLS configuration for HTTPS proxies could be ignored or\noverridden.\n(High severity, \u003ccode\u003eGHSA-8988-9cw3-xx77\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eread_chunked()\u003c/code\u003e\ncould buffer a chunk-size\nline of unbounded length in memory. (High severity,\n\u003ccode\u003eGHSA-vxq7-64xx-v4gw\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eChunked Deflate streaming could enter an infinite loop. (Medium\nseverity,\n\u003ccode\u003eGHSA-gh4c-6fx4-qh6g\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. caution::\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003eurllib3 2.8.0 fixes HTTPS proxy TLS configuration being\nignored or\noverridden by destination settings. Configurations relying on that\nbehavior may require changes.\n\u003cp\u003eConfigure proxy CA certificates and client certificates in\n\u003ccode\u003eproxy_ssl_context\u003c/code\u003e, and proxy identity checks with\n\u003ccode\u003eproxy_assert_hostname\u003c/code\u003e or\n\u003ccode\u003eproxy_assert_fingerprint\u003c/code\u003e.\nDestination client certificates and identity overrides no longer\napply to HTTPS forwarding proxy connections.\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003ch2\u003eDeprecations \u0026amp; Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeprecated using an empty collection as the \u003ccode\u003eRetry\u003c/code\u003e\noption\n\u003ccode\u003eallowed_methods\u003c/code\u003e to retry any verb.\n(\u003ccode\u003e[#5044](https://github.com/urllib3/urllib3/issues/5044)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5044\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003eUrl.auth_decoded\u003c/code\u003e and\n\u003ccode\u003eUrl.auth_decoded_joined\u003c/code\u003e convenience\nproperties to the result of \u003ccode\u003eparse_url()\u003c/code\u003e.\n(\u003ccode\u003e[#4945](https://github.com/urllib3/urllib3/issues/4945)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4945\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ebasic_auth_encoding\u003c/code\u003e and\n\u003ccode\u003eproxy_basic_auth_encoding\u003c/code\u003e parameters to\n\u003ccode\u003eurllib3.util.make_headers()\u003c/code\u003e.\n(\u003ccode\u003e[#5092](https://github.com/urllib3/urllib3/issues/5092)\n\u0026lt;https://github.com/urllib3/urllib3/issues/5092\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a\"\u003e\u003ccode\u003eb1d30ab\u003c/code\u003e\u003c/a\u003e\nRelease 2.8.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e\"\u003e\u003ccode\u003e9016d7e\u003c/code\u003e\u003c/a\u003e\nSkip \u003ccode\u003etest_read_chunked_with_trailing_data_does_not_hang\u003c/code\u003e for\nbrotlicffi (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5258\"\u003e#5258\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533\"\u003e\u003ccode\u003e9101f58\u003c/code\u003e\u003c/a\u003e\nFix \u003ccode\u003enox -s docs\u003c/code\u003e warning (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5256\"\u003e#5256\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed\"\u003e\u003ccode\u003ecd770b0\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f\"\u003e\u003ccode\u003eea2ad7b\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8\"\u003e\u003ccode\u003e0716e31\u003c/code\u003e\u003c/a\u003e\nFix loading unencrypted client keys with a password in pyOpenSSL (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5255\"\u003e#5255\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d\"\u003e\u003ccode\u003e43c68c8\u003c/code\u003e\u003c/a\u003e\nTest pickling of \u003ccode\u003eInvalidChunkLength\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/5247\"\u003e#5247\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817\"\u003e\u003ccode\u003e308b279\u003c/code\u003e\u003c/a\u003e\nShare security policy between GitHub and Read the Docs (\u003ca hr...\n\n_Description has been truncated_\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e",
  "tree_diff": []
}