)]}'
{
  "log": [
    {
      "commit": "7bf4e6f0c4ac1762c09b5dce43e0a06aed88434b",
      "tree": "50a967ed4a18da5b910f9d4d3a48a84fecd5a238",
      "parents": [
        "1ac6c5cd66d82da5141909b2d38889ac5f230a4f"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Sep 10 05:56:01 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 05:56:01 2026 +0000"
      },
      "message": "refactor(zipapp): implement rust exe_zip_maker program (#4151)\n\nCreating self-executable zip archives currently relies on Python script\nexecution during builds, which incurs interpreter startup overhead and\nrequires a Python runtime.\n\nProvide a compiled Rust implementation of exe_zip_maker. The tool\ncomputes the SHA-256 digest of the input zip archive, substitutes the\n%ZIP_HASH% placeholder within the executable preamble script, and\nconcatenates the modified preamble with the zip payload.\n\nThis change only adds a Rust implementation. Subsequent changes will\nwire it into the overall build process as a prebuilt tool."
    },
    {
      "commit": "1ac6c5cd66d82da5141909b2d38889ac5f230a4f",
      "tree": "413aaf82de8219c7864844a143704349eaaae84f",
      "parents": [
        "7403b9a5c1e90816d17814a74f54ab531e309c81"
      ],
      "author": {
        "name": "Adam Kocoloski",
        "email": "kocolosk@apache.org",
        "time": "Thu Sep 10 04:38:22 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 04:38:22 2026 +0000"
      },
      "message": "fix(bzlmod): convert coverage_tool Label to string (#4157)\n\nThe `coverage_tool` attribute on\n`python.single_version_platform_override` is declared as a Label, but\nthe value was passed through unchanged to `python_repository`, which\ndeclares `coverage_tool` as a string. This caused a type mismatch error\nat module-extension evaluation time whenever `coverage_tool` was set.\n\nConvert the Label to its canonical string form before storing it. Fixes\n#2570.\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "7403b9a5c1e90816d17814a74f54ab531e309c81",
      "tree": "c1a05d2cef5d994218f716e4b6018f6367c208cf",
      "parents": [
        "14f436ff28c457fd2e136c0a5f4c46e75268806a"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Sep 07 12:18:20 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 12:18:20 2026 +0000"
      },
      "message": "build(dev): move release management tooling from //tools/private to //dev (#4153)\n\nConsolidate repository release management tooling under //dev as part\nof organizing developer-only tools into a dedicated package. Retaining\ndeveloper utilities in //tools/private conflates repo maintenance tools\nwith internal runtime dependencies of //tools.\n\nMove release CLI and library targets from //tools/private/release to\n//dev/release. Update Python imports, unit tests, GitHub Actions\nworkflows, and documentation to reference the new package location.\nClarify the scope of //tools/private in its documentation.\n\nWork towards #4128."
    },
    {
      "commit": "14f436ff28c457fd2e136c0a5f4c46e75268806a",
      "tree": "2192e58cb3bc4630670c788e993c853114e43056",
      "parents": [
        "ced38c374ef96aa30ced9846ca09b5ed783cc1f2"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Sep 07 07:55:28 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 07 07:55:28 2026 +0000"
      },
      "message": "refactor: introduce helper for defining distribution filegroups (#4152)\n\nPreviously, distribution filegroups required manually enumerating each\ndirect subpackage\u0027s distribution target in `srcs`. This created\nrepetitive boilerplate across BUILD files and risked omitting newly\nadded subpackages from release distributions.\n\nIntroduce the `distribution_filegroup` macro to automatically glob\npackage files and discover direct subpackages using\n`native.subpackages()`, with support for an `exclude` list.\n\n* Also updates BUILD files across the repository to use the new macro"
    },
    {
      "commit": "ced38c374ef96aa30ced9846ca09b5ed783cc1f2",
      "tree": "4a54ead66a5085bf8ada30e44a9a001e37848c7c",
      "parents": [
        "cf6ec45b40059eecb6e40f936999e4d230987c1e"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Sep 04 11:12:54 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 11:12:54 2026 +0000"
      },
      "message": "build(dev): move internal dev tools from //tools/private to //dev (#4149)\n\nConsolidate most developer tools under //dev. //tools/private is\nreserved for internal release management tooling.\n\nMove sync_downloader_configs.py, update_deps, gazelle, and debug to\n//dev. Update import paths, target visibility, generation markers,\npre-commit hooks, and developer documentation.\n\nWork towards #4128"
    },
    {
      "commit": "cf6ec45b40059eecb6e40f936999e4d230987c1e",
      "tree": "30f0c198781dbef091eabf70900b78b1354375cf",
      "parents": [
        "a17a26396d9902d9044ce786bb4e53a6bd6c8e94"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Sep 04 00:41:09 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 00:41:09 2026 -0700"
      },
      "message": "agents: add conversation-done skill (#4150)\n\nAgent workflows create substantial disk and process overhead outside\nthe conversation directory, including Bazel server processes, output\nbases, git worktrees, and feature branches. Without automated cleanup,\nthese resources accumulate across tasks.\n\nAdd the `conversation-done` skill and an async cleanup engine to safely\nreclaim these resources when a conversation finishes. The tool shuts\ndown active Bazel servers, deletes matching output bases, and prunes\ngit worktrees and branches while enforcing safeguards for main repos,\ncanonical branches, and upstream remotes."
    },
    {
      "commit": "a17a26396d9902d9044ce786bb4e53a6bd6c8e94",
      "tree": "ece733227edf99b3d1bba813a277f94b8d8baa8d",
      "parents": [
        "fc4ee15b601fe93b0cd87c211f8089b810a1e513"
      ],
      "author": {
        "name": "github-actions[bot]",
        "email": "41898282+github-actions[bot]@users.noreply.github.com",
        "time": "Fri Sep 04 02:41:13 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 04 02:41:13 2026 +0000"
      },
      "message": "chore(release): sync changelog for v2.3.3 backports (#4147)\n\nUpdates CHANGELOG.md and removes news files for backports:\n- #4007\n- #4119\n- #4135\n\nWork towards #4121\nRelease-Tracking-Issue: #4121\n\n---------\n\nCo-authored-by: github-actions[bot] \u003c41898282+github-actions[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "fc4ee15b601fe93b0cd87c211f8089b810a1e513",
      "tree": "33bd99214df6468687b661b1c7f06b67c90a39cb",
      "parents": [
        "d42e0dd6153bbc6c98eb93d3a2f52fc7fc528caa"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Sep 03 19:39:35 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 19:39:35 2026 -0700"
      },
      "message": "docs(release): document sync-changelog command in template and guide (#4148)\n\nThe /sync-changelog command was added to on_comment and the release\ntool CLI, but was omitted from the release tracking issue template and\ntroubleshooting documentation.\n\nAdd /sync-changelog to the Available Commands section of the release\ntracking issue template, and document how to retry changelog syncing in\nRELEASING.md."
    },
    {
      "commit": "d42e0dd6153bbc6c98eb93d3a2f52fc7fc528caa",
      "tree": "d1d146f0c525d58f4b97d362cede6330f1b959c9",
      "parents": [
        "03f212c3f3b590a7103d512650ce09818d30d218"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Sep 03 19:16:56 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 19:16:56 2026 -0700"
      },
      "message": "build(release): allow process-news to create missing release sections (#4145)\n\nDuring patch release backporting, sync-changelog failed because\nprocess-news rejected release versions that did not already exist in\nCHANGELOG.md.\n\nRemove the pre-check requiring the version anchor to pre-exist, and\nallow process-news to automatically create a new release section with\nthe appropriate release date. Forward --release-date from sync-changelog\nto process-news."
    },
    {
      "commit": "03f212c3f3b590a7103d512650ce09818d30d218",
      "tree": "229194a20ee16765e2b64f4d7f9b1157730d493b",
      "parents": [
        "5fe3666b5e09f613e1de3fe9b049510c6a79cf9a"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Sep 03 11:05:41 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 11:05:41 2026 +0000"
      },
      "message": "build(dev): remove unused requirements update aliases (#4144)\n\nRemove requirements_all.update and whl_library_requirements.update\naliases from //dev. Reference update_pip_deps directly in devguide.\n\nWork towards #4128"
    },
    {
      "commit": "5fe3666b5e09f613e1de3fe9b049510c6a79cf9a",
      "tree": "9fef29e78487bf92a1da1f0baa10fbe0709dc3f3",
      "parents": [
        "88e12538434fb9750a11f317899ab58d37c6f055"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Sep 03 07:13:13 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 07:13:13 2026 +0000"
      },
      "message": "fix(bootstrap): remap stdlib sys.path entries to runfiles during site init (#4104)\n\nWhen CPython resolves interpreter symlinks during startup, it leaks\nunderlying repository cache or external repository paths into sys.path\nand sys prefixes instead of their runfiles locations.\n\nThis breaks runfiles isolation and prevents using a mixture of\ngenerated and non-generated files as part of the python runtime, as\nstandard library modules and runtime site-packages are loaded from\nlocations outside the runfiles tree.\n\nFix this by passing interpreter_actual_path into site_init_template.py\nduring virtual environment creation. During site initialization,\ncollect any non-runfiles sys prefixes into a set and remap matching\nsys.path entries, sys prefixes, and site.PREFIXES to the runfiles\nruntime root.\n\nAlso adds a reproduction test target\n(stdlib_symlink_syspath_bootstrap_script_test) to verify that sys.path\nentries remain within the runfiles tree.\n\nWork towards https://github.com/bazel-contrib/rules_python/issues/1653"
    },
    {
      "commit": "88e12538434fb9750a11f317899ab58d37c6f055",
      "tree": "3d257dc8929a7f0dd32954b9367df7d8649ba16c",
      "parents": [
        "6db21fa56954e57b3dec0e48c5bb3baa2b7fdf74"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Sep 03 04:46:05 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 04:46:05 2026 +0000"
      },
      "message": "build: move requirements update multirun from //private to //dev (#4143)\n\nPart of consolidating developer-only tools and utilities under //dev.\nTop-level //private ambiguously conflates rule internals with\ndeveloper utilities.\n\nMove the repo-wide requirements update multirun from //private to\n//dev:all_requirements.update and remove the //private package.\n\nWork towards #4128"
    },
    {
      "commit": "6db21fa56954e57b3dec0e48c5bb3baa2b7fdf74",
      "tree": "f88699a4de5dc4667a75ba4e911f6671fe6b075b",
      "parents": [
        "31ae992005827d4e421b29f897d050a9dee36fb9"
      ],
      "author": {
        "name": "rsartor-cmd",
        "email": "rsartor@google.com",
        "time": "Thu Sep 03 04:01:01 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 03 04:01:01 2026 +0000"
      },
      "message": "feat: Add win32 versions (#4141)\n\nAdds runtimes for win32, versions 3.9.25, 3.10.20, 3.11.15, 3.12.13,\n3.13.13, and 3.14.4. This is useful for some downstream consumers (e.g.\nprotobuf) who need to support that. This doesn\u0027t affect any other\nversions or platforms."
    },
    {
      "commit": "31ae992005827d4e421b29f897d050a9dee36fb9",
      "tree": "a544899fe4036a978c822de9471a804e61fab27b",
      "parents": [
        "040246c7211820bb14997d85c693cc28e1af5281"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Sep 02 21:07:13 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 21:07:13 2026 -0700"
      },
      "message": "build(tools): remove reviewbot tool and workflow (#4142)\n\nThe automated PR reviewbot is not being used, and there is\ninsufficient quota to run it as part of PRs. With no plan to change\nthat, remove it.\n\nRemove the internal reviewbot scripts, prompt, and review-pr skill,\nclean up the private developer tools documentation, and remove the\nautomated review GitHub Actions workflow."
    },
    {
      "commit": "040246c7211820bb14997d85c693cc28e1af5281",
      "tree": "210f9cfa4ebbb11e14c7ca8b53d9100760416eda",
      "parents": [
        "29409efc234b955f9cb441a5f8b0eb7d2032f874"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Sep 02 23:18:14 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 23:18:14 2026 +0000"
      },
      "message": "build(deps): bump pip from 26.1.2 to 26.2 in /examples/wheel in the uv group across 1 directory (#4140)\n\nBumps the uv group with 1 update in the /examples/wheel directory:\n[pip](https://github.com/pypa/pip).\n\nUpdates `pip` from 26.1.2 to 26.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/pip/blob/main/NEWS.rst\"\u003epip\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e26.2 (2026-07-29)\u003c/h1\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eNewly published packages will no longer be immediately visible to pip\nif the index uses caching. To install a newly published package, use\n\u003ccode\u003e--refresh-package\u003c/code\u003e.\n(\u003ccode\u003e[#13680](https://github.com/pypa/pip/issues/13680)\n\u0026lt;https://github.com/pypa/pip/issues/13680\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDrop support for detecting legacy, non-:pep:\u003ccode\u003e405\u003c/code\u003e,\n\u003ccode\u003evirtualenv\u003c/code\u003e (\u0026lt; 20)\nenvironments. (\u003ccode\u003e[#14062](https://github.com/pypa/pip/issues/14062)\n\u0026lt;https://github.com/pypa/pip/issues/14062\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eConstraints files, including \u003ccode\u003ePIP_CONSTRAINT\u003c/code\u003e, no longer\naffect isolated\nbuild environments. Use \u003ccode\u003e--build-constraint\u003c/code\u003e or the\n\u003ccode\u003ePIP_BUILD_CONSTRAINT\u003c/code\u003e\nenvironment variable to constrain build dependencies instead.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e--use-feature\u003dbuild-constraint\u003c/code\u003e flag is now always\nenabled and has no\neffect. (\u003ccode\u003e[#14094](https://github.com/pypa/pip/issues/14094)\n\u0026lt;https://github.com/pypa/pip/issues/14094\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDeclare support for Python 3.15\n(\u003ccode\u003e[#14208](https://github.com/pypa/pip/issues/14208)\n\u0026lt;https://github.com/pypa/pip/issues/14208\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport self-referential extras officially. pip has supported this by\naccident since version 21.2.\n(\u003ccode\u003e[#11296](https://github.com/pypa/pip/issues/11296)\n\u0026lt;https://github.com/pypa/pip/issues/11296\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003e--only-deps\u003c/code\u003e flag to instruct pip to select only the\ndependencies\nof supplied packages. It cannot be used with \u003ccode\u003e--no-deps\u003c/code\u003e,\n\u003ccode\u003e-r\u003c/code\u003e, \u003ccode\u003e--group\u003c/code\u003e,\nor \u003ccode\u003e--requirements-from-script\u003c/code\u003e.\n(\u003ccode\u003e[#11440](https://github.com/pypa/pip/issues/11440)\n\u0026lt;https://github.com/pypa/pip/issues/11440\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eCache simple responses in accordance to their\n\u003ccode\u003eCache-Control\u003c/code\u003e header\ninstead of always revalidating on every request. To refresh cached\npackage index responses\nand ensure newly published packages are found, use\n\u003ccode\u003e--refresh-package \u0026lt;package\u0026gt;\u003c/code\u003e.\n(\u003ccode\u003e[#13680](https://github.com/pypa/pip/issues/13680)\n\u0026lt;https://github.com/pypa/pip/issues/13680\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003e--no-require-hashes\u003c/code\u003e to disable automatic enablement\nof\n\u003ccode\u003e--require-hashes\u003c/code\u003e when encountering a requirement with\nhashes. (\u003ccode\u003e[#14169](https://github.com/pypa/pip/issues/14169)\n\u0026lt;https://github.com/pypa/pip/issues/14169\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHonor \u003ccode\u003e--only-final\u003c/code\u003e when sourcing requirements with\n\u003ccode\u003e-r pylock.toml\u003c/code\u003e.\n(\u003ccode\u003e[#13950](https://github.com/pypa/pip/issues/13950)\n\u0026lt;https://github.com/pypa/pip/issues/13950\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd support for \u003ccode\u003epylock.toml\u003c/code\u003e \u003ccode\u003eupload-time\u003c/code\u003e\nfield, so \u003ccode\u003e--uploaded-prior-to\u003c/code\u003e works with \u003ccode\u003e-r\npylock.toml\u003c/code\u003e.\n(\u003ccode\u003e[#14168](https://github.com/pypa/pip/issues/14168)\n\u0026lt;https://github.com/pypa/pip/issues/14168\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBetter error messages in case of conflicts with requirements from\n\u003ccode\u003e-r pylock.toml\u003c/code\u003e.\n(\u003ccode\u003e[#13963](https://github.com/pypa/pip/issues/13963)\n\u0026lt;https://github.com/pypa/pip/issues/13963\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd experimental support for isolating build subprocesses by creating\nstandard\nvirtual environments. This will fix most (if not all) subtle isolation\nissues\nthat can lead to broken builds exclusive to pip. The feature can be\nenabled\nvia \u003ccode\u003e--use-feature\u003dvenv-isolation\u003c/code\u003e and will be enabled by\ndefault in a future\nrelease.\u003c/p\u003e\n\u003cp\u003eNote that the feature has limited compatibility with\n\u003ccode\u003e--use-feature\u003dinprocess-build-deps\u003c/code\u003e.\nWhile most builds should work with both features enabled, there are\nknown edge cases.\n\u003ccode\u003einprocess-build-deps\u003c/code\u003e will not be enabled by default until\nthey are fixed.\n(\u003ccode\u003e[#14070](https://github.com/pypa/pip/issues/14070)\n\u0026lt;https://github.com/pypa/pip/issues/14070\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003ePresent more informative diagnostic errors on uncaught network\nerrors. (\u003ccode\u003e[#14115](https://github.com/pypa/pip/issues/14115)\n\u0026lt;https://github.com/pypa/pip/issues/14115\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAllow opting out of Git partial clones with\n\u003ccode\u003ePIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER\u003c/code\u003e.\n(\u003ccode\u003e[#11043](https://github.com/pypa/pip/issues/11043)\n\u0026lt;https://github.com/pypa/pip/issues/11043\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd a \u003ccode\u003e--no-proxy-env\u003c/code\u003e (or \u003ccode\u003e--proxy\n\u0026quot;\u0026quot;\u003c/code\u003e) option to ignore proxies\nconfigured via non-pip environment variables or configuration files.\nA proxy set with \u003ccode\u003e--proxy\u003c/code\u003e is still used.\n(\u003ccode\u003e[#5378](https://github.com/pypa/pip/issues/5378)\n\u0026lt;https://github.com/pypa/pip/issues/5378\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd support for pulling username from keyring subprocess provider\n(\u003ccode\u003e[#12543](https://github.com/pypa/pip/issues/12543)\n\u0026lt;https://github.com/pypa/pip/issues/12543\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSpeedup tab autocompletion by lazy-importing certain modules.\n(\u003ccode\u003e[#4768](https://github.com/pypa/pip/issues/4768)\n\u0026lt;https://github.com/pypa/pip/issues/4768\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357\"\u003e\u003ccode\u003e4b6ae5c\u003c/code\u003e\u003c/a\u003e\nBump for release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/50b6d3cf998e141d106e72ba17380c39f979188d\"\u003e\u003ccode\u003e50b6d3c\u003c/code\u003e\u003c/a\u003e\nUpdate AUTHORS.txt\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/dbddfbde3a2f57401c9ad1b910aee6d195af7b8d\"\u003e\u003ccode\u003edbddfbd\u003c/code\u003e\u003c/a\u003e\nTweak news entries for pip 26.2 (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14212\"\u003e#14212\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/6576b7596c97bb95ce02098303d25bf82dd44943\"\u003e\u003ccode\u003e6576b75\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14165\"\u003e#14165\u003c/a\u003e from\nsbidoul/refactor-pylock-hanling-sbi\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/0090e0065ae0087d5d6c171a4eb1821e127aa120\"\u003e\u003ccode\u003e0090e00\u003c/code\u003e\u003c/a\u003e\nAddress a variety of typos detected in code review\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/e12ddd958df6878f38f2a6f777e4653613eb4821\"\u003e\u003ccode\u003ee12ddd9\u003c/code\u003e\u003c/a\u003e\nAdd support for --uploaded-prior-to with -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/5eefdbcb09ab9783ab89f33fb85c48abf45eb7be\"\u003e\u003ccode\u003e5eefdbc\u003c/code\u003e\u003c/a\u003e\nBetter conflict report for requirements from -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/6d71ff83d64b36504761990911e797c0f5d259d1\"\u003e\u003ccode\u003e6d71ff8\u003c/code\u003e\u003c/a\u003e\nTest --only-final with -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/e7d6eb9983980a6380a12e0822da2c1c560e1bb4\"\u003e\u003ccode\u003ee7d6eb9\u003c/code\u003e\u003c/a\u003e\nRefactor -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/756506d154a5b5b5746e9c66bc6e52d6ae3803a9\"\u003e\u003ccode\u003e756506d\u003c/code\u003e\u003c/a\u003e\nAdd TODO about pylock.select and --no-binary\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pypa/pip/compare/26.1.2...26.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dpip\u0026package-manager\u003duv\u0026previous-version\u003d26.1.2\u0026new-version\u003d26.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\nYou can disable automated security fix PRs for this repo from the\n[Security Alerts\npage](https://github.com/bazel-contrib/rules_python/network/alerts).\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "29409efc234b955f9cb441a5f8b0eb7d2032f874",
      "tree": "210f9cfa4ebbb11e14c7ca8b53d9100760416eda",
      "parents": [
        "2d39a20438227c9f0bf3c5b9b1258193dea867cf"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Sep 02 23:15:14 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 23:15:14 2026 +0000"
      },
      "message": "build(deps): bump pip from 26.1.2 to 26.2 in /examples/wheel in the pip group across 1 directory (#4136)\n\nBumps the pip group with 1 update in the /examples/wheel directory:\n[pip](https://github.com/pypa/pip).\n\nUpdates `pip` from 26.1.2 to 26.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/pip/blob/main/NEWS.rst\"\u003epip\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e26.2 (2026-07-29)\u003c/h1\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eNewly published packages will no longer be immediately visible to pip\nif the index uses caching. To install a newly published package, use\n\u003ccode\u003e--refresh-package\u003c/code\u003e.\n(\u003ccode\u003e[#13680](https://github.com/pypa/pip/issues/13680)\n\u0026lt;https://github.com/pypa/pip/issues/13680\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDrop support for detecting legacy, non-:pep:\u003ccode\u003e405\u003c/code\u003e,\n\u003ccode\u003evirtualenv\u003c/code\u003e (\u0026lt; 20)\nenvironments. (\u003ccode\u003e[#14062](https://github.com/pypa/pip/issues/14062)\n\u0026lt;https://github.com/pypa/pip/issues/14062\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eConstraints files, including \u003ccode\u003ePIP_CONSTRAINT\u003c/code\u003e, no longer\naffect isolated\nbuild environments. Use \u003ccode\u003e--build-constraint\u003c/code\u003e or the\n\u003ccode\u003ePIP_BUILD_CONSTRAINT\u003c/code\u003e\nenvironment variable to constrain build dependencies instead.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003e--use-feature\u003dbuild-constraint\u003c/code\u003e flag is now always\nenabled and has no\neffect. (\u003ccode\u003e[#14094](https://github.com/pypa/pip/issues/14094)\n\u0026lt;https://github.com/pypa/pip/issues/14094\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDeclare support for Python 3.15\n(\u003ccode\u003e[#14208](https://github.com/pypa/pip/issues/14208)\n\u0026lt;https://github.com/pypa/pip/issues/14208\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport self-referential extras officially. pip has supported this by\naccident since version 21.2.\n(\u003ccode\u003e[#11296](https://github.com/pypa/pip/issues/11296)\n\u0026lt;https://github.com/pypa/pip/issues/11296\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003e--only-deps\u003c/code\u003e flag to instruct pip to select only the\ndependencies\nof supplied packages. It cannot be used with \u003ccode\u003e--no-deps\u003c/code\u003e,\n\u003ccode\u003e-r\u003c/code\u003e, \u003ccode\u003e--group\u003c/code\u003e,\nor \u003ccode\u003e--requirements-from-script\u003c/code\u003e.\n(\u003ccode\u003e[#11440](https://github.com/pypa/pip/issues/11440)\n\u0026lt;https://github.com/pypa/pip/issues/11440\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eCache simple responses in accordance to their\n\u003ccode\u003eCache-Control\u003c/code\u003e header\ninstead of always revalidating on every request. To refresh cached\npackage index responses\nand ensure newly published packages are found, use\n\u003ccode\u003e--refresh-package \u0026lt;package\u0026gt;\u003c/code\u003e.\n(\u003ccode\u003e[#13680](https://github.com/pypa/pip/issues/13680)\n\u0026lt;https://github.com/pypa/pip/issues/13680\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003e--no-require-hashes\u003c/code\u003e to disable automatic enablement\nof\n\u003ccode\u003e--require-hashes\u003c/code\u003e when encountering a requirement with\nhashes. (\u003ccode\u003e[#14169](https://github.com/pypa/pip/issues/14169)\n\u0026lt;https://github.com/pypa/pip/issues/14169\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHonor \u003ccode\u003e--only-final\u003c/code\u003e when sourcing requirements with\n\u003ccode\u003e-r pylock.toml\u003c/code\u003e.\n(\u003ccode\u003e[#13950](https://github.com/pypa/pip/issues/13950)\n\u0026lt;https://github.com/pypa/pip/issues/13950\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd support for \u003ccode\u003epylock.toml\u003c/code\u003e \u003ccode\u003eupload-time\u003c/code\u003e\nfield, so \u003ccode\u003e--uploaded-prior-to\u003c/code\u003e works with \u003ccode\u003e-r\npylock.toml\u003c/code\u003e.\n(\u003ccode\u003e[#14168](https://github.com/pypa/pip/issues/14168)\n\u0026lt;https://github.com/pypa/pip/issues/14168\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBetter error messages in case of conflicts with requirements from\n\u003ccode\u003e-r pylock.toml\u003c/code\u003e.\n(\u003ccode\u003e[#13963](https://github.com/pypa/pip/issues/13963)\n\u0026lt;https://github.com/pypa/pip/issues/13963\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd experimental support for isolating build subprocesses by creating\nstandard\nvirtual environments. This will fix most (if not all) subtle isolation\nissues\nthat can lead to broken builds exclusive to pip. The feature can be\nenabled\nvia \u003ccode\u003e--use-feature\u003dvenv-isolation\u003c/code\u003e and will be enabled by\ndefault in a future\nrelease.\u003c/p\u003e\n\u003cp\u003eNote that the feature has limited compatibility with\n\u003ccode\u003e--use-feature\u003dinprocess-build-deps\u003c/code\u003e.\nWhile most builds should work with both features enabled, there are\nknown edge cases.\n\u003ccode\u003einprocess-build-deps\u003c/code\u003e will not be enabled by default until\nthey are fixed.\n(\u003ccode\u003e[#14070](https://github.com/pypa/pip/issues/14070)\n\u0026lt;https://github.com/pypa/pip/issues/14070\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003ePresent more informative diagnostic errors on uncaught network\nerrors. (\u003ccode\u003e[#14115](https://github.com/pypa/pip/issues/14115)\n\u0026lt;https://github.com/pypa/pip/issues/14115\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAllow opting out of Git partial clones with\n\u003ccode\u003ePIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER\u003c/code\u003e.\n(\u003ccode\u003e[#11043](https://github.com/pypa/pip/issues/11043)\n\u0026lt;https://github.com/pypa/pip/issues/11043\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd a \u003ccode\u003e--no-proxy-env\u003c/code\u003e (or \u003ccode\u003e--proxy\n\u0026quot;\u0026quot;\u003c/code\u003e) option to ignore proxies\nconfigured via non-pip environment variables or configuration files.\nA proxy set with \u003ccode\u003e--proxy\u003c/code\u003e is still used.\n(\u003ccode\u003e[#5378](https://github.com/pypa/pip/issues/5378)\n\u0026lt;https://github.com/pypa/pip/issues/5378\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd support for pulling username from keyring subprocess provider\n(\u003ccode\u003e[#12543](https://github.com/pypa/pip/issues/12543)\n\u0026lt;https://github.com/pypa/pip/issues/12543\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSpeedup tab autocompletion by lazy-importing certain modules.\n(\u003ccode\u003e[#4768](https://github.com/pypa/pip/issues/4768)\n\u0026lt;https://github.com/pypa/pip/issues/4768\u0026gt;\u003c/code\u003e_)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357\"\u003e\u003ccode\u003e4b6ae5c\u003c/code\u003e\u003c/a\u003e\nBump for release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/50b6d3cf998e141d106e72ba17380c39f979188d\"\u003e\u003ccode\u003e50b6d3c\u003c/code\u003e\u003c/a\u003e\nUpdate AUTHORS.txt\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/dbddfbde3a2f57401c9ad1b910aee6d195af7b8d\"\u003e\u003ccode\u003edbddfbd\u003c/code\u003e\u003c/a\u003e\nTweak news entries for pip 26.2 (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14212\"\u003e#14212\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/6576b7596c97bb95ce02098303d25bf82dd44943\"\u003e\u003ccode\u003e6576b75\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14165\"\u003e#14165\u003c/a\u003e from\nsbidoul/refactor-pylock-hanling-sbi\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/0090e0065ae0087d5d6c171a4eb1821e127aa120\"\u003e\u003ccode\u003e0090e00\u003c/code\u003e\u003c/a\u003e\nAddress a variety of typos detected in code review\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/e12ddd958df6878f38f2a6f777e4653613eb4821\"\u003e\u003ccode\u003ee12ddd9\u003c/code\u003e\u003c/a\u003e\nAdd support for --uploaded-prior-to with -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/5eefdbcb09ab9783ab89f33fb85c48abf45eb7be\"\u003e\u003ccode\u003e5eefdbc\u003c/code\u003e\u003c/a\u003e\nBetter conflict report for requirements from -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/6d71ff83d64b36504761990911e797c0f5d259d1\"\u003e\u003ccode\u003e6d71ff8\u003c/code\u003e\u003c/a\u003e\nTest --only-final with -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/e7d6eb9983980a6380a12e0822da2c1c560e1bb4\"\u003e\u003ccode\u003ee7d6eb9\u003c/code\u003e\u003c/a\u003e\nRefactor -r pylock.toml\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/756506d154a5b5b5746e9c66bc6e52d6ae3803a9\"\u003e\u003ccode\u003e756506d\u003c/code\u003e\u003c/a\u003e\nAdd TODO about pylock.select and --no-binary\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pypa/pip/compare/26.1.2...26.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2d39a20438227c9f0bf3c5b9b1258193dea867cf",
      "tree": "cc5ce28c59c60a8501c07a773456cf3058ef13df",
      "parents": [
        "6c57f12a331804516d4cc986c801ee254068dad1"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Wed Sep 02 21:44:36 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 21:44:36 2026 +0000"
      },
      "message": "feat(uv): add --directory support for locking (#4029)\n\nCurrently, requirements locking targets are tightly coupled to the Bazel\npackage directory where the lock rule is declared. This prevents having\nreusable invocations across different example packages (e.g.\n`examples/bzlmod`\nand `examples`) that produce identical lock files, hindering migration\nfrom\n`compile_pip_requirements` to the `lock` rule.\n\nTo resolve this, add a `directory` attribute to the `lock` macro and\nrules to\npass `--directory` to `uv lock` and `uv pip compile`. Reroot input\nsources,\nconstraints, and project root arguments relative to the specified\nworking\ndirectory, and update UNIX and Windows execution templates to handle\ndirectory\nremapping seamlessly.\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "6c57f12a331804516d4cc986c801ee254068dad1",
      "tree": "16eb95a342f8b2b421efdf5036ef6f538f6f3597",
      "parents": [
        "e5faa243e2e61163b9e4240ebd2a5632049c9566"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Sep 02 17:43:03 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 17:43:03 2026 +0000"
      },
      "message": "build: configure repository cache in .bazelrc (#4137)\n\nConfigure a shared Bazel repository cache and enable hardlinks for\nlocal builds.\n\nDeveloper workflows that use short-lived worktrees (such as agentic\ndevelopment) repeatedly re-download external dependencies and consume\nexcessive disk space."
    },
    {
      "commit": "e5faa243e2e61163b9e4240ebd2a5632049c9566",
      "tree": "d95805c8e3320c616066dec38ae0174521570b3f",
      "parents": [
        "c90ceb94da9d91ba41f4e5ad4d1e528ed6e97890"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Sep 02 17:42:20 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 17:42:20 2026 +0000"
      },
      "message": "refactor: move tools/private/zipapp to tools/zipapp (#4127)\n\nThe `//tools/private` package is reserved for developer tools used to\nmaintain `rules_python`. The zipapp tools support rule execution and\nbelong under `//tools/` alongside tools like `launcher`.\n\nMove `tools/private/zipapp` to `tools/zipapp`, update internal rule\nattributes, adjust test imports and dependencies, update distribution\nfilegroups, and document the scope of `//tools/private`."
    },
    {
      "commit": "c90ceb94da9d91ba41f4e5ad4d1e528ed6e97890",
      "tree": "999f945d5eae2bbe31e076e19371502879da95d3",
      "parents": [
        "c319e12afe012a88eb408b9035ca86c43c3512df"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Sep 02 07:48:15 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 07:48:15 2026 +0000"
      },
      "message": "chore: update default Python version to 3.14 (#4023)\n\nUpdate the default Python toolchain version from 3.11 to 3.14 to align\nwith newer Python releases and provide modern defaults out of the box.\n\nThis updates the default toolchain version configurations in the module\nextension, documentation, and test suites."
    },
    {
      "commit": "c319e12afe012a88eb408b9035ca86c43c3512df",
      "tree": "1187edec91bad86487e64f3a06538f2e1496814c",
      "parents": [
        "a6606a5344aca4a708af79179e0239983fbf7b93"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Sep 02 00:53:54 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 02 00:53:54 2026 -0700"
      },
      "message": "agents: update news and PR conventions (#4138)\n\nUpdate agent rules based on recent review feedback.\n\n- Refine `.agents/rules/news.md` to mandate focusing on user-visible\n  outcomes and restrict `{obj}` to documented API symbols.\n- Update `.agents/rules/pr.md` to preserve author wording and wrap PR\n  description bodies at 72 columns."
    },
    {
      "commit": "a6606a5344aca4a708af79179e0239983fbf7b93",
      "tree": "0511471c07750a72ebca8cbdba30d1bbb3f63bdb",
      "parents": [
        "6c1d9ea58a88b352ea4585e3631e191de528d874"
      ],
      "author": {
        "name": "Garrett Holmstrom",
        "email": "gholmstrom@zoox.com",
        "time": "Tue Sep 01 10:08:53 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 01 10:08:53 2026 +0000"
      },
      "message": "fix(gazelle): fix module map for old-style namespaces (#4135)\n\nThe performance tweak in #3415 which parallelized gazelle module map\ngeneration calls simplify() on wheels individually, which always results\nin entries which collapse to the highest level modules which contain\n__init__.py files. But when two wheels do old-style namespace packages\nby both including that file under their top-level module, they simplify\ndown to the top-level module, clobber each other when merged, and wind\nup with one wheel getting mapped for the entire namespace. This causes\nbug #3528.\n\nWe fix this by deferring our call to simplify() until after we\u0027ve merged\nall the wheels\u0027 module info.\n\nFixes #3528"
    },
    {
      "commit": "6c1d9ea58a88b352ea4585e3631e191de528d874",
      "tree": "ec0bc2b97f1ad09e4ce2c8c6232347d1c7826c99",
      "parents": [
        "14ac13149d6dbb49a9979164fb48719f4837f901"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 31 03:30:57 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 03:30:57 2026 +0000"
      },
      "message": "refactor(config_settings): remove unused private distribution target (#4129)\n\nThe `python/config_settings/private` package contains no source files,\nleaving its `:distribution` target empty and obsolete. Including it\nin `//python/config_settings:distribution` adds redundant build graph\nstructure.\n\nDelete the unused private `BUILD.bazel` file and remove the dependency\nfrom `//python/config_settings:distribution`."
    },
    {
      "commit": "14ac13149d6dbb49a9979164fb48719f4837f901",
      "tree": "70a680c0c6f94e52fd7792d24cb8e7edee3b83ac",
      "parents": [
        "c25347445d90ef452baf4207485ac58da7923ca1"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 31 03:30:14 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 03:30:14 2026 +0000"
      },
      "message": "docs(support): document nix as a tier 2 platform (#4130)\n\nClarify that Nix is a Tier 2 platform. We\u0027ve gotten a few PRs for it,\nso be explicit about its support status."
    },
    {
      "commit": "c25347445d90ef452baf4207485ac58da7923ca1",
      "tree": "75763220bfd8c2f2cf9cc27894f65035e41b9ac6",
      "parents": [
        "d517de1b95a3b196b3baf9da082a9fbdeefb3e9b"
      ],
      "author": {
        "name": "Nicolas Dumazet",
        "email": "cozy-visor-sandlot@duck.com",
        "time": "Mon Aug 31 01:54:50 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 31 01:54:50 2026 +0000"
      },
      "message": "fix(venv_shebang_rewriter): avoid depending on host coreutils (#4125)\n\nTwo scripts used as build actions in the pip integration ran directly\n(`ctx.actions.run`, no shell) with no declared `PATH`. On sandboxed\nenvironments without an FHS-style `/bin:/usr/bin` (e.g. NixOS), these\nfail with `\u003ctool\u003e: command not found`, even though the action\u0027s own\nexecutable resolves fine.\n\n- `venv_shebang_rewriter.sh` resolved `head`/`tail`/`chmod` from `PATH`.\n- `wheel_record_rewriter.sh` resolved `awk` from `PATH`.\n\n## Fix\n\nBoth are ported to plain Python scripts exposed as `py_binary` targets,\nper this project\u0027s own documented guidance (`PyExecToolsInfo`\u0027s\n`exec_interpreter` docs recommend a `py_binary` + `cfg\u003dexec` over manual\ninterpreter wiring). This sidesteps host `PATH` concerns entirely.\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "d517de1b95a3b196b3baf9da082a9fbdeefb3e9b",
      "tree": "454837fd0570f2aa2e17454144caeb461f8458df",
      "parents": [
        "bca549e4aca6aef42e443d7860b422182411f153"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 30 18:54:45 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 30 18:54:45 2026 -0700"
      },
      "message": "agents: remove _bzl suffix requirement for bzl_library targets (#4131)\n\nGuidance previously instructed agents to append `_bzl` to bzl_library\ntargets within rules_python, diverging from external target naming\nconventions and creating unnecessary naming discrepancies.\n\nUpdate bzl_library guidance and examples in AGENTS.md to consistently\ndrop the `.bzl` extension rather than appending `_bzl`."
    },
    {
      "commit": "bca549e4aca6aef42e443d7860b422182411f153",
      "tree": "d696eab5294d109336755b386a2de0d153ce1067",
      "parents": [
        "8d376b364ee94d8e44185a6a1fb62b27425f546a"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 29 11:01:27 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 29 11:01:27 2026 -0700"
      },
      "message": "agents: add sync-git-branch-continuously skill (#4126)\n\nProvide an automated background daemon and agent skill to continuously\nsynchronize Git branches with remote tracking repositories during agent\nworkflows.\n\nAdd the `sync-git-branch-continuously` skill and companion daemon\nscript. The daemon periodically performs fast-forward pulls and pushes\nto configured remotes, while supporting asynchronous wakeup via\n`SIGUSR1` signals for immediate on-demand synchronization cycles."
    },
    {
      "commit": "8d376b364ee94d8e44185a6a1fb62b27425f546a",
      "tree": "1cc7c470527886a6d735f13c6bf7650c6a7a550b",
      "parents": [
        "3da7faf4293499b6398a924583dc4a3beda1c4a3"
      ],
      "author": {
        "name": "tomatotomata",
        "email": "Ahmadalgaidy@hotmail.com",
        "time": "Sat Aug 29 05:12:18 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 29 05:12:18 2026 +0000"
      },
      "message": "fix: generate publish wheels for target platforms (#4007)\n\nSummary:\n- Configure publish deps for a static list of platforms instead of host\nplatform.\n- Add changelog and update lockfile.\n\nThis solves two issues:\n- The lock file could be different on different platforms.\n- The publish deps behave not as expected in RBE scenarios.\n\nFixes #3911\n\n---------\n\nCo-authored-by: Ignas Anikevicius \u003c240938+aignas@users.noreply.github.com\u003e"
    },
    {
      "commit": "3da7faf4293499b6398a924583dc4a3beda1c4a3",
      "tree": "947fd88e6c969dbbe1a5627f3f964939bb149a31",
      "parents": [
        "11a3ec34164d7955ea945f8b05d4a7051603b704"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 29 02:40:48 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 29 02:40:48 2026 +0000"
      },
      "message": "fix(zipapp): guard against null runtime files (#4119)\n\nWhen building a zipapp archive with a Python runtime whose \\`files\\`\nattribute is \\`None\\` (such as a system interpreter), adding\n\\`py_runtime.files\\` to the runfiles builder raises an error.\n\nOnly add \\`py_runtime.files\\` to the runfiles builder when it is not\n\\`None\\`."
    },
    {
      "commit": "11a3ec34164d7955ea945f8b05d4a7051603b704",
      "tree": "7f51af324684341ec4bbe7fa71a1893d612f8c9d",
      "parents": [
        "533d866ce06db1f02f9bb94c6d0307b01c57c2fd"
      ],
      "author": {
        "name": "Peter Hawkins",
        "email": "hawkinsp@cs.stanford.edu",
        "time": "Fri Aug 28 20:38:36 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 20:38:36 2026 +0000"
      },
      "message": "feat: Update CPython 3.15.0 from -a8 to -rc1. (#4122)\n\nMost users will want -rc1 to build ABI stable wheels.\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "533d866ce06db1f02f9bb94c6d0307b01c57c2fd",
      "tree": "226a287fcbaf7bc25e2f941c3e7003c62e856b71",
      "parents": [
        "397cba7b8d385d1e2f036decfda0cbf7fdb33edc"
      ],
      "author": {
        "name": "ANISAYAK MITRA",
        "email": "266799942+anisayakmitra-in@users.noreply.github.com",
        "time": "Fri Aug 28 09:04:23 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 09:04:23 2026 +0000"
      },
      "message": "feat(gazelle): support generic manifest lockfiles (#4117)\n\nAdds a format-agnostic lockfiles argument to gazelle_python_manifest and\ndeprecates requirements.\n\nThis lets callers use uv.lock or any dependency lockfile as the manifest\nintegrity input. The existing build-file-generation example now\nexercises lockfiles.\n\nFixes #4111.\n\nThe macro rejects specifying both arguments so existing requirements\nusers can migrate without ambiguity."
    },
    {
      "commit": "397cba7b8d385d1e2f036decfda0cbf7fdb33edc",
      "tree": "52f09469b58f764cf8136531954bdd7438035250",
      "parents": [
        "47e18b1f000f8566519fb7fc750e941591e78560"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Aug 27 18:27:01 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 18:27:01 2026 -0700"
      },
      "message": "agents: add Windows shebang RECORD rewriting and PR metadata discrepancy rules (#4118)\n\nDocument agent workflow rules for Windows wheel installation and PR\nmetadata management.\n\nAgents need explicit guidance when rewriting Windows wheel scripts to\navoid misidentifying wrapper scripts in RECORD files, and must not\nsilently alter PR metadata without user confirmation.\n\nSpecify that Windows shebang scripts are rewritten as .bat wrapper\nscripts and only those scripts receive .bat extensions in RECORD files.\nRequire agents to notify users and seek confirmation before updating\ndivergent PR metadata on GitHub."
    },
    {
      "commit": "47e18b1f000f8566519fb7fc750e941591e78560",
      "tree": "0cfd62db333799c13698fef2fb5df0a38dc3837a",
      "parents": [
        "3821f833fb1946757adbc4ba17e7bd3e96d681dd"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 28 00:15:22 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 00:15:22 2026 +0000"
      },
      "message": "fix(pypi): append .bat extension for rewritten shebang scripts in RECORD on Windows (#4114)\n\nOn Windows, wheel scripts with Python shebangs are rewritten as .bat\nwrappers, but the generated RECORD file retained extensionless script\npaths. This caused importlib.metadata file resolution and RECORD\nverification to fail when locating installed scripts.\n\nPass the list of rewritten scripts from whl_library_srcs to\ngen_wheel_record and update the RECORD rewriters to append .bat only to\nthose rewritten script entries on Windows.\n\n* Migrate importlib_metadata_test to pytest_test across Python 3.10-3.14\n  and add Windows .bat verification."
    },
    {
      "commit": "3821f833fb1946757adbc4ba17e7bd3e96d681dd",
      "tree": "ec554e38f9b7641040f6a3bd1a4649ea5f2544d3",
      "parents": [
        "c953e5e96b2b7fb4a7adcfdfd55d686f7a30fbc9"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Aug 27 00:18:16 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 00:18:16 2026 -0700"
      },
      "message": "agents: add VERSION_NEXT_PATCH docs rule and Strunk \u0026 White PR guidelines (#4116)\n\nAgent guidelines lacked explicit instructions for versioning bug fixes\nin documentation and allowed verbose, passive pull request descriptions.\n\nDocument using `VERSION_NEXT_PATCH` for bug fixes and patch-level\nbehavioral adjustments in `{versionchanged}` directives. Direct agents\nto apply Strunk \u0026 White conciseness and active phrasing when authoring\nPR descriptions."
    },
    {
      "commit": "c953e5e96b2b7fb4a7adcfdfd55d686f7a30fbc9",
      "tree": "40a6aa002e71222d01b6284e5ea12275fff55dcb",
      "parents": [
        "f323d06a702c1240bb92d597eb851498b16ce571"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Aug 26 07:56:55 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 26 07:56:55 2026 +0000"
      },
      "message": "fix(precompile): skip precompilation for directory and pyc inputs in srcs (#4113)\n\nPrecompiling `py_library`, `py_binary`, or `py_test` targets fails when\n`srcs` contains directory artifacts or `.pyc` files. The precompiler\ndeclares invalid actions on directories and drops non-`.py` sources from\ndefault outputs.\n\nThis change:\n* Expands direct sources to include Python files, `.pyc` files, and\n  directories.\n* Skips precompilation for directories and non-Python files while\n  retaining them in default outputs.\n* Updates `srcs` validation and documentation.\n\n---------\n\nCo-authored-by: Ignas Anikevicius \u003c240938+aignas@users.noreply.github.com\u003e"
    },
    {
      "commit": "f323d06a702c1240bb92d597eb851498b16ce571",
      "tree": "4142443d035784fb6ecffd6e3516ea6f6c2d5bd6",
      "parents": [
        "6bc555d10e5f45747a93e67ff06f53e157b9762f"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Tue Aug 25 07:16:55 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 07:16:55 2026 +0000"
      },
      "message": "feat(pypi): allow defining deps in through pkg_aliases macro (#4105)\n\nSummary:\n- If `requires_dist` are passed we create a `py_library` using the\n  aliased `srcs` target.\n- Currently this is only exercised by tests.\n\nSplit out of #4059"
    },
    {
      "commit": "6bc555d10e5f45747a93e67ff06f53e157b9762f",
      "tree": "4ea8c7e06408dd7ce9ca468ac7ecdc7dfc96c738",
      "parents": [
        "34ce2115785e613d2526cb0bd02dae44569a430d"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 24 23:31:04 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 23:31:04 2026 -0700"
      },
      "message": "agents: add external PR push guidance, refactor commit type, and fix news frontmatter (#4112)\n\nImprove agent guidance and rule syntax consistency when working with\nexternal PR branches, internal refactoring changes, and news file glob\nmatching.\n\n- Add explicit push instructions for checked-out external PR branches to\n  prevent accidental pushes to upstream or default remotes.\n- Document the `refactor:` commit and PR type for unreleased changes and\n  internal refactorings to keep commit logs accurate.\n- Correct the news rule frontmatter syntax to use glob triggering and\n  clarify that news entries should be omitted for unreleased code."
    },
    {
      "commit": "34ce2115785e613d2526cb0bd02dae44569a430d",
      "tree": "eb787fc7ff55508e52c781a925b6c81f6b1351a0",
      "parents": [
        "ae076cfe626925a25b8e28d1fbaa60d368663da5"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Mon Aug 24 16:01:52 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 24 16:01:52 2026 +0000"
      },
      "message": "fix: various fixes for the deps library (#4106)\n\nCorrectly wire args around and disable precompiling\nfor the deps nodes.\n\nWork towards #2948\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "ae076cfe626925a25b8e28d1fbaa60d368663da5",
      "tree": "af898c70b82eb2ebf9db223b1e5240ab3e34e2a3",
      "parents": [
        "7e6afb296bf3e4a969dbd8f56a4c330ea4fc3db8"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 23 15:56:21 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 15:56:21 2026 -0700"
      },
      "message": "agents: add Windows lockfile migration and Gazelle manifest rules (#4109)\n\nClarify lockfile maintenance rules to prevent Windows CI failures when\nmigrating requirement inputs and updating Gazelle manifests.\n\nAdd explicit instructions to .agents/rules/lockfiles.md requiring # via\nprovenance updates in Windows lockfiles when migrating input files, and\nrequiring manifest updates via gazelle_python_manifest.update after\nmodifying requirements."
    },
    {
      "commit": "7e6afb296bf3e4a969dbd8f56a4c330ea4fc3db8",
      "tree": "b46d017ee3aba72ec270a43977c542da6d6c59e5",
      "parents": [
        "7dc0e647fcb6dc42adbd7ac1dc54a9bcc2822e27"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 23 15:47:55 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 15:47:55 2026 -0700"
      },
      "message": "agents: document runtime version checks and multi-version pytest_test bzlmod rules (#4108)\n\nWORKSPACE mode resolves pip dependencies for only the host Python\nversion, causing multi-version pytest targets to fail when executed\nagainst non-host interpreters. Additionally, relying on static type\nignore comments in version-dependent code obscures actual runtime\ncompatibility requirements across supported Python releases.\n\nTo address this, agent guidelines are updated to require explicit\nruntime Python version checks instead of static type ignores, and to\nrestrict multi-version pytest_test targets to Bzlmod mode using\nSUPPORTS_BZLMOD. The allowed PR commit prefixes are also updated to\ninclude agents: for changes to agent rules and prompts."
    },
    {
      "commit": "7dc0e647fcb6dc42adbd7ac1dc54a9bcc2822e27",
      "tree": "05d078d1570b2334e49e603f3e8245179226773a",
      "parents": [
        "b28a81307c8290e779df4cf1d093e7d129748571"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 23 15:41:06 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 15:41:06 2026 -0700"
      },
      "message": "agents: add constraint synchronization rule for dependency bumps (#4107)\n\nWhen dependencies are bumped, hardcoded version pins in constraint\nfiles can conflict with newly resolved requirements and cause lockfile\nupdate targets to fail.\n\nTo prevent these conflicts, expand the lockfile and dependency agent\nrules to trigger on constraint files and instruct agents to update any\nconflicting constraint pins and rerun affected update targets during\ndependency updates."
    },
    {
      "commit": "b28a81307c8290e779df4cf1d093e7d129748571",
      "tree": "ae769042fba153128b00caf22367ed9636738759",
      "parents": [
        "0c23701223222ef916e80b4cf85c3ded2c54bfb0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Aug 23 18:52:45 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 18:52:45 2026 +0000"
      },
      "message": "build(deps): bump the pip group across 1 directory with 3 updates (#4102)\n\nBumps the pip group with 3 updates in the /tests/uv/lock/pyproject_toml\ndirectory: [idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.3 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.32.3...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.3.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/2.3.0...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "0c23701223222ef916e80b4cf85c3ded2c54bfb0",
      "tree": "dd28406c12bb8cfbd43f2d387e8e7be4b25a2eb9",
      "parents": [
        "c758673fd321f30b9a264f38b1ed3da1915f2cef"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 23 07:49:25 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 07:49:25 2026 +0000"
      },
      "message": "fix(runfiles): update Path method signatures for Python 3.14 compatibility and fix match() (#4100)\n\nAlign runfiles.Path method signatures with Python 3.14 typeshed stubs to\navoid type checker errors on newer Python releases. This also fixes a\nbug where pattern matching failed on Python 3.12+.\n\nThis change splits the runfiles compatibility updates from PR #4023."
    },
    {
      "commit": "c758673fd321f30b9a264f38b1ed3da1915f2cef",
      "tree": "b2903272d51bb638062cfd845366c1c42e29eab2",
      "parents": [
        "0a7d10819586e9b60b6567bc4bc70687697e3e57"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 23 07:43:44 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 07:43:44 2026 +0000"
      },
      "message": "chore: migrate requirements.in files to pyproject.toml (#4099)\n\nStandardize Python dependency declarations across tools, examples, and\ntests to use standard pyproject.toml configuration instead of\nrequirements.in files.\n\nReplace requirements.in inputs with pyproject.toml, update corresponding\nBUILD.bazel and documentation references, and regenerate all associated\nrequirement lockfiles and Gazelle manifests."
    },
    {
      "commit": "0a7d10819586e9b60b6567bc4bc70687697e3e57",
      "tree": "74221bd4f822e149ddfd69c904f11c35b898e306",
      "parents": [
        "13a5e40cc1d21a4746cbbd9197041d66b1c64dff"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Sun Aug 23 06:51:37 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 06:51:37 2026 +0000"
      },
      "message": "refactor(pypi): split whl_library_targets (#4101)\n\nSummary:\n- Split the macros into 2 separate files for easier management.\n- Split the tests for each macro as well.\n\nWork towards #2948\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "13a5e40cc1d21a4746cbbd9197041d66b1c64dff",
      "tree": "e87b840ad9bd101af88910edb47295214c64a3ce",
      "parents": [
        "c557a87e3fe2b31ecfe3960e1feee3326d500fb1"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 22 23:24:38 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 23:24:38 2026 -0700"
      },
      "message": "agents: add lockfile and dependency bump rule (#4103)\n\nAutomated dependency bumps and manual lockfile updates often miss\nplatform-specific lockfile invariants, such as preserving Windows\nrequirements entries, and overlook necessary follow-up updates to wheel\noverrides, patch files, and test assertions.\n\nAdd a glob-triggered agent rule for uv.lock and requirements.txt files\nthat documents lockfile regeneration commands, enforces Windows lockfile\npreservation, and lists required synchronization steps when dependencies\nare bumped."
    },
    {
      "commit": "c557a87e3fe2b31ecfe3960e1feee3326d500fb1",
      "tree": "a54f7eb6905acae040e6f2c874d4b7dfe29620e0",
      "parents": [
        "da7e041f99586b16dc159147f8968e70ab2375d3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Aug 23 05:47:23 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 05:47:23 2026 +0000"
      },
      "message": "build(deps): bump the pip group across 5 directories with 5 updates (#4097)\n\nBumps the pip group with 2 updates in the /examples/bzlmod directory:\n[certifi](https://github.com/certifi/python-certifi) and\n[wheel](https://github.com/pypa/wheel).\nBumps the pip group with 3 updates in the /examples/pip_parse directory:\n[idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /tests/multiple_inputs\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 3 updates in the /tests/uv/lock/pyproject_toml\ndirectory: [idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 3 updates in the /tests/uv/lock/workspaces\ndirectory: [idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `wheel` from 0.40.0 to 0.46.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/wheel/releases\"\u003ewheel\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.46.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with\n\u003ccode\u003esetuptools\u003c/code\u003e older than v70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e instead of a\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions\nof files outside of the destination tree with maliciously crafted wheels\n(CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.46.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTemporarily restored the \u003ccode\u003ewheel.macosx_libfile\u003c/code\u003e module\n(\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/659\"\u003e#659\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.46.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.8\u003c/li\u003e\n\u003cli\u003eRemoved the \u003ccode\u003ebdist_wheel\u003c/code\u003e setuptools command\nimplementation and entry point. The \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e\nmodule is now just an alias to\n\u003ccode\u003esetuptools.command.bdist_wheel\u003c/code\u003e, emitting a deprecation\nwarning on import.\u003c/li\u003e\n\u003cli\u003eRemoved vendored \u003ccode\u003epackaging\u003c/code\u003e in favor of a run-time\ndependency on it\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.metadata\u003c/code\u003e module private (with a\ndeprecation warning if it\u0027s imported\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.cli\u003c/code\u003e package private (no deprecation\nwarning)\u003c/li\u003e\n\u003cli\u003eFixed an exception when calling the \u003ccode\u003econvert\u003c/code\u003e command\nwith an empty description field\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.45.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed pure Python wheels converted from eggs and wininst files\nhaving the ABI tag in the file name\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.45.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eRefactored the \u003ccode\u003econvert\u003c/code\u003e command to not need setuptools to\nbe installed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDon\u0027t configure setuptools logging unless running\n\u003ccode\u003ebdist_wheel\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded a redirection from \u003ccode\u003ewheel.bdist_wheel.bdist_wheel\u003c/code\u003e\nto \u003ccode\u003esetuptools.command.bdist_wheel.bdist_wheel\u003c/code\u003e to improve\ncompatibility with \u003ccode\u003esetuptools\u003c/code\u003e\u0027 latest fixes.\u003c/p\u003e\n\u003cp\u003eProjects are still advised to migrate away from the deprecated module\nand import the \u003ccode\u003esetuptools\u003c/code\u003e\u0027 implementation explicitly. (PR\nby \u003ca\nhref\u003d\"https://github.com/abravalheri\"\u003e\u003ccode\u003e@​abravalheri\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.44.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCanonicalized requirements in METADATA file (PR by Wim\nJeantine-Glenn)\u003c/li\u003e\n\u003cli\u003eDeprecated the \u003ccode\u003ebdist_wheel\u003c/code\u003e module, as the code was\nmigrated to \u003ccode\u003esetuptools\u003c/code\u003e itself\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.43.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.7\u003c/li\u003e\n\u003cli\u003eUpdated vendored \u003ccode\u003epackaging\u003c/code\u003e to 24.0\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.42.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAllowed removing build tag with \u003ccode\u003ewheel tags --build\n\u0026quot;\u0026quot;\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel pack\u003c/code\u003e and \u003ccode\u003ewheel tags\u003c/code\u003e writing\nupdated \u003ccode\u003eWHEEL\u003c/code\u003e fields after a blank line, causing other\ntools to ignore them\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel pack\u003c/code\u003e and \u003ccode\u003ewheel tags\u003c/code\u003e writing\n\u003ccode\u003eWHEEL\u003c/code\u003e with CRLF line endings or a mix of CRLF and LF\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel pack --build-number \u0026quot;\u0026quot;\u003c/code\u003e not\nremoving build tag from \u003ccode\u003eWHEEL\u003c/code\u003e (above changes by Benjamin\nGilbert)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.41.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated vendored \u003ccode\u003epackaging\u003c/code\u003e to 23.2\u003c/li\u003e\n\u003cli\u003eFixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam\nGross)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/wheel/blob/main/docs/news.rst\"\u003ewheel\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease Notes\u003c/h1\u003e\n\u003cp\u003e\u003cstrong\u003eUNRELEASED\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed the macOS platform-tag warning always using the plural\n\u0026quot;these files\u0026quot;\nwording, even when only a single library required a higher deployment\ntarget\n(\u003ccode\u003e[#697](https://github.com/pypa/wheel/issues/697)\n\u0026lt;https://github.com/pypa/wheel/pull/697\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.48.0 (2026-08-12)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded a \u003ccode\u003e--local-version\u003c/code\u003e option to \u003ccode\u003ewheel\npack\u003c/code\u003e to add, replace, or remove a\nPEP 440 local version identifier from a wheel\n(\u003ccode\u003e[#570](https://github.com/pypa/wheel/issues/570)\n\u0026lt;https://github.com/pypa/wheel/issues/570\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel convert\u003c/code\u003e unnecessarily upgrading compatible\ncore metadata versions\n(\u003ccode\u003e[#643](https://github.com/pypa/wheel/issues/643)\n\u0026lt;https://github.com/pypa/wheel/issues/643\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel tags\u003c/code\u003e producing invalid archives when\nretagging wheels whose\nentries use ZIP64, by dropping the central-directory ZIP64 extra field\nthat is\nnot valid in a local file header\n(\u003ccode\u003e[#692](https://github.com/pypa/wheel/issues/692)\n\u0026lt;https://github.com/pypa/wheel/issues/692\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel convert\u003c/code\u003e writing the converted wheel outside\nthe destination\ndirectory when the input archive contained a maliciously crafted project\nname\nor version with path separators (arbitrary file write / path traversal)\n(\u003ccode\u003eGHSA-vgq5-9859-3mmw\n\u0026lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.47.0 (2026-04-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded the \u003ccode\u003ewheel info\u003c/code\u003e subcommand to display metadata\nabout wheel files without\nunpacking them (\u003ccode\u003e[#639](https://github.com/pypa/wheel/issues/639)\n\u0026lt;https://github.com/pypa/wheel/issues/639\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eWheelFile\u003c/code\u003e raising \u003ccode\u003eMissing RECORD\nfile\u003c/code\u003e when the wheel filename contains\nuppercase characters (e.g. \u003ccode\u003eDjango-3.2.5.whl\u003c/code\u003e) but the\n\u003ccode\u003e.dist-info\u003c/code\u003e directory\ninside uses normalized lowercase naming\n(\u003ccode\u003e[#411](https://github.com/pypa/wheel/issues/411)\n\u0026lt;https://github.com/pypa/wheel/issues/411\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.3 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed \u003ccode\u003eImportError: cannot import name \u0027_setuptools_logging\u0027\nfrom \u0027wheel\u0027\u003c/code\u003e when\ninstalled alongside an old version of setuptools and running the\n\u003ccode\u003ebdist_wheel\u003c/code\u003e\ncommand (\u003ccode\u003e[#676](https://github.com/pypa/wheel/issues/676)\n\u0026lt;https://github.com/pypa/wheel/issues/676\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.2 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with\n\u003ccode\u003esetuptools\u003c/code\u003e older than\nv70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e instead of a\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions\nof files outside of the\ndestination tree with maliciously crafted wheels (CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.1 (2025-04-08)\u003c/strong\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/eba4036ccaca4e2d0c5b5bf3e3be59b2b2877d6b\"\u003e\u003ccode\u003eeba4036\u003c/code\u003e\u003c/a\u003e\nUpdated the version number for v0.46.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/557fb5425036ccca95330b2c8875e54c9f4483cf\"\u003e\u003ccode\u003e557fb54\u003c/code\u003e\u003c/a\u003e\nCreated a new release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef\"\u003e\u003ccode\u003e7a7d2de\u003c/code\u003e\u003c/a\u003e\nFixed security issue around wheel unpack (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/675\"\u003e#675\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/41418fac233d6973ea8798d620df4aa5b3aa1b66\"\u003e\u003ccode\u003e41418fa\u003c/code\u003e\u003c/a\u003e\nFixed test failures due to metadata normalization changes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/c1d442bec6c634fcfb89e5d58698dd226685bd14\"\u003e\u003ccode\u003ec1d442b\u003c/code\u003e\u003c/a\u003e\n[pre-commit.ci] pre-commit autoupdate (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/674\"\u003e#674\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/0bac8820ec90b1aaa0695d79a56563137b48686d\"\u003e\u003ccode\u003e0bac882\u003c/code\u003e\u003c/a\u003e\nUpdate github actions environments (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/673\"\u003e#673\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/be9f45b4ee1210b2a815d2eefea56b71efd99d63\"\u003e\u003ccode\u003ebe9f45b\u003c/code\u003e\u003c/a\u003e\n[pre-commit.ci] pre-commit autoupdate (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/667\"\u003e#667\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/6244f08bb92d7569da6c2fbea23de0846ad34ff3\"\u003e\u003ccode\u003e6244f08\u003c/code\u003e\u003c/a\u003e\nUpdate pre-commit ruff legacy alias (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/668\"\u003e#668\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/15b7577654e8bcd23e009c6bac036b65c11d8d8f\"\u003e\u003ccode\u003e15b7577\u003c/code\u003e\u003c/a\u003e\nPEP 639 compliance (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/670\"\u003e#670\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/fc8cb4163e4f48d86092cb2a16076f1b3efcd10f\"\u003e\u003ccode\u003efc8cb41\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Removed redundant Python version from the publish workflow\n(\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/666\"\u003e#666\u003c/a\u003e)\u0026quot;\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pypa/wheel/compare/0.40.0...0.46.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.25.1...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.20 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.20 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003c...\n\n_Description has been truncated_\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "da7e041f99586b16dc159147f8968e70ab2375d3",
      "tree": "a54f7eb6905acae040e6f2c874d4b7dfe29620e0",
      "parents": [
        "3b99ebcb25b8a2192d2ba1eac163ad7065884dad"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Aug 23 05:46:37 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 05:46:37 2026 +0000"
      },
      "message": "build(deps): bump the uv group across 5 directories with 5 updates (#4098)\n\nBumps the uv group with 2 updates in the /examples/bzlmod directory:\n[certifi](https://github.com/certifi/python-certifi) and\n[wheel](https://github.com/pypa/wheel).\nBumps the uv group with 3 updates in the /examples/pip_parse directory:\n[idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the uv group with 1 update in the /tests/multiple_inputs\ndirectory: [urllib3](https://github.com/urllib3/urllib3).\nBumps the uv group with 3 updates in the /tests/uv/lock/pyproject_toml\ndirectory: [idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the uv group with 3 updates in the /tests/uv/lock/workspaces\ndirectory: [idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `wheel` from 0.40.0 to 0.46.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/wheel/releases\"\u003ewheel\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.46.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with\n\u003ccode\u003esetuptools\u003c/code\u003e older than v70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e instead of a\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions\nof files outside of the destination tree with maliciously crafted wheels\n(CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.46.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTemporarily restored the \u003ccode\u003ewheel.macosx_libfile\u003c/code\u003e module\n(\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/659\"\u003e#659\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.46.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.8\u003c/li\u003e\n\u003cli\u003eRemoved the \u003ccode\u003ebdist_wheel\u003c/code\u003e setuptools command\nimplementation and entry point. The \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e\nmodule is now just an alias to\n\u003ccode\u003esetuptools.command.bdist_wheel\u003c/code\u003e, emitting a deprecation\nwarning on import.\u003c/li\u003e\n\u003cli\u003eRemoved vendored \u003ccode\u003epackaging\u003c/code\u003e in favor of a run-time\ndependency on it\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.metadata\u003c/code\u003e module private (with a\ndeprecation warning if it\u0027s imported\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.cli\u003c/code\u003e package private (no deprecation\nwarning)\u003c/li\u003e\n\u003cli\u003eFixed an exception when calling the \u003ccode\u003econvert\u003c/code\u003e command\nwith an empty description field\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.45.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed pure Python wheels converted from eggs and wininst files\nhaving the ABI tag in the file name\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.45.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eRefactored the \u003ccode\u003econvert\u003c/code\u003e command to not need setuptools to\nbe installed\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDon\u0027t configure setuptools logging unless running\n\u003ccode\u003ebdist_wheel\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded a redirection from \u003ccode\u003ewheel.bdist_wheel.bdist_wheel\u003c/code\u003e\nto \u003ccode\u003esetuptools.command.bdist_wheel.bdist_wheel\u003c/code\u003e to improve\ncompatibility with \u003ccode\u003esetuptools\u003c/code\u003e\u0027 latest fixes.\u003c/p\u003e\n\u003cp\u003eProjects are still advised to migrate away from the deprecated module\nand import the \u003ccode\u003esetuptools\u003c/code\u003e\u0027 implementation explicitly. (PR\nby \u003ca\nhref\u003d\"https://github.com/abravalheri\"\u003e\u003ccode\u003e@​abravalheri\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.44.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCanonicalized requirements in METADATA file (PR by Wim\nJeantine-Glenn)\u003c/li\u003e\n\u003cli\u003eDeprecated the \u003ccode\u003ebdist_wheel\u003c/code\u003e module, as the code was\nmigrated to \u003ccode\u003esetuptools\u003c/code\u003e itself\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.43.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.7\u003c/li\u003e\n\u003cli\u003eUpdated vendored \u003ccode\u003epackaging\u003c/code\u003e to 24.0\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.42.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAllowed removing build tag with \u003ccode\u003ewheel tags --build\n\u0026quot;\u0026quot;\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel pack\u003c/code\u003e and \u003ccode\u003ewheel tags\u003c/code\u003e writing\nupdated \u003ccode\u003eWHEEL\u003c/code\u003e fields after a blank line, causing other\ntools to ignore them\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel pack\u003c/code\u003e and \u003ccode\u003ewheel tags\u003c/code\u003e writing\n\u003ccode\u003eWHEEL\u003c/code\u003e with CRLF line endings or a mix of CRLF and LF\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel pack --build-number \u0026quot;\u0026quot;\u003c/code\u003e not\nremoving build tag from \u003ccode\u003eWHEEL\u003c/code\u003e (above changes by Benjamin\nGilbert)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.41.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated vendored \u003ccode\u003epackaging\u003c/code\u003e to 23.2\u003c/li\u003e\n\u003cli\u003eFixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam\nGross)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/wheel/blob/main/docs/news.rst\"\u003ewheel\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease Notes\u003c/h1\u003e\n\u003cp\u003e\u003cstrong\u003eUNRELEASED\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed the macOS platform-tag warning always using the plural\n\u0026quot;these files\u0026quot;\nwording, even when only a single library required a higher deployment\ntarget\n(\u003ccode\u003e[#697](https://github.com/pypa/wheel/issues/697)\n\u0026lt;https://github.com/pypa/wheel/pull/697\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.48.0 (2026-08-12)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded a \u003ccode\u003e--local-version\u003c/code\u003e option to \u003ccode\u003ewheel\npack\u003c/code\u003e to add, replace, or remove a\nPEP 440 local version identifier from a wheel\n(\u003ccode\u003e[#570](https://github.com/pypa/wheel/issues/570)\n\u0026lt;https://github.com/pypa/wheel/issues/570\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel convert\u003c/code\u003e unnecessarily upgrading compatible\ncore metadata versions\n(\u003ccode\u003e[#643](https://github.com/pypa/wheel/issues/643)\n\u0026lt;https://github.com/pypa/wheel/issues/643\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel tags\u003c/code\u003e producing invalid archives when\nretagging wheels whose\nentries use ZIP64, by dropping the central-directory ZIP64 extra field\nthat is\nnot valid in a local file header\n(\u003ccode\u003e[#692](https://github.com/pypa/wheel/issues/692)\n\u0026lt;https://github.com/pypa/wheel/issues/692\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel convert\u003c/code\u003e writing the converted wheel outside\nthe destination\ndirectory when the input archive contained a maliciously crafted project\nname\nor version with path separators (arbitrary file write / path traversal)\n(\u003ccode\u003eGHSA-vgq5-9859-3mmw\n\u0026lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.47.0 (2026-04-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded the \u003ccode\u003ewheel info\u003c/code\u003e subcommand to display metadata\nabout wheel files without\nunpacking them (\u003ccode\u003e[#639](https://github.com/pypa/wheel/issues/639)\n\u0026lt;https://github.com/pypa/wheel/issues/639\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eWheelFile\u003c/code\u003e raising \u003ccode\u003eMissing RECORD\nfile\u003c/code\u003e when the wheel filename contains\nuppercase characters (e.g. \u003ccode\u003eDjango-3.2.5.whl\u003c/code\u003e) but the\n\u003ccode\u003e.dist-info\u003c/code\u003e directory\ninside uses normalized lowercase naming\n(\u003ccode\u003e[#411](https://github.com/pypa/wheel/issues/411)\n\u0026lt;https://github.com/pypa/wheel/issues/411\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.3 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed \u003ccode\u003eImportError: cannot import name \u0027_setuptools_logging\u0027\nfrom \u0027wheel\u0027\u003c/code\u003e when\ninstalled alongside an old version of setuptools and running the\n\u003ccode\u003ebdist_wheel\u003c/code\u003e\ncommand (\u003ccode\u003e[#676](https://github.com/pypa/wheel/issues/676)\n\u0026lt;https://github.com/pypa/wheel/issues/676\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.2 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with\n\u003ccode\u003esetuptools\u003c/code\u003e older than\nv70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a\n\u003ccode\u003eFutureWarning\u003c/code\u003e instead of a\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions\nof files outside of the\ndestination tree with maliciously crafted wheels (CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.1 (2025-04-08)\u003c/strong\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/eba4036ccaca4e2d0c5b5bf3e3be59b2b2877d6b\"\u003e\u003ccode\u003eeba4036\u003c/code\u003e\u003c/a\u003e\nUpdated the version number for v0.46.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/557fb5425036ccca95330b2c8875e54c9f4483cf\"\u003e\u003ccode\u003e557fb54\u003c/code\u003e\u003c/a\u003e\nCreated a new release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef\"\u003e\u003ccode\u003e7a7d2de\u003c/code\u003e\u003c/a\u003e\nFixed security issue around wheel unpack (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/675\"\u003e#675\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/41418fac233d6973ea8798d620df4aa5b3aa1b66\"\u003e\u003ccode\u003e41418fa\u003c/code\u003e\u003c/a\u003e\nFixed test failures due to metadata normalization changes\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/c1d442bec6c634fcfb89e5d58698dd226685bd14\"\u003e\u003ccode\u003ec1d442b\u003c/code\u003e\u003c/a\u003e\n[pre-commit.ci] pre-commit autoupdate (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/674\"\u003e#674\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/0bac8820ec90b1aaa0695d79a56563137b48686d\"\u003e\u003ccode\u003e0bac882\u003c/code\u003e\u003c/a\u003e\nUpdate github actions environments (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/673\"\u003e#673\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/be9f45b4ee1210b2a815d2eefea56b71efd99d63\"\u003e\u003ccode\u003ebe9f45b\u003c/code\u003e\u003c/a\u003e\n[pre-commit.ci] pre-commit autoupdate (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/667\"\u003e#667\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/6244f08bb92d7569da6c2fbea23de0846ad34ff3\"\u003e\u003ccode\u003e6244f08\u003c/code\u003e\u003c/a\u003e\nUpdate pre-commit ruff legacy alias (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/668\"\u003e#668\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/15b7577654e8bcd23e009c6bac036b65c11d8d8f\"\u003e\u003ccode\u003e15b7577\u003c/code\u003e\u003c/a\u003e\nPEP 639 compliance (\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/670\"\u003e#670\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/wheel/commit/fc8cb4163e4f48d86092cb2a16076f1b3efcd10f\"\u003e\u003ccode\u003efc8cb41\u003c/code\u003e\u003c/a\u003e\nRevert \u0026quot;Removed redundant Python version from the publish workflow\n(\u003ca\nhref\u003d\"https://redirect.github.com/pypa/wheel/issues/666\"\u003e#666\u003c/a\u003e)\u0026quot;\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pypa/wheel/compare/0.40.0...0.46.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2023.7.22 to 2024.7.4\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463\"\u003e\u003ccode\u003ebd81538\u003c/code\u003e\u003c/a\u003e\n2024.07.04 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/295\"\u003e#295\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3\"\u003e\u003ccode\u003e06a2cbf\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/294\"\u003e#294\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23\"\u003e\u003ccode\u003e13bba02\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/293\"\u003e#293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554\"\u003e\u003ccode\u003ee8abcd0\u003c/code\u003e\u003c/a\u003e\nBump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/292\"\u003e#292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1\"\u003e\u003ccode\u003e124f4ad\u003c/code\u003e\u003c/a\u003e\n2024.06.02 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/291\"\u003e#291\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a\"\u003e\u003ccode\u003ec2196ce\u003c/code\u003e\u003c/a\u003e\n--- (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/290\"\u003e#290\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2\"\u003e\u003ccode\u003efefdeec\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.4 to 4.1.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/289\"\u003e#289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf\"\u003e\u003ccode\u003e3c5fb15\u003c/code\u003e\u003c/a\u003e\nBump actions/download-artifact from 4.1.6 to 4.1.7 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1\"\u003e\u003ccode\u003e4a9569a\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 4.1.2 to 4.1.4 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/287\"\u003e#287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3\"\u003e\u003ccode\u003e1fc8086\u003c/code\u003e\u003c/a\u003e\nBump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (\u003ca\nhref\u003d\"https://redirect.github.com/certifi/python-certifi/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.25.1...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.20 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.20 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/kj...\n\n_Description has been truncated_\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "3b99ebcb25b8a2192d2ba1eac163ad7065884dad",
      "tree": "2d0bbe3f186be646cda39879061f3f983ccaaaee",
      "parents": [
        "4a64b37937a0d656d2c36b5da8a620361cdb72cc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Aug 23 03:07:48 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 03:07:48 2026 +0000"
      },
      "message": "build(deps): bump the pip group across 3 directories with 7 updates (#4096)\n\nBumps the pip group with 3 updates in the /examples/bzlmod directory:\n[idna](https://github.com/kjd/idna),\n[requests](https://github.com/psf/requests) and\n[urllib3](https://github.com/urllib3/urllib3).\nBumps the pip group with 1 update in the /examples/wheel directory:\n[pip](https://github.com/pypa/pip).\nBumps the pip group with 6 updates in the\n/gazelle/examples/bzlmod_build_file_generation directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [idna](https://github.com/kjd/idna) | `2.10` | `3.15` |\n| [requests](https://github.com/psf/requests) | `2.25.1` | `2.33.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `1.26.13` | `2.7.0` |\n| [django](https://github.com/django/django) | `4.2.20` | `5.2.16` |\n| [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.5.2` |\n`0.6.0` |\n| [setuptools](https://github.com/pypa/setuptools) | `65.6.3` | `83.0.0`\n|\n\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.25.1...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.18 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.18...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pip` from 24.0 to 26.1.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/pip/blob/main/NEWS.rst\"\u003epip\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e26.1.2 (2026-05-31)\u003c/h1\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject \u003ccode\u003econsole_scripts\u003c/code\u003e and \u003ccode\u003egui_scripts\u003c/code\u003e\nentry points whose name would\ninstall a script outside the scripts directory.\n(\u003ccode\u003e[#14000](https://github.com/pypa/pip/issues/14000)\n\u0026lt;https://github.com/pypa/pip/issues/14000\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFix installation incorrectly failing when the target path contains a\ndoubled\nslash, such as with \u003ccode\u003epip install --root //...\u003c/code\u003e.\n(\u003ccode\u003e[#14001](https://github.com/pypa/pip/issues/14001)\n\u0026lt;https://github.com/pypa/pip/issues/14001\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eSend a consistent \u003ccode\u003eAccept-Encoding\u003c/code\u003e header to avoid a\nspurious \u003ccode\u003eCache entry deserialization failed\u003c/code\u003e warning.\n(\u003ccode\u003e[#14012](https://github.com/pypa/pip/issues/14012)\n\u0026lt;https://github.com/pypa/pip/issues/14012\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e26.1.1 (2026-05-04)\u003c/h1\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where uninstallation left behind empty directories. Revert\nthe\nremoval of the adjacent \u003ccode\u003e__pycache__\u003c/code\u003e directory when a .py\nfile is removed.\n(\u003ccode\u003e[#13973](https://github.com/pypa/pip/issues/13973)\n\u0026lt;https://github.com/pypa/pip/issues/13973\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e26.1 (2026-04-26)\u003c/h1\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.9.\n(\u003ccode\u003e[#13795](https://github.com/pypa/pip/issues/13795)\n\u0026lt;https://github.com/pypa/pip/issues/13795\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd experimental support to read requirements from standardized\npylock.toml files (\u003ccode\u003e-r pylock.toml\u003c/code\u003e).\n(\u003ccode\u003e[#13876](https://github.com/pypa/pip/issues/13876)\n\u0026lt;https://github.com/pypa/pip/issues/13876\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003e--uploaded-prior-to\u003c/code\u003e to accept a duration in days\n(e.g., \u003ccode\u003eP3D\u003c/code\u003e for 3 days ago).\n(\u003ccode\u003e[#13674](https://github.com/pypa/pip/issues/13674)\n\u0026lt;https://github.com/pypa/pip/issues/13674\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eEnhancements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up dependency resolution when there are complex conflicts.\n(\u003ccode\u003e[#13859](https://github.com/pypa/pip/issues/13859)\n\u0026lt;https://github.com/pypa/pip/issues/13859\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eReduce memory usage when resolving large dependency trees.\n(\u003ccode\u003e[#13843](https://github.com/pypa/pip/issues/13843)\n\u0026lt;https://github.com/pypa/pip/issues/13843\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eEmit a deprecation warning when pip imports an unexpected module\nafter\ninstallation of a distribution has started.\n(\u003ccode\u003e[#13912](https://github.com/pypa/pip/issues/13912)\n\u0026lt;https://github.com/pypa/pip/issues/13912\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eAllow URL constraints to apply to requirements with extras.\n(\u003ccode\u003e[#12018](https://github.com/pypa/pip/issues/12018)\n\u0026lt;https://github.com/pypa/pip/issues/12018\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eAllow unpinned requirements to use hashes from constraints.\nConstraints\nlike \u003ccode\u003e{name}\u003d\u003d{version} --hash\u003d...\u003c/code\u003e feeds into hash\nverification for\na corresponding requirement.\n(\u003ccode\u003e[#9243](https://github.com/pypa/pip/issues/9243)\n\u0026lt;https://github.com/pypa/pip/issues/9243\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eImprove conflict reports that involve direct URLs.\n(\u003ccode\u003e[#13932](https://github.com/pypa/pip/issues/13932)\n\u0026lt;https://github.com/pypa/pip/issues/13932\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eShow all errors instead of first error for faulty\n\u003ccode\u003edependency_groups\u003c/code\u003e definitions.\n(\u003ccode\u003e[#13917](https://github.com/pypa/pip/issues/13917)\n\u0026lt;https://github.com/pypa/pip/issues/13917\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/31d7d168953668aad85154d6121879d07fbeac27\"\u003e\u003ccode\u003e31d7d16\u003c/code\u003e\u003c/a\u003e\nBump for release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/79f348c86a149adec5a9852788dcc13114b29d3c\"\u003e\u003ccode\u003e79f348c\u003c/code\u003e\u003c/a\u003e\nUpdate AUTHORS.txt\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/237a9258813636b7b1ead05e2cb0d509b44f67ee\"\u003e\u003ccode\u003e237a925\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14001\"\u003e#14001\u003c/a\u003e from\nnotatallshaw/fix-is-within-directory\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/34d0285d548bbd644bfabfede2dfabed23c240db\"\u003e\u003ccode\u003e34d0285\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14006\"\u003e#14006\u003c/a\u003e from\nlaymonage/fix-requirements_from_scripts-space-...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/09d3e07066c56e20b4ab2b3133e29f02f19be5e9\"\u003e\u003ccode\u003e09d3e07\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pypa/pip/issues/14012\"\u003e#14012\u003c/a\u003e from\nnotatallshaw/stable-accept-encoding\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/fa7854f6b37113a2c4698cdde902e1fcc9bebdd5\"\u003e\u003ccode\u003efa7854f\u003c/code\u003e\u003c/a\u003e\nUse is_within_directory for entry point check\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/d01b46c273e08bf4299feb81899c9bd0b3e7029b\"\u003e\u003ccode\u003ed01b46c\u003c/code\u003e\u003c/a\u003e\nNEWS ENTRY\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/7ff8bdd81ec5edca2bebf78ad8506dda710d6af5\"\u003e\u003ccode\u003e7ff8bdd\u003c/code\u003e\u003c/a\u003e\nFix is_within_directory for doubled-slash roots\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/7ea3466fb51ccc729e67ea85809df5a4dda1987b\"\u003e\u003ccode\u003e7ea3466\u003c/code\u003e\u003c/a\u003e\nNEWS ENTRY\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pypa/pip/commit/85673eaa109f343658f9904f4045ff009378ae08\"\u003e\u003ccode\u003e85673ea\u003c/code\u003e\u003c/a\u003e\nFix Accept-Encoding to gzip, deflate\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pypa/pip/compare/24.0...26.1.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 2.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/releases\"\u003eidna\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.15\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.14\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.13\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.12\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.11\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.10\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.9\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003ev3.8\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix regression where IDNAError exception was not being produced for\ncertain inputs.\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.13, drop support for Python 3.5 as it is no\nlonger testable.\u003c/li\u003e\n\u003cli\u003eDocumentation improvements\u003c/li\u003e\n\u003cli\u003eUpdates to package testing using Github actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Hugo van Kemenade for contributions to this release.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.7...v3.8\"\u003ehttps://github.com/kjd/idna/compare/v3.7...v3.8\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.7\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix issue where specially crafted inputs to encode() could take\nexceptionally long amount of time to process. [CVE-2024-3651]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Guido Vranken for reporting the issue.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v3.6...v3.7\"\u003ehttps://github.com/kjd/idna/compare/v3.6...v3.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in\n\u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining\nand\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e\nRelease 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e\nPre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from\nkjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e\nConvert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from\nkjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into\ndependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from\nStanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 3.35.2 to 4.35.2 in the actions\ngroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e\nMerge branch \u0027master\u0027 into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from\nStanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/kjd/idna/compare/v2.10...v3.15\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.25.1 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/releases\"\u003erequests\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat uses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report any gaps or feedback you may have in the\nissue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts contents to a non-deterministic location to prevent malicious\nfile replacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed\nauthentication to be applied to Requests on Python 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base\nthat\nuses Requests, please take a look at \u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e.\nGive it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now\nextracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has\ncreated\na new class of issues in Requests that have had negative impact across a\nnumber\nof use cases. The Requests team has decided to revert this feature as\nlong term\nmaintenance of it is proving to be unsustainable in its current\niteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and\ntrusted\nenvironment will retrieve credentials for the wrong hostname/machine\nfrom a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e\nv2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e\nMove badges to top of README (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e\nRemove unused extraction call (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e\ndocs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e\ndocs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e\nBump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e\ndocs: exclude Response.is_permanent_redirect from API docs (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e\ndocs: clarify Quickstart POST example (\u003ca\nhref\u003d\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/psf/requests/compare/v2.25.1...v2.33.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 1.26.13 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to\nspecific use cases detailed in the accompanying advisories; overall user\nexposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been read and decompressed partially. (Reported by \u003ca\nhref\u003d\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed using the official \u003ca\nhref\u003d\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by\n\u003ca\nhref\u003d\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive\nheaders specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca\nhref\u003d\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing\ndeprecation notices. Rescheduled the removal of deprecated features to\nversion 3.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed data buffered from previous partial reads. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the response after a partial read when\n\u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and\n\u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt\u003d0\u003c/code\u003e.\n(\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing\n\u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior\nof chunked request bodies. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling\nschemeless URIs were passed to\n\u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to\naccept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e,\nmatching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling\nuse with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3\nis raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure\nlong-term sustainable maintenance of the project after a sharp decline\nin financial support. If your company or organization uses Python and\nwould benefit from HTTP/2 support in Requests, pip, cloud SDKs, and\nthousands of other projects \u003ca\nhref\u003d\"https://opencollective.com/urllib3\"\u003eplease consider contributing\nfinancially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and\nmaintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the\nstreaming API were bypassed when HTTP redirects were followed.\n(CVE-2026-21441 reported by \u003ca\nhref\u003d\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High,\nGHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours\nas 6 hours by default. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on\nEmscripten. (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the\nresponse had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt\u003dN)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt\u003dN)\u003c/code\u003e call when the response was\ndecompressed\nusing the official \u003ccode\u003eBrotli\n\u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using\n\u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in\n\u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc\n\u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979)\n\u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt\u003dNone)\u003c/code\u003e was\nignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636)\n\u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only\npart of the\nresponse after a partial read when \u003ccode\u003ecache_content\u003dTrue\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e\nRelease 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e\nMerge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e\nFix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e\nSwitch to nightly PyPy3.11 in CI for now (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e\nAvoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when\n\u003ccode\u003eamt\u003d0\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e\nBump dev dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e\nUpgrade mypy to version 1.20.2 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e\nDrop support for EOL PyPy3.10 (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix\nwarnings (\u003ca\nhref\u003d\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/urllib3/urllib3/compare/1.26.18...2.7.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django` from 4.2.20 to 5.2.16\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/6c8eee41f778da87bdd17e27381d3705ed2d068b\"\u003e\u003ccode\u003e6c8eee4\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Bumped version for 5.2.16 release.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e\"\u003e\u003ccode\u003ed5d60ed\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted\nin Dom...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc\"\u003e\u003ccode\u003e6c66eb8\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when\ncreating...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7\"\u003e\u003ccode\u003e721685a\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set\ncooki...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/61a829d13aa5589cc12b10cc96194125f84f2e69\"\u003e\u003ccode\u003e61a829d\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Added stub release notes and release date 5.2.16.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/21af510eabd0a2e4a95d58bccfec1453453571c5\"\u003e\u003ccode\u003e21af510\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Avoided breaking sha1sum verification in the generated\nchecksum.txt f...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/039df55c3abf070b190937802b8cdae318c52e11\"\u003e\u003ccode\u003e039df55\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Replaced the defunct pgp.mit.edu keyserver with GitHub for key\nimport.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/2b3093ff431de73cd23023110ccd86f310d3d29d\"\u003e\u003ccode\u003e2b3093f\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Fixed \u003ca\nhref\u003d\"https://redirect.github.com/django/django/issues/29187\"\u003e#29187\u003c/a\u003e\n-- Fixed flaky receiver count assertion in signals tests.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/4abc595b1a25fe723f6d5ec30e505a474f6605c9\"\u003e\u003ccode\u003e4abc595\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Refs \u003ca\nhref\u003d\"https://redirect.github.com/django/django/issues/16281\"\u003e#16281\u003c/a\u003e\n-- Fixed isolation of admin_views.ViewOnSiteTests.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/django/django/commit/f87add967ec0aa644353cb7e1e1659ca9262f691\"\u003e\u003ccode\u003ef87add9\u003c/code\u003e\u003c/a\u003e\n[5.2.x] Added CVE-2026-6873, CVE-2026-7666, CVE-2026-8404,\nCVE-2026-35193, an...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/django/django/compare/4.2.20...5.2.16\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sqlparse` from 0.5.2 to 0.6.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG\"\u003esqlparse\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 0.6.0 (Aug 13, 2026)\u003c/h2\u003e\n\u003cp\u003eNotable Changes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.8 and 3.9. Python 3.10+ is now\nrequired.\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) in the\nlexer,\nwhich consumed CPU quadratically on statements containing many unclosed\ndollar-quoted literals or multiline comments (CVE-2026-59893). See the\nsecurity advisory for details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr\u003c/a\u003e\nThe vulnerability was discovered by EQSTLab, min8282 and 7thpark.\nThanks for reporting!\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) when\ngrouping\ndeeply nested or very wide statements. Building a token group re-read\nthe\nwhole group on every step, so a small statement could keep a worker busy\nfor a long time (CVE-2026-54284, pr848 by alhudz and tonghuaroot).\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) in\n\u003ccode\u003eformat(sql, reindent\u003dTrue)\u003c/code\u003e, which consumed CPU\nquadratically on long\nlists of tuples. See the security advisory for details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Fixes a potential denial of service attack (DOS) on\nstatements\nthat consist only of comments (CVE-2026-71491). See the security\nadvisory\nfor details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p\u003c/a\u003e\nThe vulnerability was discovered by \u003ca\nhref\u003d\"https://github.com/sanktjodel\"\u003e\u003ccode\u003e@​sanktjodel\u003c/code\u003e\u003c/a\u003e.\nThanks for reporting!\u003c/li\u003e\n\u003cli\u003eIMPORTANT: Backslashes are now escaped in the \u003ccode\u003epython\u003c/code\u003e\nand \u003ccode\u003ephp\u003c/code\u003e output\nformats. Without escaping, SQL containing a backslash could break out of\nthe generated string literal (CVE-2026-59894). See the security advisory\nfor details:\n\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x\"\u003ehttps://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x\u003c/a\u003e\nThe vulnerability was discovered by \u003ca\nhref\u003d\"https://github.com/7thParkk\"\u003e\u003ccode\u003e@​7thParkk\u003c/code\u003e\u003c/a\u003e. Thanks\nfor reporting!\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eEnhancements\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eModernize type annotations in top-level API functions using PEP 585\nand\nPEP 604 syntax.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eEND FOR\u003c/code\u003e and \u003ccode\u003eEND CASE\u003c/code\u003e are now recognized as\nkeywords.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eBug Fixes\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eStatement splitting was rewritten on a stack-based architecture.\nThis fixes\nsplitting of statements with nested BEGIN ... END blocks\n(issue845).\u003c/li\u003e\n\u003cli\u003eFix function grouping being skipped in \u003ccode\u003eCREATE TABLE ... AS\nSELECT\u003c/code\u003e\nstatements when the \u003ccode\u003eas\u003c/code\u003e keyword is lowercase (pr867 by\nOsamaali313).\u003c/li\u003e\n\u003cli\u003eRecognize \u003ccode\u003eROW_FORMAT\u003c/code\u003e as a keyword so that \u003ccode\u003eALTER\nTABLE ... ROW_FORMAT\u003d...\u003c/code\u003e\nno longer merges the table name and the option into a single identifier\n(issue773, pr860 by apoorvdarshan).\u003c/li\u003e\n\u003cli\u003eRecognize \u003ccode\u003eMATERIALIZED\u003c/code\u003e as a keyword so it is parsed and\nformatted\nconsistently in \u003ccode\u003eCREATE MATERIALIZED VIEW\u003c/code\u003e statements\n(issue752, pr854 by\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/2f40da99b50d81135aecf96f6b08fcfa338a96de\"\u003e\u003ccode\u003e2f40da9\u003c/code\u003e\u003c/a\u003e\nUpdate version number.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/5753f1570d3aa7366652cdd91577eb9e74533cfb\"\u003e\u003ccode\u003e5753f15\u003c/code\u003e\u003c/a\u003e\nAlign the changelog entries for this release with previous ones\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/b9588d973a7403cd8075873511e610dac4a58b2e\"\u003e\u003ccode\u003eb9588d9\u003c/code\u003e\u003c/a\u003e\nUnify the benchmark scripts on a shared harness\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/519e41698a172add8aa7b54ab4e94daad0af213e\"\u003e\u003ccode\u003e519e416\u003c/code\u003e\u003c/a\u003e\nPair comment/dollar-quote delimiters at the lexer position\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b\"\u003e\u003ccode\u003ea51df6d\u003c/code\u003e\u003c/a\u003e\nMeasure reindent offsets backwards to avoid quadratic CPU use\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/73d9ccddf21d73a68e3f99517a3918fd21eb81fa\"\u003e\u003ccode\u003e73d9ccd\u003c/code\u003e\u003c/a\u003e\nUpdate CHANGELOG\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e\"\u003e\u003ccode\u003ed1d8060\u003c/code\u003e\u003c/a\u003e\nFix uncontrolled CPU consumption (ReDoS) in the lexer\u0027s handling of\ndollar-qu...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87\"\u003e\u003ccode\u003eef2012a\u003c/code\u003e\u003c/a\u003e\nFix quadratic DoS in group_comments (GHSA-f2ff-p2ww-7p4p)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/26112ddb139361cc76218b3e3b50067652678fec\"\u003e\u003ccode\u003e26112dd\u003c/code\u003e\u003c/a\u003e\nUpdate Changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63\"\u003e\u003ccode\u003e53ff44b\u003c/code\u003e\u003c/a\u003e\nEscape backslashes in output formatters.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/andialbrecht/sqlparse/compare/0.5.2...0.6.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `setuptools` from 65.6.3 to 83.0.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pypa/setuptools/blob/main/NEWS.rst\"\u003esetuptools\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev83.0.0\u003c/h1\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRequire Python 3.10 or later...\n\n_Description has been truncated_\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "4a64b37937a0d656d2c36b5da8a620361cdb72cc",
      "tree": "91fc5466bac451512344a82f12fcb244ad3e8f67",
      "parents": [
        "7dda346c9940ecb11d8969ee9af04f841c1fd523"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Sun Aug 23 02:30:06 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 02:30:06 2026 +0000"
      },
      "message": "chore: remove unused rules in whl_library_targets (#4087)\n\nThis is a simple cleanup removing dead code."
    },
    {
      "commit": "7dda346c9940ecb11d8969ee9af04f841c1fd523",
      "tree": "c978491eb6275e420a5751af5bf2e252502fee7c",
      "parents": [
        "92c736e1629fbcbc61d160483e7df4684e6d434b"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 23 00:58:20 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 23 00:58:20 2026 +0000"
      },
      "message": "build: upgrade Python 3.9 usages across dev tools, examples, and tests (#4094)\n\nPython 3.9 is reaching end-of-life and Dependabot does not process\ncodebases appearing to use Python 3.9. Newer developer and\ndocumentation tools also require higher Python baselines.\n\nUpgraded minimum Python versions from 3.9 to 3.10/3.11 across\ndeveloper requirements lockfiles, documentation snippets, example\nworkspaces/modules, and integration/unit test matrices."
    },
    {
      "commit": "92c736e1629fbcbc61d160483e7df4684e6d434b",
      "tree": "3153baaf2051e8e22bfe9a0adb52272927609958",
      "parents": [
        "db65dfea650080f3693bb94e8fd0af411b152e6e"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 22 12:08:54 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 12:08:54 2026 -0700"
      },
      "message": "agents: specify docs and build(release) commit types (#4095)\n\nAmbiguity in commit type selection can cause issue templates or release\nscripts to be mislabeled under generic types like chore.\n\nUpdates the agent pull request rules to specify that issue template\nchanges use docs: and release tooling uses build(release):."
    },
    {
      "commit": "db65dfea650080f3693bb94e8fd0af411b152e6e",
      "tree": "b346a4e375ff97a2a7fb32619e02179dfef32180",
      "parents": [
        "cee6457d3014ff4065597ba9a681710622000bb2"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 22 11:38:50 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 11:38:50 2026 -0700"
      },
      "message": "build(release): remove patch release template and streamline backport workflow (#4093)\n\nHaving a separate issue template for patch release requests creates\nconfusion and fragments release tracking. Consolidating patch releases\nand backports into the unified release tracking workflow enables\nautomated backporting and reduces manual overhead for contributors\nand maintainers.\n\nTo streamline the workflow, this change:\n* Removes the standalone patch release request issue template in favor\n  of the unified release tracking template.\n* Updates release tracking automation to support backport checklists\n  and ignore placeholder PR numbers.\n* Updates documentation and developer guides to recommend automated\n  backport tracking issues and document the `process-news` command for\n  manual backport changelog updates."
    },
    {
      "commit": "cee6457d3014ff4065597ba9a681710622000bb2",
      "tree": "1552e33f8d941ff30fb5ed0c05c5d04efc7686cb",
      "parents": [
        "b9ec580bc3b89d4fefb758fbd6c42fc8fc88bf8e"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 22 11:04:24 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 11:04:24 2026 -0700"
      },
      "message": "agents: document Windows extended path rules and test organization (#4092)\n\nDuring Windows test and bootstrap development, long path resolution\nand platform constraints can introduce subtle failures, such as Win32\nAPIs ignoring relative traversal on extended-length paths or MSVC\ncompiler limitations when source directories exceed standard limits.\n\nTo prevent these pitfalls in future agent-assisted workflows, this\nchange codifies guidelines for handling Windows extended-length paths\nand establishes conventions for test suite organization and platform\nconstraints. Specifically, it documents strategies for keeping source\ndirectories concise, normalizing paths prior to file access or\ncomparisons, organizing tests by feature domain, and applying\nappropriate platform compatibility restrictions."
    },
    {
      "commit": "b9ec580bc3b89d4fefb758fbd6c42fc8fc88bf8e",
      "tree": "f620a0f63dd0149d802be81cceee926b1a9f041f",
      "parents": [
        "4f4eafd35cc4a57808e7b1a385ca4445ec1f2146"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Sat Aug 22 14:34:32 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 14:34:32 2026 +0000"
      },
      "message": "chore: cherry-pick 2.3.2 changelog prep (#4090)\n\nSummary:\n- doc: changelog entries for 2.3.2\n- chore: fix version numbers\n\nWork towards #4088"
    },
    {
      "commit": "4f4eafd35cc4a57808e7b1a385ca4445ec1f2146",
      "tree": "b17847ab3472e76edb1f1b2845a8d703ead6dfa7",
      "parents": [
        "581e6c5cc2166a7804be9e418fe3185779d7538b"
      ],
      "author": {
        "name": "Kristian Hartikainen",
        "email": "kristian@ekarobotics.com",
        "time": "Sat Aug 22 10:43:28 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 10:43:28 2026 +0000"
      },
      "message": "fix(pypi): support source-less wheels with dependencies (#4054)\n\nSource-less wheels with dependency metadata fail analysis because the\ngenerated wrapper `py_library` puts an empty `:srcs` target in its\n`srcs` attribute.\n\nThis forwards `:srcs` through the wrapper only when it produces Python\nsources, while retaining it in `deps` for `PyInfo` propagation. Before\nthis change, [`py-spy\u003d\u003d0.4.1`](https://pypi.org/project/py-spy/0.4.1/)\ndependency fails during analysis. Afterward, it can be used as a\ndependency.\n\nAdds regression coverage for source-less, sourceful, and generated\nnamespace-package source targets, along with a news entry.\n\nLargely implemented with Opus.\n\nFixes #4053.\n\n---------\n\nCo-authored-by: Ignas Anikevicius \u003c240938+aignas@users.noreply.github.com\u003e"
    },
    {
      "commit": "581e6c5cc2166a7804be9e418fe3185779d7538b",
      "tree": "d728281dbd4e2efe58ebee8d4e1e256193ac4042",
      "parents": [
        "984d4852ed1d7084d8f80e63f1e71d383f5ab815"
      ],
      "author": {
        "name": "belitskiy",
        "email": "belitskiy@google.com",
        "time": "Sat Aug 22 05:08:32 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 05:08:32 2026 +0000"
      },
      "message": "fix(windows): use extended paths in Python bootstraps (#4071)\n\nImplicit long-path support is not universal across the Win32 API. The\ndocumented set of APIs covered by the long-path opt-in does not include\nDLL loading functions, e.g., LoadLibraryExW:\n\n\nhttps://learn.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation#functions-without-max_path-restrictions\n\nAlways use extended-length paths in Windows bootstrap code and correctly\nconvert UNC paths to the \\\\?\\UNC\\ form.\n\nExperienced this breakage in JAX after the project being switched over\nto Bzlmod, which made some paths too long:\nhttps://github.com/jax-ml/jax/actions/runs/31674295160/job/94365413380\n\n```\n    File \"c:\\botcode\\w\\bazel-out\\x64_windows-opt\\bin\\jax\\experimental\\jax2tf\\tests\\multiprocess\\jax2tf_multiprocess_test_cpu.exe.runfiles\\rules_python++pip+jax_pypi_312_ml_dtypes_cp312_cp312_win_amd64_c1a95399\\site-packages\\ml_dtypes\\_finfo.py\", line 17, in \u003cmodule\u003e\n      from ml_dtypes._ml_dtypes_ext import bfloat16\n  ImportError: DLL load failed while importing _ml_dtypes_ext: The filename or extension is too long.\n```\n\nAlready used as a patch in https://github.com/jax-ml/jax/pull/39961\n\n---------\n\nCo-authored-by: Ignas Anikevicius \u003c240938+aignas@users.noreply.github.com\u003e"
    },
    {
      "commit": "984d4852ed1d7084d8f80e63f1e71d383f5ab815",
      "tree": "5e105b666a6f74c94625d6a9b9ada527ea4a57be",
      "parents": [
        "7905d790118254d18ebc1e8fae2ccc887770d028"
      ],
      "author": {
        "name": "Henrique",
        "email": "121921605+henriquejsza@users.noreply.github.com",
        "time": "Sat Aug 22 04:51:50 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 22 04:51:50 2026 +0000"
      },
      "message": "fix(pypi): handle revisions in uv.lock Git sources (#4086)\n\nGit sources in `uv.lock` can include a revision in the URL query and\nfragment. `pip.parse` currently includes those components in the derived\nfilename, which can produce an invalid Bazel repository name.\n\nDerive the filename from only the URL path while preserving the complete\nrevision-bearing Git URL. Regression coverage verifies the filename is\nclean\nand the fetch URL remains unchanged.\n\nFixes #4084"
    },
    {
      "commit": "7905d790118254d18ebc1e8fae2ccc887770d028",
      "tree": "be8c34ba979af88f17ec5fcf2f65867cca6356c0",
      "parents": [
        "b1b9bf00f7b9af8ba8a2dab4edef68d5e6e2e536"
      ],
      "author": {
        "name": "Régis Desgroppes",
        "email": "rdesgroppes@gmail.com",
        "time": "Thu Aug 20 07:26:35 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 07:26:35 2026 +0000"
      },
      "message": "fix(toolchain): fix crash on Windows when precompiling is enabled (#4082)\n\n`python/private/py_executable.bzl`\u0027s `_maybe_add_test_main_validation`\nfix (#4079) noted `precompile.bzl` as a remaining user of the same\n`exec_interpreter` relocation issue, needing the same migration.\n\nThere was no existing test exercising `_precompile`\u0027s action at all:\n`tests/base_rules/precompile`\u0027s suite is `analysis_test`-only, checking\ndeclared providers, never actually running the precompiler.\nReproducing this on Windows therefore required a real `bazel build`, via\nthe new `test_precompile_enabled_succeeds`:\n```\nbazel test \\\n  //tests/base_rules/precompile:test_precompile_enabled_succeeds\n...\nERROR: .../tests/base_rules/precompile/BUILD.bazel:3:22: Python\n precompiling .../test_precompile_enabled_succeeds_main.py into\n .../test_precompile_enabled_succeeds_main.cpython-311.pyc\n failed: Worker process did not return a WorkResponse:\n---8\u003c---8\u003c--- Start of log, file at\n .../multiplex-worker-1-PyCompile.log ---8\u003c---8\u003c---\n(empty)\n---8\u003c---8\u003c--- End of log ---8\u003c---8\u003c---\n```\nThe worker crashes at startup, unable to find its DLLs, before it can\nwrite anything to its own log or respond over the worker protocol.\n\n`_precompile` now uses `actions_run()` with `exec_runtime`, exactly as\n`_maybe_add_test_main_validation` does, instead of\n`exec_tools_info.exec_interpreter[DefaultInfo].files_to_run`.\n\nReproducing and fixing this also uncovered two more problems, both\nspecific to the precompiler\u0027s worker mode and unrelated to\n`exec_interpreter`.\n\nFirst, `tools/precompiler/precompiler.py`\u0027s persistent worker reads each\nJSON request as a single line via `asyncio.StreamReader`, whose default\n64KiB limit is exceeded once every interpreter distribution file,\npreviously hidden by relocation into a much smaller symlink tree, shows\nup as an actual, individually-digested action input:\n```\nValueError: Separator is not found, and chunk exceed the limit\n```\nA CPython 3.11 distribution\u0027s ~2,260 inputs measure ~470KiB this way; `1\n\u003c\u003c 22` (4MiB) leaves ample headroom.\n\nSecond, the worker\u0027s default implementation, `_AsyncPersistentWorker`,\ncan\u0027t start on Windows at all: `asyncio`\u0027s `ProactorEventLoop` fails to\nwrap `stdin`/`stdout` as pipe transports, with:\n```\nOSError: [WinError 6] The handle is invalid\n```\nBazel gives workers anonymous pipes (`CreatePipe`) for stdio, which\nnever support overlapped I/O, so `asyncio`\u0027s `ProactorEventLoop` can\u0027t\nregister them with an I/O completion port.\nThis is unrelated to precompiling\u0027s relocation bug: nothing exercises\nthis worker on Windows today.\n`_SerialPersistentWorker`, the blocking-I/O alternative already present\nin the file, has no such issue, so `--worker_impl` now defaults to\n`serial` on Windows.\n\n`tests/base_rules/precompile:test_precompile_enabled_succeeds` is a\nreal, executing `py_test` with `precompile \u003d \"enabled\"`, added alongside\nthe analysis-only suite to close this gap: it forces the precompiler\naction to actually run, and needs no CI wiring since it carries no tag\nexcluding it from the existing Windows job\u0027s default test sweep."
    },
    {
      "commit": "b1b9bf00f7b9af8ba8a2dab4edef68d5e6e2e536",
      "tree": "fdd6d9889082261524d0fba28bacba5f8860ce3e",
      "parents": [
        "d6e3912b8b23427222ef6c5717193c132bcdc69d"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Thu Aug 20 06:50:10 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 20 06:50:10 2026 +0000"
      },
      "message": "fix(pypi): drop unsupported args in the whl_library macro (#4083)\n\nWith this change we just ignore unsupported args from the implementation\nrules. Whilst this is a blunt tool to get the job done, it should work\nfor now and it is extendible to do failures or warnings in the future.\n\nFixes #4077"
    },
    {
      "commit": "d6e3912b8b23427222ef6c5717193c132bcdc69d",
      "tree": "d08d810abbcbab3b5d36a144b6a3e4107fc0f006",
      "parents": [
        "6201ce209b1640088ce161b78322bd81b57ef879"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Tue Aug 18 22:40:36 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 22:40:36 2026 -0700"
      },
      "message": "workflows: grant pull-requests write to release_process_backports (#4081)\n\nCalling the reusable workflow \u0027release_sync_changelog.yaml\u0027 requires\n\u0027pull-requests: write\u0027 permissions. Because\n\u0027release_process_backports.yaml\u0027 lacked this permission, GitHub\nActions rejected workflow runs when attempting to invoke the changelog\nsync workflow.\n\nGrant \u0027pull-requests: write\u0027 permissions to\n\u0027release_process_backports.yaml\u0027 and add regression tests that\nstatically verify caller workflows define sufficient permissions for\nany reusable workflows they invoke."
    },
    {
      "commit": "6201ce209b1640088ce161b78322bd81b57ef879",
      "tree": "d87d3929a6cac7ae6b232847456b873039feeb36",
      "parents": [
        "03a1a9aac4fe904deff653b5ab2be49d8c63cfcc"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Tue Aug 18 21:30:25 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 21:30:25 2026 -0700"
      },
      "message": "agents: document direct integration test execution in testing rules (#4080)\n\nIntegration tests under `tests/integration/` are filtered out by\nthe default `--config\u003dfast-tests` configuration because they are\ntagged with `integration-test` and `enormous`. When full integration\nbehavior needs to be verified, agents and developers must run them\ndirectly without the fast-tests configuration flag.\n\nDocument how integration tests are tagged and outline the command to\ninvoke specific integration test targets directly without\n`--config\u003dfast-tests`."
    },
    {
      "commit": "03a1a9aac4fe904deff653b5ab2be49d8c63cfcc",
      "tree": "a7346443bbbd235acbe7fc2bb63a2e1010fa3d6d",
      "parents": [
        "2e65252f95661e6a542b39fbf00ae3ead0be7fdb"
      ],
      "author": {
        "name": "Régis Desgroppes",
        "email": "rdesgroppes@gmail.com",
        "time": "Wed Aug 19 04:01:28 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 19 04:01:28 2026 +0000"
      },
      "message": "fix(py_test): fix Windows crash in `py_test` main validation (#4079)\n\n`py_test` main validation (`--validate_test_main\u003denabled`) crashes on\nWindows, because it invokes the interpreter via\n`exec_tools.exec_interpreter`, which resolves through\n`current_interpreter_executable()`\u0027s relocated copy of the interpreter.\n\nThe crash may be reproduced on existing tests in the repo, for instance:\n```\nbazel build \\\n  --@rules_python//python/config_settings:validate_test_main\u003denabled  \\\n  //tests/validate_test_main:validate_test_main_test\n...\nERROR: .../tests/validate_test_main/BUILD.bazel:3:8: Validating py_test\n main //tests/validate_test_main:validate_test_main_test failed:\n (Exit -1073741515): python.exe failed: error executing\n PyValidateTestMain command\n```\n```\ncd tests/integration/validate_test_main\nbazel build \\\n  --@rules_python//python/config_settings:validate_test_main\u003denabled \\\n  //:good_test\n...\nERROR: .../tests/integration/validate_test_main/BUILD.bazel:11:8:\n Validating py_test main //:good_test failed: (Exit -1073741515):\n python.exe failed: error executing PyValidateTestMain command\n```\n\n`-1073741515` is `STATUS_DLL_NOT_FOUND`: the relocated copy can\u0027t find\nits DLLs beside itself.\n\nThis is also the Windows-local manifestation of #2703\n(`exec_interpreter` broken on RBE): the same relocation severs the\ninterpreter from files resolved relative to itself, just triggered\ndifferently: RBE\u0027s copy materialization there, a lack of symlink\nprivilege here.\n\nColocating the DLLs alone (a first attempt) traded this for a second,\nstill fatal error, `ModuleNotFoundError: No module named \u0027encodings\u0027`,\nbecause the copy still can\u0027t find its stdlib.\nPatching each missing file individually doesn\u0027t scale: DLLs today,\nstdlib tomorrow, whatever else a future toolchain needs beside itself\nafter that.\n\n`_maybe_add_test_main_validation` now uses `actions_run()` with\n`exec_runtime` instead of `exec_tools.exec_interpreter`\u0027s relocated\n`DefaultInfo.files_to_run`, matching\n`PyExecToolsInfo.exec_interpreter`\u0027s own documented recommendation and\nthe pattern `common.bzl`\u0027s `actions_run()` and `py_zipapp_rule.bzl`\nalready use.\n`exec_runtime.interpreter` is the real file, used directly, with its\nreal files as plain action inputs, so nothing is relocated and nothing\nloses its siblings.\n\nWith the proposed fix[^1], above examples now build cleanly, with no\nrelocated runfiles tree for the interpreter at all, and\n`tests/integration/validate_test_main`\u0027s `inert_test` still fails with\nits intended \"will not run any tests\" message rather than a crash.\n\n`tests/integration/validate_test_main_test` is the corresponding\nintegration test, but it was not exercised on Windows, where it was\nfailing on `OSError: [WinError 193] %1 is not a valid Win32 application`\nin `tests/integration/runner.py`\u0027s Bazel-in-Bazel invocation, itself\nunable to run `bazel_from_env`\u0027s `#!` shebang line the way POSIX\u0027s\n`exec` does.\nThe present change therefore fixes this, by resolving the shebang\u0027s\ninterpreter itself, and enables the test on Windows.\n\n[^1]: This does not fix `exec_interpreter`/#2703 itself:\n`precompile.bzl` still resolves the interpreter via the relocated path\nand would need the same migration.\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "2e65252f95661e6a542b39fbf00ae3ead0be7fdb",
      "tree": "a45115642d58e9d78b836359b5e28396c4530e25",
      "parents": [
        "f25f24a01fa83e8a83d72e4959de7e5a0d3ba8bd"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Tue Aug 18 15:05:50 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 15:05:50 2026 -0700"
      },
      "message": "agents: document rf.root() path navigation and Runfiles.CreateOrRaise() in python rules (#4078)\n\nWhen interacting with Bazel runfiles in Python tests and runtime\nhelpers, using structured path navigation and globbing provides a\ncleaner, less error-prone interface than manual path manipulation or\nmulti-root fallback loops.\n\nUpdate .agents/rules/python.md to document the preference for `rf.root()\n/ \"\u003crepo\u003e/\u003cpath\u003e\"` over `Rlocation()` and using `.glob()` on\n`runfiles.Path`. Refine fail-fast creation guidance to prefer\n`runfiles.CreateOrRaise()` over `runfiles.Create()` with assertions."
    },
    {
      "commit": "f25f24a01fa83e8a83d72e4959de7e5a0d3ba8bd",
      "tree": "81480e0ff2e9eca3055d2680f59fa4736725987e",
      "parents": [
        "727a9414c50313ba1c05efecf7ae1ea4c65d1d60"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Aug 18 00:56:35 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 00:56:35 2026 +0000"
      },
      "message": "build(deps): bump bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml from 1.4.2 to 1.5.0 (#4075)\n\nBumps\n[bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml](https://github.com/bazel-contrib/publish-to-bcr)\nfrom 1.4.2 to 1.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/bazel-contrib/publish-to-bcr/releases\"\u003ebazel-contrib/publish-to-bcr/.github/workflows/publish.yaml\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.5.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: Support .tgz and .txz release archive extensions by \u003ca\nhref\u003d\"https://github.com/fmeum\"\u003e\u003ccode\u003e@​fmeum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/publish-to-bcr/pull/408\"\u003ebazel-contrib/publish-to-bcr#408\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update action sha to latest by \u003ca\nhref\u003d\"https://github.com/kormide\"\u003e\u003ccode\u003e@​kormide\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/publish-to-bcr/pull/409\"\u003ebazel-contrib/publish-to-bcr#409\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/bazel-contrib/publish-to-bcr/compare/v1.4.2...v1.5.0\"\u003ehttps://github.com/bazel-contrib/publish-to-bcr/compare/v1.4.2...v1.5.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/publish-to-bcr/commit/ca23149e55cd4db07a6bcce69c02dea314c5a357\"\u003e\u003ccode\u003eca23149\u003c/code\u003e\u003c/a\u003e\nchore: update action sha to latest (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/publish-to-bcr/issues/409\"\u003e#409\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/bazel-contrib/publish-to-bcr/commit/f9cfe7aca4256bb57b9d96648ce408c77593665b\"\u003e\u003ccode\u003ef9cfe7a\u003c/code\u003e\u003c/a\u003e\nSupport .tgz and .txz release archive extensions (\u003ca\nhref\u003d\"https://redirect.github.com/bazel-contrib/publish-to-bcr/issues/408\"\u003e#408\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/bazel-contrib/publish-to-bcr/compare/v1.4.2...v1.5.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dbazel-contrib/publish-to-bcr/.github/workflows/publish.yaml\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d1.4.2\u0026new-version\u003d1.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "727a9414c50313ba1c05efecf7ae1ea4c65d1d60",
      "tree": "ea7a09a7f00e525e82ae88c5931261419c88764d",
      "parents": [
        "fb97d50b0ec227f15e18347baae6f04e0eb25096"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Aug 18 00:46:47 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 00:46:47 2026 +0000"
      },
      "message": "build(deps): bump charset-normalizer from 3.4.9 to 3.5.0 in /tools/publish (#4073)\n\nBumps [charset-normalizer](https://github.com/jawah/charset_normalizer)\nfrom 3.4.9 to 3.5.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/releases\"\u003echarset-normalizer\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.5.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca\nhref\u003d\"https://github.com/Ousret/charset_normalizer/compare/3.4.9...3.5.0\"\u003e3.5.0\u003c/a\u003e\n(2026-08-12)\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExplicit support for Python 3.15\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eComparing a CharsetMatch to a non-alias encoding strings (\u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/773\"\u003e#773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReturn 0.0 CharsetMatch.multi_byte_usage for empty payloads instead\nof crashing (\u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/774\"\u003e#774\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eA file with both a charset declaration and BOM/SIG did not verify\nfirst the BOM/SIG charset.\u003c/li\u003e\n\u003cli\u003eiso2022* cases misdetected due to a flaw in our multibyte chunking\nlogic.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReplaced the optional mypyc build with Cython extensions while\nretaining the\npure Python fallback. The previous engine (mypyc) started to hit rough\nlimit around\nthe optimization of our noise/coherence detector while Cython allows us\nto\nsteer the engine toward the right generated optimized sources.\nThis change SHOULD not impact bundler (e.g. Pyinstaller) as the module\nare\nimmediately discoverable (i.e. not hidden import like mypyc did).\nMoreover, a long wished distribution is the abi3 wheels, this will allow\nus\nto no longer rush each year when a new Python interpreter is released.\nWe still distribute the interpreter specific wheels for faster\nperformance.\u003c/li\u003e\n\u003cli\u003eApplied micro-optimization on several utils.\u003c/li\u003e\n\u003cli\u003eCharsetMatches no longer sort on each match insertion.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved an old performance optimization attempt in apy.py\n(success_fast_tracked+payload_result_cache).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md\"\u003echarset-normalizer\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca\nhref\u003d\"https://github.com/Ousret/charset_normalizer/compare/3.4.9...3.5.0\"\u003e3.5.0\u003c/a\u003e\n(2026-08-12)\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExplicit support for Python 3.15\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eComparing a CharsetMatch to a non-alias encoding strings (\u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/773\"\u003e#773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReturn 0.0 CharsetMatch.multi_byte_usage for empty payloads instead\nof crashing (\u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/774\"\u003e#774\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eA file with both a charset declaration and BOM/SIG did not verify\nfirst the BOM/SIG charset.\u003c/li\u003e\n\u003cli\u003eiso2022* cases misdetected due to a flaw in our multibyte chunking\nlogic.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReplaced the optional mypyc build with Cython extensions while\nretaining the\npure Python fallback. The previous engine (mypyc) started to hit rough\nlimit around\nthe optimization of our noise/coherence detector while Cython allows us\nto\nsteer the engine toward the right generated optimized sources.\nThis change SHOULD not impact bundler (e.g. Pyinstaller) as the module\nare\nimmediately discoverable (i.e. not hidden import like mypyc did).\nMoreover, a long wished distribution is the abi3 wheels, this will allow\nus\nto no longer rush each year when a new Python interpreter is released.\nWe still distribute the interpreter specific wheels for faster\nperformance.\u003c/li\u003e\n\u003cli\u003eApplied micro-optimization on several utils.\u003c/li\u003e\n\u003cli\u003eCharsetMatches no longer sort on each match insertion.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved an old performance optimization attempt in apy.py\n(success_fast_tracked+payload_result_cache).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/3325d87c3c73fa1a8746947151faaf9a41177543\"\u003e\u003ccode\u003e3325d87\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/792\"\u003e#792\u003c/a\u003e\nfrom jawah/update-cibuildwheel-action\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/77203b104216a6d578a682b5ac0514750aa988f7\"\u003e\u003ccode\u003e77203b1\u003c/code\u003e\u003c/a\u003e\nchore: reformat noxfile.py\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/8561c227ba3789c24ad3fde08d23ad85693b4d98\"\u003e\u003ccode\u003e8561c22\u003c/code\u003e\u003c/a\u003e\nchore(deps): bump github/codeql-action/upload-sarif (\u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/787\"\u003e#787\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/25248df4e75c376d60e307d73a628c57b7db1743\"\u003e\u003ccode\u003e25248df\u003c/code\u003e\u003c/a\u003e\nchore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 (\u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/789\"\u003e#789\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/3eaaf3e6f58b43c12fc4b90ced195d1ac05338e0\"\u003e\u003ccode\u003e3eaaf3e\u003c/code\u003e\u003c/a\u003e\nchore: enable cp315t in ci\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/fbe9fc4f4cb9d1ae415b24e601eaa97c3fe4072e\"\u003e\u003ccode\u003efbe9fc4\u003c/code\u003e\u003c/a\u003e\nchore: update cibuildwheel for py315 by default\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/5c7b82afd16e7c5ceda36ea47f996703d776bf08\"\u003e\u003ccode\u003e5c7b82a\u003c/code\u003e\u003c/a\u003e\nchore: add emscripten classifier\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/7d30c21fe0cfffeae7858631751fa828f040c300\"\u003e\u003ccode\u003e7d30c21\u003c/code\u003e\u003c/a\u003e\nchore: skip pyodide tests cibw\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/417d66f3d4fa779f4e9075e3fae12f16fb468283\"\u003e\u003ccode\u003e417d66f\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/jawah/charset_normalizer/issues/791\"\u003e#791\u003c/a\u003e\nfrom jawah/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/commit/130afd55951e7c8bfe4043b192403b384d6c3827\"\u003e\u003ccode\u003e130afd5\u003c/code\u003e\u003c/a\u003e\nchore: perf script initial warm with big5 dummy content\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/jawah/charset_normalizer/compare/3.4.9...3.5.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcharset-normalizer\u0026package-manager\u003dpip\u0026previous-version\u003d3.4.9\u0026new-version\u003d3.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "fb97d50b0ec227f15e18347baae6f04e0eb25096",
      "tree": "6ef97e427eb41b22536839c6cbc76e26f4365aaf",
      "parents": [
        "2c5c38f99336b33376fcb6b5992a7a99a403d52f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Aug 18 00:43:17 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 00:43:17 2026 +0000"
      },
      "message": "build(deps): bump actions/setup-python from 5 to 7 (#4074)\n\nBumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 5 to 7.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate to ESM and upgrade dependencies by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1330\"\u003eactions/setup-python#1330\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePin SHA commits and update docs with latest versions by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1338\"\u003eactions/setup-python#1338\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the pip-install input by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1336\"\u003eactions/setup-python#1336\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix to Classify stderr warning messages as warnings instead of\nerrors in annotations by \u003ca\nhref\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate and retry manifest fetch to prevent silent failures by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1332\"\u003eactions/setup-python#1332\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Upgrade\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump certifi from 2020.6.20 to 2024.7.4 in\n/\u003cstrong\u003etests\u003c/strong\u003e/data by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1328\"\u003eactions/setup-python#1328\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove EOL Python versions and Bumps numpy text fixture by \u003ca\nhref\u003d\"https://github.com/priya-kinthali\"\u003e\u003ccode\u003e@​priya-kinthali\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1333\"\u003eactions/setup-python#1333\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 6.2.0 by \u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lmvysakh\"\u003e\u003ccode\u003e@​lmvysakh\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1335\"\u003eactions/setup-python#1335\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/philip-gai\"\u003e\u003ccode\u003e@​philip-gai\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1337\"\u003eactions/setup-python#1337\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6...v7.0.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd RHEL support and include Linux distro in cache keys by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1323\"\u003eactions/setup-python#1323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix pip cache error handling on Windows by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1040\"\u003eactions/setup-python#1040\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade minimatch from 3.1.2 to 3.1.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1281\"\u003eactions/setup-python#1281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions dependencies by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write\ndenied by \u003ca\nhref\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependency versions and test workflow configuration by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1322\"\u003eactions/setup-python#1322\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate advanced-usage.md by \u003ca\nhref\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\"\u003ehttps://github.com/actions/setup-python/compare/v6.2.0...v6.3.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev6.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eDependency Upgrades\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade dependencies to Node 24 compatible versions by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1259\"\u003eactions/setup-python#1259\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97\"\u003e\u003ccode\u003e5fda3b9\u003c/code\u003e\u003c/a\u003e\nPin SHA commits and update docs with latest versions (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e\"\u003e\u003ccode\u003e4ab7e95\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1337\"\u003e#1337\u003c/a\u003e\nfrom actions/philip-gai/bump-actions-cache-6-2-0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c\"\u003e\u003ccode\u003e0f3a009\u003c/code\u003e\u003c/a\u003e\nRemove the pip-install input (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1336\"\u003e#1336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932\"\u003e\u003ccode\u003ef8cf429\u003c/code\u003e\u003c/a\u003e\nMigrate to ESM and upgrade dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1330\"\u003e#1330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5\"\u003e\u003ccode\u003e54baeea\u003c/code\u003e\u003c/a\u003e\nValidate and retry manifest fetch to prevent silent failures (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1332\"\u003e#1332\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5\"\u003e\u003ccode\u003ec709277\u003c/code\u003e\u003c/a\u003e\nAnnotation code fix (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1335\"\u003e#1335\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a\"\u003e\u003ccode\u003e6849080\u003c/code\u003e\u003c/a\u003e\nremove EOL Python versions and Bumps numpy text fixture (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1333\"\u003e#1333\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e\"\u003e\u003ccode\u003e0903b46\u003c/code\u003e\u003c/a\u003e\nBump certifi from 2020.6.20 to 2024.7.4 in /\u003cstrong\u003etests\u003c/strong\u003e/data\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1328\"\u003e#1328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1\"\u003e\u003ccode\u003eece7cb0\u003c/code\u003e\u003c/a\u003e\nFix pip cache error handling on Windows. (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1040\"\u003e#1040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf\"\u003e\u003ccode\u003e1d18d7a\u003c/code\u003e\u003c/a\u003e\nUpdate advanced-usage.md (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/811\"\u003e#811\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v5...v7\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/setup-python\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d5\u0026new-version\u003d7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "2c5c38f99336b33376fcb6b5992a7a99a403d52f",
      "tree": "a1e96003b178e2d1193846ded896563d35ebd7d3",
      "parents": [
        "42867b6b27d8b08c66aca00df1f60c58441b3643"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Aug 18 00:43:13 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 18 00:43:13 2026 +0000"
      },
      "message": "build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#4072)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n9.0.0 to 10.0.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/releases\"\u003eastral-sh/setup-uv\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.0.1 🌈 Tolerate transient manifest timeouts\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eThank you \u003ca\nhref\u003d\"https://github.com/arguile\"\u003e\u003ccode\u003e@​arguile\u003c/code\u003e\u003c/a\u003e- for making\nthis action more resilient.\u003c/p\u003e\n\u003ch2\u003e🐛 Bug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTolerate transient manifest timeouts \u003ca\nhref\u003d\"https://github.com/arguile\"\u003e\u003ccode\u003e@​arguile\u003c/code\u003e\u003c/a\u003e- (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1016\"\u003e#1016\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🧰 Maintenance\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore: update known checksums for 0.12.4 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1017\"\u003e#1017\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📚 Documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update version references to v10.0.0 @\u003ca\nhref\u003d\"https://github.com/apps/github-actions\"\u003egithub-actions[bot]\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1014\"\u003e#1014\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev10.0.0 🌈 Disable automatic caching for sensitive events and new QOL\nfeatures\u003c/h2\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cp\u003eAnother breaking release, directly after v9.0.0 but we think the\nadded security justifies that.\u003c/p\u003e\n\u003ch3\u003eExtra security by default\u003c/h3\u003e\n\u003cp\u003eIf you use the default \u003ccode\u003eenable-cache: auto\u003c/code\u003e this will now\n\u003cstrong\u003eDISABLE THE CACHE\u003c/strong\u003e to protect against cache poisoning\nfor the following events:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003epull_request_target\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eworkflow_run\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erelease\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eYou can read the full reasoning in \u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/984\"\u003eastral-sh/setup-uv#984\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003e\u003ccode\u003eversion: latest-known\u003c/code\u003e\u003c/h3\u003e\n\u003cpre lang\u003d\"yaml\"\u003e\u003ccode\u003e- name: Install the latest version of uv known to\nsetup-uv\n  uses: astral-sh/setup-uv@v10.0.0\n  with:\n    version: \u0026quot;latest-known\u0026quot;\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis will now install the latest version with a checksum that is\nknown by this action. The \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts\"\u003eknown\n\u003ccode\u003euv\u003c/code\u003e checksums\u003c/a\u003e are automatically updated but will take a\nrelease of this action to take effect. You won\u0027t be always using the\nlatest \u0026amp; greatest but you will have an extra level of security.\u003c/p\u003e\n\u003ch3\u003eRead python version from \u003ccode\u003e.tool-versions\u003c/code\u003e\u003c/h3\u003e\n\u003cpre lang\u003d\"yaml\"\u003e\u003ccode\u003e- name: Install uv based on the version defined\nin .tool-versions and also set python\n  uses: astral-sh/setup-uv@v10.0.0\n  with:\n    version-file: \u0026quot;pyproject.toml\u0026quot;\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d\"\u003e\u003ccode\u003e20cfd1b\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.12.4 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1017\"\u003e#1017\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30\"\u003e\u003ccode\u003ed73a0ca\u003c/code\u003e\u003c/a\u003e\nTolerate transient manifest timeouts (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1016\"\u003e#1016\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6\"\u003e\u003ccode\u003eae3b92d\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v10.0.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1014\"\u003e#1014\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d\"\u003e\u003ccode\u003eae62891\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1013\"\u003e#1013\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2\"\u003e\u003ccode\u003ef9cdb47\u003c/code\u003e\u003c/a\u003e\nReject paths in .tool-versions (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1007\"\u003e#1007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12\"\u003e\u003ccode\u003e4f6036f\u003c/code\u003e\u003c/a\u003e\nRequire pull requests for Dependabot rollups (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1005\"\u003e#1005\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182\"\u003e\u003ccode\u003e8d6402c\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/1004\"\u003e#1004\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027\"\u003e\u003ccode\u003e46f427b\u003c/code\u003e\u003c/a\u003e\nRead Python version from .tool-versions (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/996\"\u003e#996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3\"\u003e\u003ccode\u003e8ed89c5\u003c/code\u003e\u003c/a\u003e\nci: pin Alpine container image (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/995\"\u003e#995\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae\"\u003e\u003ccode\u003e8473c7f\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/994\"\u003e#994\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/v9.0.0...v10.0.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d9.0.0\u0026new-version\u003d10.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "42867b6b27d8b08c66aca00df1f60c58441b3643",
      "tree": "2ffb781d37a84e60eada790973295b39111c304a",
      "parents": [
        "89deea4395d3a02be3a84457808b8048f1ac0401"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 17 16:33:30 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 16:33:30 2026 -0700"
      },
      "message": "workflows: make on_pr_closed.py executable and add permissions test (#4076)\n\nGitHub Actions workflow step scripts invoked directly as executables\nrequire executable file mode (`100755`).\n`.github/workflows/on_pr_closed.py` was checked in with `100644`\npermissions, causing step execution errors when run directly.\n\nMark `on_pr_closed.py` as executable and introduce an automated\nregression test in `tests/workflows/` that asserts any workflow script\nwith a shebang has executable bit permissions. In addition, update agent\nrules and review skills to audit script execution permissions."
    },
    {
      "commit": "89deea4395d3a02be3a84457808b8048f1ac0401",
      "tree": "08f0882fca2d971ad0f323228c69ae17ac8ceab5",
      "parents": [
        "8363ebe7f17b3670f2aa37cbc86f6c81eef881b9"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 17 15:53:18 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 15:53:18 2026 +0000"
      },
      "message": "tests(runfiles): migrate runfiles tests to pytest_test (#4061)\n\nMigrate the primary runfiles test targets to pytest_test to standardize\ntest execution and runner behavior across the test suite.\n\nThe main runfiles_test and pathlib_test targets are updated to use\npytest_test. However, the corresponding _min_python_test targets remain\nstandard py_test targets using standard library unittest. In WORKSPACE\nmode, dev_pip dependencies only resolve for Python 3.11, so pytest is\nunavailable when testing against Python 3.10; retaining py_test ensures\nminimum Python version verification continues to work."
    },
    {
      "commit": "8363ebe7f17b3670f2aa37cbc86f6c81eef881b9",
      "tree": "d72ba59989c01abc5be490c7a1eceb91824709d4",
      "parents": [
        "b76ffcdc7a42ca1dd09ed83e41a593380f20c8e1"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 17 01:06:31 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 01:06:31 2026 -0700"
      },
      "message": "agents: update CI soft-fail handling and GHA event parsing rules (#4069)\n\nUpdate agent skills and workflow rules for CI soft-failing jobs and\nGHA event parsing.\n\nWhy:\n- Prevent merge shepherd from getting stuck on experimental/rolling\n  soft-failing CI jobs.\n- Encourage workflow parsing scripts to read event payloads directly\n  from GITHUB_EVENT_PATH.\n\nHow:\n- Add soft-failing jobs guidance in merge-pr and monitor-ci-results\nskills.\n- Add Event Payload Resolution guideline in github_actions_workflows.md."
    },
    {
      "commit": "b76ffcdc7a42ca1dd09ed83e41a593380f20c8e1",
      "tree": "c3722b2fa6dc4a296885e2bb116dd65eb69fdad4",
      "parents": [
        "1213e831d60f8120619b49aa5c4f785e3aa4b996"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 17 01:02:43 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 01:02:43 2026 -0700"
      },
      "message": "build(release): separate sync changelog into standalone workflow and CLI tool (#4067)\n\nBackport processing previously combined applying backports to a\nrelease branch with synchronizing the changelog back to main. This\ntight coupling prevented changelog synchronization from being\ntriggered, dispatched, or retried independently of the backport\nprocess.\n\nSeparate changelog synchronization into a dedicated sync-changelog\nCLI command and standalone GitHub Actions workflows. Update backport\nprocessing to record changelog sync tasks rather than executing them\ndirectly. Add event parsing helpers to inspect GITHUB_EVENT_PATH in\nworkflows, integrate GitHub Actions workflow command annotations\ninto release logging, and expand documentation and test coverage."
    },
    {
      "commit": "1213e831d60f8120619b49aa5c4f785e3aa4b996",
      "tree": "64f9c395e2b75e13cbb3aea963f5f5a4f2283675",
      "parents": [
        "1b525fac37d7ab2ecc51163fa19e5e895d1917a6"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 17 00:52:13 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 00:52:13 2026 -0700"
      },
      "message": "agents: add native.test_suite API tag invariant rule (#4068)\n\nagents: add native.test_suite API tag invariant rule\n\nIn Bazel, tags on native.test_suite serve as test filtering selectors\nrather than specifying target execution properties.\n\nAdd a rule to .agents/rules/starlark.md warning against forwarding\nregular test target tags to native.test_suite."
    },
    {
      "commit": "1b525fac37d7ab2ecc51163fa19e5e895d1917a6",
      "tree": "7a87a791df292d044ce055f47649c40824dc6574",
      "parents": [
        "888ad0ee081b9a62d26d8c385b1ad9696daef0f3"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Mon Aug 17 05:57:29 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 05:57:29 2026 +0000"
      },
      "message": "test(pytest): support python_versions in pytest_test macro (#4064)\n\ntest(pytest): support python_versions in pytest_test macro\n\nTesting pytest-based suites across multiple Python versions previously\nrequired manually defining individual targets for each Python version.\n\nUpdate the \\`pytest_test\\` macro in test support helpers to accept an\noptional \\`python_versions\\` list. When specified, version-specific\n\\`pytest_test\\` targets with formatted names are generated and grouped\nunder a root \\`test_suite\\`."
    },
    {
      "commit": "888ad0ee081b9a62d26d8c385b1ad9696daef0f3",
      "tree": "247a192b561c875ac9af59ee3fb877eb3d278330",
      "parents": [
        "803bd089be727965bb183fcdabd91011ea8e03c0"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 16 23:04:52 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 16 23:04:52 2026 -0700"
      },
      "message": "agents: update review-code skill to initialize and update artifact on responses (#4066)\n\nPreviously, the code review skill waited until all auditing subagents\nfinished before creating and populating the review artifact. For\nlarge reviews or multi-agent audits, this caused significant delays\nwhere users could not inspect findings or observe progress.\n\nTo improve responsiveness, the review-code skill now initializes the\n`code-review-results.md` artifact immediately before launching\nsubagents and updates the artifact as individual subagent responses\narrive."
    },
    {
      "commit": "803bd089be727965bb183fcdabd91011ea8e03c0",
      "tree": "c4ba2eaa51c4e85bf358d1bedd92e4ce06b47ab9",
      "parents": [
        "259ee664685eeb04250e8a637f861ff7e69b390d"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 16 16:07:39 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 16 16:07:39 2026 -0700"
      },
      "message": "agents: refine commit type definitions and interface docstring rules (#4063)\n\nAgent rules previously grouped build, release tooling, CI, and GitHub\nActions under a generic `workflow:` category, creating ambiguity for\nconventional commit types. Furthermore, agent rules lacked explicit\nguidance on documenting interface methods in abstract base classes.\n\nClarify commit type conventions for release/build tools (`build:`),\nCI configurations (`ci:`), and GitHub Actions workflows (`workflow:`).\nAdditionally, require docstrings on abstract base classes to explicitly\ndocument Args, Returns, and custom exceptions under Raises."
    },
    {
      "commit": "259ee664685eeb04250e8a637f861ff7e69b390d",
      "tree": "41c2e589b7049bce1deb820fb490483ba2a3bab1",
      "parents": [
        "865b4e42fd8022363f3e5fa147328557de7fbe78"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 16 15:49:07 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 16 15:49:07 2026 -0700"
      },
      "message": "build(release): add process-news command with PR and version marker support (#4062)\n\nDuring release preparation, maintainers currently have to manually\nlocate news fragments from merged PRs, assemble them into\nCHANGELOG.md, delete consumed news files, and update documentation\nversion markers ({versionadded}/{versionchanged}). Doing this manually\nacross many PRs is tedious and prone to human error.\n\nAdd the `process-news` subcommand to the release tool in\n`process_news.py` to automate merging specific news files and PR\nchanges into an existing release section in CHANGELOG.md, removing\nprocessed news files, and updating `VERSION_NEXT_*` markers to the\ntarget release version."
    },
    {
      "commit": "865b4e42fd8022363f3e5fa147328557de7fbe78",
      "tree": "1bfe574b2c9c22931a6610545828f27bf05244e9",
      "parents": [
        "499c927cd8c98f3cb91ea31d4a2a328642373b46"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sun Aug 16 13:49:15 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 16 13:49:15 2026 -0700"
      },
      "message": "agents(starlark): document depset element immutability and provider conventions (#4060)\n\nagents(starlark): document depset element immutability and provider\nconventions\n\nDepset elements and nested provider fields must be immutable upon depset\nconstruction in Bazel, and using providers rather than structs enables\nkey sharing to minimize memory overhead. Documenting these invariants\nhelps agents adhere to Bazel best practices and avoid runtime errors\nor buildifier lint warnings when working with custom providers in\ndepsets.\n\nUpdate Starlark agent rules to require providers for depset elements,\nenforce tuple or depset types for nested fields instead of mutable\nlists, and document the buildifier suppression convention for non-Info\nproviders."
    },
    {
      "commit": "499c927cd8c98f3cb91ea31d4a2a328642373b46",
      "tree": "885188c2a37227d18d1711da980b03e709443e53",
      "parents": [
        "a9bbea3e12cc3abd4f1faf6964a1b6303475f36f"
      ],
      "author": {
        "name": "JoHoenk",
        "email": "162738563+JoHoenk@users.noreply.github.com",
        "time": "Sat Aug 15 23:45:22 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 23:45:22 2026 +0000"
      },
      "message": "feat(sphinxdocs): make SphinxDocsLibraryInfo provider public (#4041)\n\nCustom rules that produce doc files for sphinx_docs currently must\ndepend on the private sphinx_docs_library rule implementation, since\nSphinxDocsLibraryInfo lives under sphinxdocs/private. Expose it via\n//sphinxdocs:sphinx_docs_library_info.bzl so custom rules can supply\ndocs without that dependency.\n\nAdd a custom_docs_library test rule and output test verifying a\nnon-sphinx_docs_library rule can supply docs to sphinx_docs through the\npublic provider.\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "a9bbea3e12cc3abd4f1faf6964a1b6303475f36f",
      "tree": "e2c1a4a2f6a1bd064e9dc17b73ae1725ac10fe8c",
      "parents": [
        "6ba12ce07d74610ff6ce9d8b12c302c70ab4a0e0"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 15 22:25:49 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 22:25:49 2026 +0000"
      },
      "message": "chore(release): sync changelog and version markers for 2.3 backports (#4058)\n\nBackports were released in the 2.3.x series (including 2.3.0 and 2.3.1),\nbut main still contained unreleased news fragments and placeholder\nversion annotations for those changes.\n\nSync the released entries into CHANGELOG.md, remove the consumed news\nfragments, and update docstring version markers to reflect 2.3.0."
    },
    {
      "commit": "6ba12ce07d74610ff6ce9d8b12c302c70ab4a0e0",
      "tree": "c3f36a2404c573641f56a76d2e0304b93d474c39",
      "parents": [
        "83df7ac195a690cb5156ae04775e0d265cf01a83"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Sat Aug 15 19:52:49 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 19:52:49 2026 +0000"
      },
      "message": "refactor: split code into multiple files (#4044)\n\nA followup to #4043 to split code into multiple files to make the\ninteraction\nand reuse more intentional and explicit.\n\nWork towards #2948.\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "83df7ac195a690cb5156ae04775e0d265cf01a83",
      "tree": "2bfc4868597f7eebbdb0f7678be28dd3aaa718dd",
      "parents": [
        "ade3edfd93b58d8631ad50fed8009522654f2912"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 15 12:52:27 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 12:52:27 2026 -0700"
      },
      "message": "agents: add workflow type convention and python exception rules (#4057)\n\nAdd workflow:/workflows: PR and commit type convention to pr.md\nfor release automation and CI tooling.\n\nAdd Exception base class and subprocess error boundary demarcation rules\nto python.md."
    },
    {
      "commit": "ade3edfd93b58d8631ad50fed8009522654f2912",
      "tree": "3490901f3ccdf87505710c80ac510562e83e0584",
      "parents": [
        "a6f7f71dc91838527f772abba7d39a95ea2a4554"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 15 12:35:00 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 12:35:00 2026 -0700"
      },
      "message": "workflow(release): surface subprocess output and improve error handling in backport operations (#4056)\n\nWhen backporting changes or creating pull requests during release\nautomation, subprocess errors frequently hid command failure details\nbecause stdout and stderr were not captured in the raised exceptions.\nAdditionally, process logging relied on raw print statements and\ncleanup operations lacked diagnostic logs.\n\nTo improve debuggability and observability:\n- Capture and surface stdout and stderr in backport errors and\n  CreatePrError exceptions when PR creation fails.\n- Transition print calls to standard logging in backport processing.\n- Log cleanup actions explicitly within the changelog sync finally\n  block."
    },
    {
      "commit": "a6f7f71dc91838527f772abba7d39a95ea2a4554",
      "tree": "4dcc78e936ea9ec7adc16096b5fc372082616863",
      "parents": [
        "e29386791280cb96bfa3cd6dff3b1e90a15ab4fa"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Sat Aug 15 11:17:51 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Aug 15 11:17:51 2026 -0700"
      },
      "message": "agents: clarify commit and PR type conventions in pr.md (#4055)\n\nAdd explicit guidance in pr.md defining commit and pull request type\nprefixes. Clarify that `fix:` and `feat:` are reserved exclusively for\nuser-visible changes, while `tests:` must be used for test-only changes\nand test-helper fixes."
    },
    {
      "commit": "e29386791280cb96bfa3cd6dff3b1e90a15ab4fa",
      "tree": "2cbc4ad654cebc186b6de957ecc910bf10c0e766",
      "parents": [
        "3bbcf7e5288e4a365755195a5242f3157a3ff0f5"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 22:50:16 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 22:50:16 2026 -0700"
      },
      "message": "tests: use runfiles.CreateOrRaise in release_test_helper (#4052)\n\nUsing runfiles.Create() returns an optional Runfiles object, which\ncan lead to typing issues and runtime attribute errors if runfiles\ncannot be created or located.\n\nSwitch to runfiles.CreateOrRaise() in _find_real_template_path to\nensure a non-None Runfiles instance is returned and fail fast if\nrunfiles are unavailable."
    },
    {
      "commit": "3bbcf7e5288e4a365755195a5242f3157a3ff0f5",
      "tree": "6f93fe52aca351efabf8eec4e5af688f77ccf882",
      "parents": [
        "e1514c3c789b5b1d603ff797765b26079e05009f"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 12:39:23 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 12:39:23 2026 -0700"
      },
      "message": "workflows(release): remove non-patch release tasks from patch release issues (#4051)\n\nWhen creating a patch release tracking issue (e.g. from /backport\ncomments or manually), .0-only tasks such as \u0027Prepare Release\u0027 and\n\u0027Create Release branch\u0027 were incorrectly retained in the template.\n\nUpdate load_release_tracking_template to filter out .0-only tasks\n(\u0027Prepare Release\u0027, \u0027Create Release branch\u0027, and \u0027Tag RC*\u0027) for patch\nreleases, and update tests to load the real issue template via runfiles."
    },
    {
      "commit": "e1514c3c789b5b1d603ff797765b26079e05009f",
      "tree": "64b57e1e71e45465302b8140eddc66b4e64ce414",
      "parents": [
        "fdb3fc9ee0badd0afb8638c4ea56cc48d02b3ffd"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 12:30:45 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 12:30:45 2026 -0700"
      },
      "message": "workflows(release): support /backport comment on release tracking issue and pr (#4050)\n\nRelease tracking issues previously expected `/add-backports` while PRs\nused `/backport`, leading to inconsistent command conventions across\nrelease workflows and documentation.\n\nUpdate the comment workflow handler to support `/backport` and\n`/backports` consistently across both release tracking issues and\nPRs. Documentation and issue templates are updated to reflect the\nunified syntax, and missing arguments now emit GitHub Actions workflow\nerror annotations."
    },
    {
      "commit": "fdb3fc9ee0badd0afb8638c4ea56cc48d02b3ffd",
      "tree": "9df2b9aa2a20477d90fd3cf300fefcb5e4953aa2",
      "parents": [
        "6009acb862a05a1b521c8fd9a9caaa480be71374"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 11:39:25 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:39:25 2026 -0700"
      },
      "message": "agents(review-code): export review results artifact and factor report format (#4048)\n\nThe review-code skill orchestrator previously lacked instructions to\nsynthesize subagent findings into a single user-facing markdown\nartifact, making it difficult to inspect audit reports in a structured\nmanner. Furthermore, reporting format and status guidelines were\nduplicated across individual auditor prompts.\n\nUpdate the review-code orchestrator to generate a unified\n`code-review-results.md` artifact containing overall summaries and\nper-category findings. Extract shared reporting format rules into a\nreusable markdown fragment referenced by all reviewer prompts."
    },
    {
      "commit": "6009acb862a05a1b521c8fd9a9caaa480be71374",
      "tree": "83c074e8679a29fff2b1baa75ba3927179aa0916",
      "parents": [
        "03a2c23245759d80cd281bcbf1ed2bb1bf81d05e"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 11:37:16 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:37:16 2026 -0700"
      },
      "message": "agents(rules): update github_actions_workflows rule with python script and testing conventions (#4047)\n\nWorkflow automation scripts and tests across GitHub Actions lacked\nclear, standardized rules for console logging, test placement, Bazel\nimport targets, and test fixture design. Without shared guidelines,\nscripts risked inconsistent log formatting, sys.path manipulations, and\nad-hoc test structures.\n\nUpdate .agents/rules/github_actions_workflows.md to require GitHub\nworkflow command syntax for console logging, define tests under\ntests/workflows/, prefer py_library imports over sys.path alterations,\nand follow functional script design with autouse fixtures for mocks."
    },
    {
      "commit": "03a2c23245759d80cd281bcbf1ed2bb1bf81d05e",
      "tree": "ea148646abc47de6dae34433b04cdb518ede0aeb",
      "parents": [
        "ed2c1bd6e7ac090a25b08780e3e15ab5ab41c3a6"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 11:30:19 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 11:30:19 2026 -0700"
      },
      "message": "workflows: auto-create patch release tracking issue on /backport (#4046)\n\nPreviously, commenting `/backport` on a PR failed if no release tracking\nissue was open, requiring maintainers to manually create one first.\n\nWhen auto-discovering tracking issues finds no open release issue,\nautomatically create a new patch release tracking issue for the next\npatch version and add the requested backports to it.\n\nAlso centralize release tracking template loading and RC task stripping\nfor patch releases into a shared helper function, prevent RC tasks from\nbeing added to patch release tracking issues, and format workflow log\nmessages with GitHub Actions annotations."
    },
    {
      "commit": "ed2c1bd6e7ac090a25b08780e3e15ab5ab41c3a6",
      "tree": "b483ed5da69bba58df8520dacd2d6ce4ece5235b",
      "parents": [
        "6302a3d5d43ea2a592fe805c6baf640d307ed637"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Fri Aug 14 08:20:02 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 08:20:02 2026 -0700"
      },
      "message": "refactor(release): move on_comment workflow logic into Python script (#4045)\n\nThe inline bash parsing logic in the comment dispatch workflow was\nbecoming complex and difficult to maintain or verify without executing\nlive GitHub Actions runs.\n\nMove the comment dispatch logic into a dedicated Python script running\nunder Python 3.14, add a Bazel py_library target, and establish full\nunit test coverage using pytest."
    },
    {
      "commit": "6302a3d5d43ea2a592fe805c6baf640d307ed637",
      "tree": "b59947064b9d6ee79e0e41b622583124164123f7",
      "parents": [
        "23684f6b7a7febd397193be2a993055ef1c81485"
      ],
      "author": {
        "name": "Ignas Anikevicius",
        "email": "240938+aignas@users.noreply.github.com",
        "time": "Fri Aug 14 14:52:22 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 14 14:52:22 2026 +0000"
      },
      "message": "fix(pypi): do not return rctx.metadata for pip_archive (#4043)\n\nThere was a small regression in #3948 that may affect\nexperimental repository cache users.\n\nRelated to #3791"
    },
    {
      "commit": "23684f6b7a7febd397193be2a993055ef1c81485",
      "tree": "0d2f334557ea1de83de51bcf682d7f9581cbba17",
      "parents": [
        "9361a1a4fbadd67659f3848936e1d909b594f9ff"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Thu Aug 13 16:34:55 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 13 16:34:55 2026 -0700"
      },
      "message": "agents(rules): add Starlark dict union and Pyrefly PackagePath conventions (#4038)\n\nStarlark supports the dictionary union operator (|), making skylib\u0027s\ndicts.add redundant. When using importlib.metadata in Python,\nf.locate() is typed as PathLike and lacks filesystem methods like\n.exists() and .is_file() under Pyrefly unless wrapped with\npathlib.Path.\n\nAdd rules instructing agents to prefer the dict union operator (|)\nover dicts.add in Starlark and to wrap f.locate() calls with\npathlib.Path() in Python type-annotated code."
    },
    {
      "commit": "9361a1a4fbadd67659f3848936e1d909b594f9ff",
      "tree": "bea05393dcf162eb8d476d65afd12d144414ee59",
      "parents": [
        "36c342ab1f36a4cda09cd7b1baf8f38c4f1ba6d6"
      ],
      "author": {
        "name": "Muravev Vasilii",
        "email": "10913258+muravev-vasilii@users.noreply.github.com",
        "time": "Thu Aug 13 19:06:19 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 13 10:06:19 2026 -0700"
      },
      "message": "fix(pypi): resolve self-referencing extras to a real fixed point (#4039)\n\n## Summary\n\n`_resolve_extras` decides that its fixed-point loop has converged by\ncomparing `num_extras_before` — the size of the extras set at the\n*start* of the round — against `len(new_extras)`, the number of extras\ndiscovered *during* that round:\n\n```python\nnum_extras_before \u003d len(extras)\nextras \u003d extras | new_extras\nnum_extras_after \u003d len(new_extras)   # the delta, not the merged size\n\nif num_extras_before \u003d\u003d num_extras_after:\n    break\n```\n\nThose are unrelated quantities, and the mismatch breaks in two separate\nways.\n\n### 1. Extras are silently dropped\n\nThe loop exits early whenever the two counts happen to coincide while\nthe set is still growing, so extras reachable only through a further\nround are never resolved —- and every dependency gated on them silently\ndisappears from the generated target.\n\nThe smallest reproducer is a two-hop self-extras chain:\n\n| `Requires-Dist` | requested | resolved today | expected |\n|---|---|---|---|\n| `foo[b]; extra \u003d\u003d \u0027all\u0027`, `foo[c]; extra \u003d\u003d \u0027b\u0027` | `foo[all]` | `{all,\nb}` | `{all, b, c}` |\n\nAnything behind `extra \u003d\u003d \u0027c\u0027` is lost, with no error. This is not\nlimited to the first round: a chain that branches before it deepens\n(`all → {p, q}`, `p → r`, `r → t`) hits the same equality on round two\nand drops `t`.\n\n### 2. The loop never terminates early for ordinary packages\n\nFor a package with no self-referencing extras — the overwhelmingly\ncommon case — `self_reqs` is empty, so `new_extras` is always `{}` while\n`extras` holds at least one entry. The condition can never hold, and the\nloop runs all 10000 rounds, allocating a dict each time, while\nevaluating the generated `BUILD` file of every wheel in the build.\n\nOn a ~52k-package repository this dominated loading-phase Starlark CPU:\n\n| Metric | Before | After |\n|---|---|---|\n| `_resolve_extras` self-time | 430–442 CPU-s | below profiler threshold\n|\n| Total Starlark user-function CPU | 747–759 CPU-s | 275–298 CPU-s |\n| Cold loading+analysis wall time (16 cores) | 82–84 s | 73–75 s |\n\n## The fix\n\nCompare the size of the *merged* set, which is what the `before`/`after`\nnaming already implied. The loop is monotonic, so the converged set is\nunchanged wherever it previously terminated correctly — this only stops\nit terminating too early, or not at all.\n\n## Tests\n\nThree regression tests are added to `tests/pypi/pep508/deps_tests.bzl`,\ncovering the three shapes that trigger the early exit: a two-hop chain,\nmultiple requested extras, and a chain where the counts only coincide\nafter the first round.\n\nAll three fail on `main` with exactly the dropped dependency, and pass\nwith the fix:\n\n```\n//tests/pypi/pep508:test_self_extras_chain_is_fully_resolved              FAILED   1 missing: c_dep\n//tests/pypi/pep508:test_self_extras_chain_with_multiple_requested_extras FAILED   1 missing: c_dep\n//tests/pypi/pep508:test_self_extras_chain_resolved_beyond_the_first_round FAILED  1 missing: t_dep\n```\n\nThe three existing tests that exercise self-extras chains\n(`test_self_is_ignored`, `test_self_dependencies_can_come_in_any_order`,\n`test_self_include_deps_from_previously_visited`) pass either way, which\nis why this went unnoticed.\n\n`bazel test //tests/pypi/...` is green (249/249) with the fix applied.\n\n## Notes\n\nThe condition was introduced in #3527, which replaced the previous\ndouble loop with this fixed-point loop.\n\nCo-authored-by: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "36c342ab1f36a4cda09cd7b1baf8f38c4f1ba6d6",
      "tree": "c8a1e0a6135b473d025811aa39823875791ca656",
      "parents": [
        "76704f642cf0c5bec2062ffebd3479545287622d"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Wed Aug 12 00:36:12 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Aug 12 00:36:12 2026 -0700"
      },
      "message": "fix(pypi): rewrite RECORD file entries for extracted .data contents (#4025)\n\nExtracting wheels with .data/ subdirectories moves files to their\ntarget directories and deletes .data/, but left .dist-info/RECORD\nreferencing deleted .data/ paths. This causes tools like\nimportlib.metadata.files() to fail locating or reading files.\n\nPer PEP 427 and PEP 376, rewrite .dist-info/RECORD entries during\nwheel extraction to match installed locations relative to\nsite-packages.\n\n* Also adds Starlark unit tests for RECORD rewriting and expands\n  importlib_metadata_test.\n\nWork towards #3024"
    },
    {
      "commit": "76704f642cf0c5bec2062ffebd3479545287622d",
      "tree": "eafe2b5043c1a02bc67b9c2f8e5f4862a8369ef7",
      "parents": [
        "c1e7fbb2f17ae6640e94109e9bc1270bfd528db0"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Tue Aug 11 16:07:29 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 16:07:29 2026 -0700"
      },
      "message": "agents(analyze-ci-failure): enhance network reset and macOS sandbox flake detection (#4037)\n\nCI jobs on Buildkite runners occasionally encounter transient curl\nnetwork resets during runner bootstrapping and transient darwin-sandbox\ndisk I/O errors (errno 5) on macOS workers. Previously, the automated\nCI failure analysis script did not match these error signatures,\nleading to unclassified failures or treating them as codebase defects.\n\nAdd pattern matching and flake classification heuristics for curl\nconnection resets and runner I/O errors so they are recognized as\ntransient infrastructure flakes."
    },
    {
      "commit": "c1e7fbb2f17ae6640e94109e9bc1270bfd528db0",
      "tree": "f127ee6da462b87cec78566ced14f531f7d57bfc",
      "parents": [
        "c2ebcd380eca13477087ceeaba41aafd50fc840e"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Tue Aug 11 09:18:38 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 16:18:38 2026 +0000"
      },
      "message": "build(ci): remove legacy mypy type checking workflow and comments (#4036)\n\nStatic type checking across the repository has been consolidated under\nPyrefly. The standalone GitHub Actions mypy workflow and mypy-specific\ntype ignore comments and suppressions are no longer necessary.\n\nRemove the legacy mypy CI job from GitHub Actions workflows, clean up\nmypy-specific type suppressions and comments in runfiles library code\nand tests, and standardize type narrowing assertions."
    },
    {
      "commit": "c2ebcd380eca13477087ceeaba41aafd50fc840e",
      "tree": "a5bd354202e38625cabd57eb8a44f68f0da8c9fd",
      "parents": [
        "353b24e3db2fbd6e5abc24856bf60a1031900e9c"
      ],
      "author": {
        "name": "armandomontanez",
        "email": "armando@engflow.com",
        "time": "Tue Aug 11 09:17:29 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 16:17:29 2026 +0000"
      },
      "message": "feat(bzlmod): make __init__.py generation configurable module-wide (#3997)\n\nIn #3841, a warning pushing users to migrate away from implicit\n`__init__.py` generation was added. While it\u0027s good to flag this bad\nbehavior, silencing it requires users to either explicitly configure\nthis option on every `py_binary` and `py_test` target, or configure the\noption globally in their `.bazelrc`.\n\nTo better facilitate a migration, this change introduces a mechanism for\nmodules to configure this option module-wide. This has multiple\nbenefits:\n\n1. Everyone working in the module doesn\u0027t need to remember to explicitly\nset `legacy_create_init` on every target.\n2. Everyone that depends on the module receives the correct behavior as\nconfigured by the module.\n3. It becomes possible to tell BCR-wide which modules have adopted this\nmigration.\n\nWork towards #2945\n\n---------\n\nCo-authored-by: Richard Levasseur \u003crichardlev@gmail.com\u003e"
    },
    {
      "commit": "353b24e3db2fbd6e5abc24856bf60a1031900e9c",
      "tree": "dc3779ae18f7ee2f079f3d5260b9517e403496e2",
      "parents": [
        "086835971b8a13842663e57476eaeb59186ffc92"
      ],
      "author": {
        "name": "Richard Levasseur",
        "email": "richardlev@gmail.com",
        "time": "Tue Aug 11 00:02:05 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 00:02:05 2026 -0700"
      },
      "message": "agents(rules): update python rules with typing and runfiles conventions (#4035)\n\nUpdate the Python agent rules to standardize type annotation practices\nand simplify runfiles initialization across Python files.\n\nClarify best practices by requiring explanatory comments for type\nsuppressions, adopting modern union syntax (`X | None`), and preferring\ngeneric collections from `collections.abc` and builtins over legacy\n`typing` equivalents. Additionally, instruct agents to prefer fail-fast\n`runfiles.CreateOrRaise()` when setting up Bazel runfiles."
    },
    {
      "commit": "086835971b8a13842663e57476eaeb59186ffc92",
      "tree": "d73a78ebaf5a0726bdc61f3fe8b3ac4d5ac56743",
      "parents": [
        "b401c751370993171ee6122e1711b1c198405f80"
      ],
      "author": {
        "name": "Stanley C",
        "email": "19547104+stanbot8@users.noreply.github.com",
        "time": "Mon Aug 10 23:32:53 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 11 06:32:53 2026 +0000"
      },
      "message": "fix: preserve arguments with spaces (#4026)\n\nThe runtime environment launcher collapsed interpreter arguments into\none shell word. It now forwards each argument without reparsing it,\npreserving the original argument boundaries.\n\nThis includes a regression test for interpreter arguments containing\nspaces.\n\nRelated: https://github.com/bazelbuild/bazel/issues/30644"
    }
  ],
  "next": "b401c751370993171ee6122e1711b1c198405f80"
}