chore(deps): update dependency requests to v2.33.0 [security] - #17
chore(deps): update dependency requests to v2.33.0 [security]#17renovate[bot] wants to merge 1 commit into
Conversation
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead. |
Welcome @renovate[bot]! 🎉Great PR! I've analyzed your code changes for:
Ready to see the full review?
Let's make your code even better together! 🚀 |
|
By default, I don't review pull requests opened by bots. If you would like me to review this pull request anyway, you can request a review via the |
Reviewer's Guide by SourceryThis pull request updates the requests dependency from version 2.31.0 to 2.32.2 to address a security vulnerability. The vulnerability occurs when using a Requests Session and setting Sequence diagram showing the TLS verification behavior fix in Requests 2.32.2sequenceDiagram
participant C as Client
participant S as Requests Session
participant H as Host
Note over C,H: Before fix (2.31.0)
C->>S: Create Session
C->>S: First request (verify=False)
S->>H: Request without cert verification
H-->>S: Response
C->>S: Second request (verify=True)
S->>H: Request still without cert verification
H-->>S: Response
Note over C,H: After fix (2.32.2)
C->>S: Create Session
C->>S: First request (verify=False)
S->>H: Request without cert verification
H-->>S: Response
C->>S: Second request (verify=True)
S->>H: Request with cert verification
H-->>S: Response
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Join our Discord community for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
|
Here's the code health analysis summary for commits Analysis Summary
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
This PR updates the requests library from v2.31.0 to v2.32.2 to address security vulnerability CVE-2024-35195 and includes performance improvements.
- Fixes critical security issue where
verify=Falsein Session would persist cert verification settings incorrectly - Improves SSL performance by reusing global SSLContext, particularly beneficial for Windows systems with OpenSSL 3.x
- Adds support for optional character detection when vendored, defaulting to utf-8 if neither chardet nor charset_normalizer present
- Fixes bug in emoji length calculation for request content-length
- Deprecates
_get_connectionin favor of new public APIget_connection_with_tls_contextfor custom HTTPAdapters
💡 (2/5) Greptile learns from your feedback when you react with 👍/👎!
1 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings | Greptile
49cb012 to
85b9a3d
Compare
5f79874 to
a6799b5
Compare
a6799b5 to
4de1678
Compare
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Code Review Agent Run #1cf39dActionable Suggestions - 0Review Details
|
Changelist by BitoThis pull request implements the following key changes.
|
|
|
4de1678 to
a745d38
Compare
Code Review Agent Run #e14280Actionable Suggestions - 0Review Details
|
a745d38 to
6fbfc2e
Compare
6fbfc2e to
2054e63
Compare
renovate
Bot
changed the title
|
Running Code Quality on PRs by uploading data to Trunk will soon be removed. You can still run checks on your PRs using trunk-action - see the migration guide for more information. |
renovate
Bot
changed the title
2054e63 to
59b932d
Compare
renovate
Bot
changed the title
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Duplication | 0 |
TIP This summary will be updated as you push new changes. Give us feedback
This PR contains the following updates:
2.32.0→2.33.0==2.31.0→==2.33.0Requests
Sessionobject does not verify requests after making first request with verify=FalseCVE-2024-35195 / GHSA-9wx4-h78v-vm56
More information
Details
When using a
requests.Session, if the first request to a given origin is made withverify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even ifverify=Trueis explicitly specified later.This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.
This behavior affects versions of
requestsprior to 2.32.0.Severity
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Requests vulnerable to .netrc credentials leak via malicious URLs
CVE-2024-47081 / GHSA-9hjg-9r4m-mvj7
More information
Details
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with
trust_env=Falseon your Requests Session (docs).References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
CVE-2026-25645 / GHSA-gc5v-m9x4-r6x2
More information
Details
Impact
The
requests.utils.extract_zipped_paths()utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.Affected usages
Standard usage of the Requests library is not affected by this vulnerability. Only applications that call
extract_zipped_paths()directly are impacted.Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.
If developers are unable to upgrade, they can set
TMPDIRin their environment to a directory with restricted write access.Severity
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
psf/requests (requests)
v2.33.0Compare Source
Announcements
uses Requests, please take a look at #7271. Give it a try, and report
any gaps or feedback you may have in the issue. 📣
Security
requests.utils.extract_zipped_pathsnow extractscontents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.
Improvements
Bugfixes
malformed authentication to be applied to Requests on
Python 3.11+. (#7205)
Deprecations
Documentation
v2.32.5Compare Source
Bugfixes
a new class of issues in Requests that have had negative impact across a number
of use cases. The Requests team has decided to revert this feature as long term
maintenance of it is proving to be unsustainable in its current iteration.
Deprecations
v2.32.4Compare Source
Security
environment will retrieve credentials for the wrong hostname/machine from a
netrc file.
Improvements
Deprecations
v2.32.3Compare Source
Bugfixes
HTTPAdapter. (#6716)
without the
sslmodule. (#6724)v2.32.2Compare Source
Deprecations
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed
_get_connectiontoa new public API,
get_connection_with_tls_context. Existing customHTTPAdapters will need to migrate their code to use this new API.
get_connectionis considered deprecated in all versions of Requests>=2.32.0.A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1Compare Source
Bugfixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.