0.2.0

Changed

• Breaking: Yama() raises ValueError for a plain http:// base URL (argument or YAMA_API_BASE_URL) unless the host is localhost, 127.0.0.1 or [::1], and then ignores proxies set in the environment, so your API key isn't sent unencrypted over a network. Use https:// for any other host. If you pass your own http_client, its proxy settings still apply.
• The ValueError for a bad API key or base URL now says where the value came from: the argument (api_key, base_url) or the environment variable (YAMA_API_KEY, YAMA_API_BASE_URL).

Fixed

• A 429 with a malformed Retry-After header raises RateLimitError or retries as usual, instead of a bare ValueError.
• With your own httpx.Client whose response hook calls raise_for_status(), an error status raises the matching error, such as NotFoundError, instead of APIConnectionError.
• The fake API in yama.testing answers 400, instead of crashing, when a code's unit isn't a string.
• Passing your own httpx.Client that has auth set no longer replaces your API key, so requests no longer fail with 401.
• A base URL with whitespace around it, such as a trailing space or newline from a .env file, now works instead of failing every request.
• A base URL with a query or fragment raises ValueError instead of sending requests to the wrong path.
• A base_url that isn't a string raises TypeError.
• A pagination next link or base URL with a malformed internationalised host name (such as xn--a-) raises YamaError or ValueError as other bad URLs do, instead of an error from the idna package.

Security

• An error for a response the client can't read no longer carries the response's values, so they can't reach logs or error trackers; it names the fields that failed instead.
• A base URL with a username or password (https://user:pw@host) raises ValueError. Before, they were sent as Basic auth in place of your API key, and repr() of the client showed them.