Skip to content

Bump requests from 2.33.0 to 2.34.0 in /backend#4641

Merged
marcoacierno merged 4 commits into
mainfrom
dependabot/pip/backend/requests-2.34.0
May 17, 2026
Merged

Bump requests from 2.33.0 to 2.34.0 in /backend#4641
marcoacierno merged 4 commits into
mainfrom
dependabot/pip/backend/requests-2.34.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 13, 2026

Bumps requests from 2.33.0 to 2.34.0.

Release notes

Sourced from requests's releases.

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2340-2026-05-11

v2.33.1

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump requests from 2.33.0 to 2.34.0 in /backend
8563856 
Bumps [requests](https://github.com/psf/requests) from 2.33.0 to 2.34.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.0...v2.34.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies python Pull requests that update Python code labels May 13, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 13, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
pycon Ready Ready Preview May 17, 2026 10:14pm

@marcoacierno
Copy link
Copy Markdown
Member

marcoacierno commented May 17, 2026

@claude run uv and update the lockfile

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 17, 2026 •
edited
Loading

Bumps requests from 2.33.0 to 2.34.0. No issues found.

@marcoacierno
Copy link
Copy Markdown
Member

marcoacierno commented May 17, 2026

@claude run uv and update the lockfile

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 17, 2026 •
edited
Loading

Claude finished @marcoacierno's task in 50s —— View job

Updating lockfile for requests bump

  • Check if uv is available in the environment
  • Run uv lock to update the lockfile (blocked)
  • Commit and push changes (blocked)

Issue: uv is not installed in the CI environment, and I don't have permission to install packages in this non-interactive context.

To fix this, please either:

  1. Add setup-uv to your workflow before the Claude action:

    - uses: astral-sh/setup-uv@v5
- uses: anthropics/claude-code-action@v1

  2. Or run locally (quickest for now):

    cd backend
uv lock
git add uv.lock
git commit -m "Update lockfile for requests 2.34.0"
git push

@marcoacierno
Copy link
Copy Markdown
Member

marcoacierno commented May 17, 2026

@claude run uv and update the lockfile

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 17, 2026 •
edited
Loading

Claude finished @marcoacierno's task in 2m 53s —— View job

Updating lockfile for requests bump

  • Check if uv is available in the environment
  • Run uv lock to update the lockfile
  • Commit and push changes

Updated lockfile with requests 2.33.0 -> 2.34.0 (also picked up wagtail-factories 4.2.1 -> 4.4.0 as a transitive update).

| View commit

@github-actions @marcoacierno
Update uv.lock for requests 2.34.0
d083796 
Co-authored-by: Marco Acierno <marcoacierno@users.noreply.github.com>
@codecov
Copy link
Copy Markdown

codecov Bot commented May 17, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.52%. Comparing base (62c5d58) to head (d083796).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #4641   +/-   ##
=======================================
  Coverage   92.52%   92.52%           
=======================================
  Files         359      359           
  Lines       10791    10791           
  Branches      821      821           
=======================================
  Hits         9984     9984           
  Misses        696      696           
  Partials      111      111
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@marcoacierno marcoacierno merged commit 08a5414 into main May 17, 2026
7 of 8 checks passed
@marcoacierno marcoacierno deleted the dependabot/pip/backend/requests-2.34.0 branch May 17, 2026 23:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@marcoacierno