chore(deps): update dependency requests to v2.32.4 [security] #17
Conversation
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead. |
Welcome @renovate[bot]! 🎉Great PR! I've analyzed your code changes for:
Ready to see the full review?
Let's make your code even better together! 🚀 |
|
By default, I don't review pull requests opened by bots. If you would like me to review this pull request anyway, you can request a review via the |
Reviewer's Guide by SourceryThis pull request updates the requests dependency from version 2.31.0 to 2.32.2 to address a security vulnerability. The vulnerability occurs when using a Requests Session and setting Sequence diagram showing the TLS verification behavior fix in Requests 2.32.2sequenceDiagram
participant C as Client
participant S as Requests Session
participant H as Host
Note over C,H: Before fix (2.31.0)
C->>S: Create Session
C->>S: First request (verify=False)
S->>H: Request without cert verification
H-->>S: Response
C->>S: Second request (verify=True)
S->>H: Request still without cert verification
H-->>S: Response
Note over C,H: After fix (2.32.2)
C->>S: Create Session
C->>S: First request (verify=False)
S->>H: Request without cert verification
H-->>S: Response
C->>S: Second request (verify=True)
S->>H: Request with cert verification
H-->>S: Response
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Join our Discord community for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
|
Here's the code health analysis summary for commits Analysis Summary
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
This PR updates the requests library from v2.31.0 to v2.32.2 to address security vulnerability CVE-2024-35195 and includes performance improvements.
- Fixes critical security issue where
verify=Falsein Session would persist cert verification settings incorrectly - Improves SSL performance by reusing global SSLContext, particularly beneficial for Windows systems with OpenSSL 3.x
- Adds support for optional character detection when vendored, defaulting to utf-8 if neither chardet nor charset_normalizer present
- Fixes bug in emoji length calculation for request content-length
- Deprecates
_get_connectionin favor of new public APIget_connection_with_tls_contextfor custom HTTPAdapters
💡 (2/5) Greptile learns from your feedback when you react with 👍/👎!
1 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings | Greptile
renovate
bot
force-pushed
the
renovate/pypi-requests-vulnerability
branch
3 times, most recently
from
49cb012 to
85b9a3d
Compare
renovate
bot
force-pushed
the
renovate/pypi-requests-vulnerability
branch
2 times, most recently
from
5f79874 to
a6799b5
Compare
renovate
bot
force-pushed
the
renovate/pypi-requests-vulnerability
branch
from
a6799b5 to
4de1678
Compare
|
Code Review Agent Run #1cf39dActionable Suggestions - 0Review Details
|
Changelist by BitoThis pull request implements the following key changes.
|
|
|
renovate
bot
force-pushed
the
renovate/pypi-requests-vulnerability
branch
from
4de1678 to
a745d38
Compare
Code Review Agent Run #e14280Actionable Suggestions - 0Review Details
|
renovate
bot
force-pushed
the
renovate/pypi-requests-vulnerability
branch
from
a745d38 to
6fbfc2e
Compare
renovate
bot
force-pushed
the
renovate/pypi-requests-vulnerability
branch
from
6fbfc2e to
2054e63
Compare
renovate
bot
changed the title
|
Running Code Quality on PRs by uploading data to Trunk will soon be removed. You can still run checks on your PRs using trunk-action - see the migration guide for more information. |
renovate
bot
changed the title
This PR contains the following updates:
2.32.0→2.32.4==2.31.0→==2.32.4GitHub Vulnerability Alerts
CVE-2024-47081
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with
trust_env=Falseon your Requests Session (docs).References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
CVE-2024-35195
When using a
requests.Session, if the first request to a given origin is made withverify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even ifverify=Trueis explicitly specified later.This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity.
This behavior affects versions of
requestsprior to 2.32.0.Release Notes
psf/requests (requests)
v2.32.4Compare Source
Security
environment will retrieve credentials for the wrong hostname/machine from a
netrc file.
Improvements
Deprecations
v2.32.3Compare Source
Bugfixes
HTTPAdapter. (#6716)
without the
sslmodule. (#6724)v2.32.2Compare Source
Deprecations
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed
_get_connectiontoa new public API,
get_connection_with_tls_context. Existing customHTTPAdapters will need to migrate their code to use this new API.
get_connectionis considered deprecated in all versions of Requests>=2.32.0.A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1Compare Source
Bugfixes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.