Bump requests from 2.32.5 to 2.33.0 by dependabot[bot] · Pull Request #175 · SocketDev/socket-python-cli

dependabot · 2026-03-26T18:27:42Z

Bumps requests from 2.32.5 to 2.33.0.

Release notes

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

socket-security · 2026-03-26T18:28:11Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/requests@2.32.5 ⏵ 2.33.0	⁺¹	⁺²

View full report

github-actions · 2026-03-26T18:28:32Z

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.84.dev3

Docker image: socketdev/cli:pr-175

socket-security-staging · 2026-04-07T16:11:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/requests@2.32.5 ⏵ 2.33.0		⁺²

View full report

Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

…sions Bundles the following Dependabot PRs into uv.lock (regenerated): - urllib3 2.6.3 -> 2.7.0 (closes #200) - gitpython 3.1.46 -> 3.1.50 (closes #198) - python-dotenv 1.2.1 -> 1.2.2 (closes #190) - pytest 9.0.2 -> 9.0.3 (closes #188) - uv 0.9.21 -> 0.11.6 (closes #184) - cryptography 46.0.5 -> 46.0.7 (closes #181) - pygments 2.19.2 -> 2.20.0 (closes #177) - requests 2.32.5 -> 2.33.0 (closes #175) All eight target versions were verified through Socket Firewall (sfw) on the full transitive dependency tree (15 packages including transitive deps fetched clean; no malware/typosquat/supply-chain alerts). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

…sions Bundles the nine open Dependabot PRs against the main app into a single uv.lock regeneration: - urllib3 2.6.3 -> 2.7.0 (closes #200) - gitpython 3.1.46 -> 3.1.50 (closes #198) - python-dotenv 1.2.1 -> 1.2.2 (closes #190) - pytest 9.0.2 -> 9.0.3 (closes #188) - uv 0.9.21 -> 0.11.6 (closes #184) - cryptography 46.0.5 -> 46.0.7 (closes #181) - pygments 2.19.2 -> 2.20.0 (closes #177) - requests 2.32.5 -> 2.33.0 (closes #175) - idna 3.11 -> 3.15 (closes #205, CVE-2026-45409) idna 3.14 fixed CVE-2026-45409 -- a quadratic-time DoS vector via oversized inputs that bypassed the earlier CVE-2024-3651 mitigation. The other bumps are version-currentness hygiene. All nine target versions verified through Socket Firewall (sfw) on the full transitive dependency tree; no malware / typosquat / supply-chain alerts surfaced. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Bundles the nine open Dependabot PRs against the main app into a single uv.lock regeneration. Where Dependabot's target trailed the latest published release, we went to the current latest and re-verified through sfw: - urllib3 2.6.3 -> 2.7.0 (closes #200) - gitpython 3.1.46 -> 3.1.50 (closes #198) - python-dotenv 1.2.1 -> 1.2.2 (closes #190) - pytest 9.0.2 -> 9.0.3 (closes #188) - uv 0.9.21 -> 0.11.17 (closes #210; Dependabot targeted 0.11.15) - cryptography 46.0.5 -> 46.0.7 (closes #181) - pygments 2.19.2 -> 2.20.0 (closes #177) - requests 2.32.5 -> 2.33.0 (closes #175) - idna 3.11 -> 3.15 (closes #205, CVE-2026-45409) idna 3.14 fixed CVE-2026-45409 -- a quadratic-time DoS via oversized inputs that bypassed the earlier CVE-2024-3651 mitigation. The rest are hygiene. All nine final versions verified clean through Socket Firewall (sfw) on the full transitive tree. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

dependabot · 2026-05-29T22:01:29Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 26, 2026

dependabot Bot requested a review from a team as a code owner March 26, 2026 18:27

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 26, 2026

dependabot Bot force-pushed the dependabot/uv/requests-2.33.0 branch from 934010f to 2823a62 Compare April 7, 2026 16:10

dependabot Bot force-pushed the dependabot/uv/requests-2.33.0 branch 3 times, most recently from b0118b6 to 0559d3d Compare April 17, 2026 08:16

dependabot Bot force-pushed the dependabot/uv/requests-2.33.0 branch 2 times, most recently from 61e0c21 to 707777e Compare April 23, 2026 04:24

dependabot Bot force-pushed the dependabot/uv/requests-2.33.0 branch from 707777e to e9f0067 Compare April 24, 2026 18:10

lelia mentioned this pull request May 18, 2026

Harden CLI exit behavior, CI/CD guardrails, bundled dep updates #203

Closed

10 tasks

lelia mentioned this pull request May 29, 2026

Bundle dependency updates, harden Dependabot reviews #207

Merged

5 tasks

lelia closed this in 6969361 May 29, 2026

dependabot Bot deleted the dependabot/uv/requests-2.33.0 branch May 29, 2026 22:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump requests from 2.32.5 to 2.33.0#175

Bump requests from 2.32.5 to 2.33.0#175
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/requests-2.33.0

dependabot Bot commented on behalf of github Mar 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

socket-security-staging Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Uh oh!

socket-security Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security-staging Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Mar 26, 2026 •

edited

Loading

socket-security Bot commented Mar 26, 2026 •

edited

Loading

github-actions Bot commented Mar 26, 2026 •

edited

Loading

socket-security-staging Bot commented Apr 7, 2026 •

edited

Loading