Skip to content

deps(deps): update requests requirement from >=2.28 to >=2.34.0#4

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requests-gte-2.34.0
Closed

deps(deps): update requests requirement from >=2.28 to >=2.34.0#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requests-gte-2.34.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 12, 2026

Updates the requirements on requests to permit the latest version.

Release notes

Sourced from requests's releases.

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2340-2026-05-11

Changelog

Sourced from requests's changelog.

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [requests](https://github.com/psf/requests) to permit the latest version.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.28.0...v2.34.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.34.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 12, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

IgorShutko added a commit that referenced this pull request May 17, 2026
Корень: универсальные RU/UA словари давали систематические
false positives на hardware-каталоге (Arduino, ЧПУ, авто-электроника).
Общий подход — безопасный матчинг, а не расширение словарей.

🔴 #1 consistency: placeholder не domain-aware
  - «заглушка» (socket blanking plug, торцевая заглушка для полива)
    УДАЛЕНА из списка — это реальный товар в hardware
  - «placeholder» убран
  - Разделено на STRONG (substring, безопасные: lorem ipsum, тест тест)
    и WEAK (todo/tbd/tba/n/a — только \bword\b + доминирование
    в коротком <60 симв тексте)
  - tba больше НЕ ловится внутри SKU 14AM00TBAS
  - 5 unit-тестов прошли

🔴 #2 audit.py: sitemap-страницы смешаны с категориями
  - INFO_KEYWORDS расширен (delivery_info, return_policy, contacts,
    brands, blog, faq, cart...)
  - is_home() ловит языковые главные (/ua/, /ru/)
  - is_info() режет языковой префикс перед матчингом
  - page_label(): в примерах печатается САМ title + длина,
    а не URL-слаг (было /ua/, /g102988977-...)

🟡 #3 text-quality: CAPS/letter_repeats шум на hardware
  - caps_lock: вайтлист brand+title токенов (INKBIRD, BIGTREETECH),
    скип SKU-подобных (цифра/дефис), расширен KNOWN_ABBR
  - letter_repeats: regex теперь только БУКВЫ, не \w —
    «30000 мАг» больше не false positive, «оооочень» ловится
  - 5 unit-тестов прошли

🟡 #4 apply_fixes: новый --fix decode-entities
  - html.unescape() по description/short/marketplace_description
  - превью before→after + счётчик + лог
  - на тесте: 44 товара, 1277 entities, &mdash;→—, &laquo;→«, &sup2;→²
  - описан в fix_recipes.md как Fix 11
  - отличие от inline-styles разъяснено (текст vs style-атрибуты)

🟡 #5 audit.py: HTML-фаза товаров возвращала 0 молча
  - sitemap fallback: если catalog-sitemap пуст → парсим
    sitemap-index, ищем под-карты catalog/product/tovar
  - catalog_phase_ok флаг в html_audit return
  - явный ⚠️ warning в REPORT.md если 0 товарных URL или
    0 успешно распарсено (вместо тихого частичного результата)

🟢 #6 audit.py: finding_meta +6 типов
  - description_empty, description_short, short_description_empty,
    marketplace_description_empty, no_marketplaces, no_images
  - больше нет «🟡 див. деталі» без рецепта

Smoke на protexttile: consistency 0 конфликтов (clean),
text-quality без caps/letter false positives, decode-entities
preview корректный. Все 14 .py syntax OK.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 19, 2026

Superseded by #5.

@dependabot dependabot Bot closed this May 19, 2026
@dependabot dependabot Bot deleted the dependabot/pip/requests-gte-2.34.0 branch May 19, 2026 03:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants