chore(deps): update dependency requests to v2.20.0 #83

dev-mend-for-github.lhy31512.workers.dev · 2025-01-07T10:33:34Z

This PR contains the following updates:

Package	Type	Update	Change
requests (source, changelog)	packages	minor	`==2.18.0` -> `==2.20.0`

By merging this PR, the issue #20 will be automatically resolved and closed:

Severity	CVSS Score	CVE	Reachability
High	7.5	CVE-2018-18074

Release Notes

psf/requests (requests)

`v2.20.0`

Compare Source

Bugfixes

Content-Type header parsing is now case-insensitive (e.g.
charset=utf8 v Charset=utf8).
Fixed exception leak where certain redirect urls would raise
uncaught urllib3 exceptions.
Requests removes Authorization header from requests redirected
from https to http on the same hostname. (CVE-2018-18074)
should_bypass_proxies now handles URIs without hostnames (e.g.
files).

Dependencies

Requests now supports urllib3 v1.24.

Deprecations

Requests has officially stopped support for Python 2.6.

`v2.19.1`

Compare Source

Bugfixes

Fixed issue where status_codes.py's init function failed trying
to append to a __doc__ value of None.

`v2.19.0`

Compare Source

Improvements

Warn user about possible slowdown when using cryptography version
< 1.3.4
Check for invalid host in proxy URL, before forwarding request to
adapter.
Fragments are now properly maintained across redirects. (RFC7231
7.1.2)
Removed use of cgi module to expedite library load time.
Added support for SHA-256 and SHA-512 digest auth algorithms.
Minor performance improvement to Request.content.
Migrate to using collections.abc for 3.7 compatibility.

Bugfixes

Parsing empty Link headers with parse_header_links() no longer
return one bogus entry.
Fixed issue where loading the default certificate bundle from a zip
archive would raise an IOError.
Fixed issue with unexpected ImportError on windows system which do
not support winreg module.
DNS resolution in proxy bypass no longer includes the username and
password in the request. This also fixes the issue of DNS queries
failing on macOS.
Properly normalize adapter prefixes for url comparison.
Passing None as a file pointer to the files param no longer
raises an exception.
Calling copy on a RequestsCookieJar will now preserve the cookie
policy correctly.

Dependencies

We now support idna v2.7.
We now support urllib3 v1.23.

`v2.18.4`

Compare Source

Improvements

Error messages for invalid headers now include the header name for
easier debugging

Dependencies

We now support idna v2.6.

`v2.18.3`

Compare Source

Improvements

Running $ python -m requests.help now includes the installed
version of idna.

Bugfixes

Fixed issue where Requests would raise ConnectionError instead of
SSLError when encountering SSL problems when using urllib3 v1.22.

`v2.18.2`

Compare Source

Bugfixes

requests.help no longer fails on Python 2.6 due to the absence of
ssl.OPENSSL_VERSION_NUMBER.

Dependencies

We now support urllib3 v1.22.

`v2.18.1`

Compare Source

Bugfixes

Fix an error in the packaging whereby the *.whl contained
incorrect data that regressed the fix in v2.17.3.

If you want to rebase/retry this PR, check this box

dev-mend-for-github.lhy31512.workers.dev · 2025-01-07T10:33:36Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: python/spec/fixtures/projects/pipenv/missing-system-library/Pipfile.lock

Command failed: pipenv lock
Creating a virtualenv for this project...
Pipfile: /tmp/renovate/repos/github/amaybaum-dev/dependabot-core3/python/spec/fixtures/projects/pipenv/missing-system-library/Pipfile
Using default python from /opt/containerbase/tools/pipenv/2023.12.1/3.13.1/bin/python (3.13.1) to create virtualenv...
created virtual environment CPython3.13.1.final.0-64 in 281ms
  creator CPython3Posix(dest=/tmp/renovate/cache/others/virtualenvs/missing-system-library-TojfN5s0, clear=False, no_vcs_ignore=False, global=False)
  seeder FromAppData(download=False, pip=bundle, via=copy, app_data_dir=/tmp/containerbase/cache/.local/share/virtualenv)
    added seed packages: pip==24.3.1
  activators BashActivator,CShellActivator,FishActivator,NushellActivator,PowerShellActivator,PythonActivator

✔ Successfully created virtual environment!
Virtualenv location: /tmp/renovate/cache/others/virtualenvs/missing-system-library-TojfN5s0
Locking [packages] dependencies...
False
ERROR:pip.subprocessor:Getting requirements to build wheel exited with 1
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/resolver.py", line 645, in _main
[ResolutionFailure]:       resolve_packages(
[ResolutionFailure]:       ~~~~~~~~~~~~~~~~^
[ResolutionFailure]:       pre, clear, verbose, system, write, requirements_dir, packages, category
[ResolutionFailure]:       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[ResolutionFailure]:       )
[ResolutionFailure]:       ^
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/resolver.py", line 612, in resolve_packages
[ResolutionFailure]:       results, resolver = resolve(
[ResolutionFailure]:       ~~~~~~~^
[ResolutionFailure]:       packages,
[ResolutionFailure]:       ^^^^^^^^^
[ResolutionFailure]:       ...<6 lines>...
[ResolutionFailure]:       requirements_dir=requirements_dir,
[ResolutionFailure]:       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[ResolutionFailure]:       )
[ResolutionFailure]:       ^
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/resolver.py", line 592, in resolve
[ResolutionFailure]:       return resolve_deps(
[ResolutionFailure]:       packages,
[ResolutionFailure]:       ...<7 lines>...
[ResolutionFailure]:       req_dir=requirements_dir,
[ResolutionFailure]:       )
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/utils/resolver.py", line 918, in resolve_deps
[ResolutionFailure]:       results, hashes, internal_resolver = actually_resolve_deps(
[ResolutionFailure]:       ~~~~~~~~~~~~~~~~~~~~~^
[ResolutionFailure]:       deps,
[ResolutionFailure]:       ^^^^^
[ResolutionFailure]:       ...<7 lines>...
[ResolutionFailure]:       req_dir=req_dir,
[ResolutionFailure]:       ^^^^^^^^^^^^^^^^
[ResolutionFailure]:       )
[ResolutionFailure]:       ^
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/utils/resolver.py", line 691, in actually_resolve_deps
[ResolutionFailure]:       resolver.resolve()
[ResolutionFailure]:       ~~~~~~~~~~~~~~~~^^
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/utils/resolver.py", line 448, in resolve
[ResolutionFailure]:       raise ResolutionFailure(message=str(e))
[pipenv.exceptions.ResolutionFailure]: Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv run pip install <requirement_name> to bypass this mechanism, then run $ pipenv graph to inspect the versions actually installed in the virtualenv.
  Hint: try $ pipenv lock --pre if it is a pre-release dependency.
ERROR: Getting requirements to build wheel exited with 1

Traceback (most recent call last):
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/bin/pipenv", line 8, in <module>
    sys.exit(cli())
             ~~~^^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/cli/options.py", line 58, in main
    return super().main(*args, **kwargs, windows_expand_args=False)
           ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/core.py", line 1688, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
                           ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/decorators.py", line 92, in new_func
    return ctx.invoke(f, obj, *args, **kwargs)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/vendor/click/decorators.py", line 33, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/cli/command.py", line 340, in lock
    do_lock(
    ~~~~~~~^
        state.project,
        ^^^^^^^^^^^^^^
    ...<4 lines>...
        categories=state.installstate.categories,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/routines/lock.py", line 65, in do_lock
    venv_resolve_deps(
    ~~~~~~~~~~~~~~~~~^
        packages,
        ^^^^^^^^^
    ...<9 lines>...
        old_lock_data=old_lock_data,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/utils/resolver.py", line 859, in venv_resolve_deps
    c = resolve(cmd, st, project=project)
  File "/opt/containerbase/tools/pipenv/2023.12.1/3.13.1/lib/python3.13/site-packages/pipenv/utils/resolver.py", line 728, in resolve
    raise RuntimeError("Failed to lock Pipfile.lock!")
RuntimeError: Failed to lock Pipfile.lock!

chore(deps): update dependency requests to v2.20.0

71f5500

dev-mend-for-github.lhy31512.workers.dev bot added the security fix Security fix generated by Mend label Jan 7, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency requests to v2.20.0 #83

chore(deps): update dependency requests to v2.20.0 #83

dev-mend-for-github.lhy31512.workers.dev bot commented Jan 7, 2025

dev-mend-for-github.lhy31512.workers.dev bot commented Jan 7, 2025

chore(deps): update dependency requests to v2.20.0 #83

Are you sure you want to change the base?

chore(deps): update dependency requests to v2.20.0 #83

Conversation

dev-mend-for-github.lhy31512.workers.dev bot commented Jan 7, 2025

Release Notes

v2.20.0

v2.19.1

v2.19.0

v2.18.4

v2.18.3

v2.18.2

v2.18.1

dev-mend-for-github.lhy31512.workers.dev bot commented Jan 7, 2025

⚠️ Artifact update problem

File name: python/spec/fixtures/projects/pipenv/missing-system-library/Pipfile.lock

`v2.20.0`

`v2.19.1`

`v2.19.0`

`v2.18.4`

`v2.18.3`

`v2.18.2`

`v2.18.1`