Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jun 10, 2025

This PR contains the following updates:

Package Change Age Confidence
requests (source, changelog) ==2.32.3==2.32.4 age confidence

GitHub Vulnerability Alerts

CVE-2024-47081

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2


Release Notes

psf/requests (requests)

v2.32.4

Compare Source

Security

  • CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
    environment will retrieve credentials for the wrong hostname/machine from a
    netrc file.

Improvements

  • Numerous documentation improvements

Deprecations

  • Added support for pypy 3.11 for Linux and macOS.
  • Dropped support for pypy 3.9 following its end of support.

Configuration

📅 Schedule: Branch creation - "" in timezone America/Vancouver, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 5 times, most recently from 613f64f to b457116 Compare June 17, 2025 01:04
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 8 times, most recently from dd3cfc9 to 5386632 Compare June 24, 2025 01:52
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 3 times, most recently from 7e5d0c4 to 095bcc0 Compare June 27, 2025 18:56
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 4 times, most recently from 8291062 to 8bb500a Compare July 10, 2025 03:48
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 8 times, most recently from e97941e to e5835e9 Compare July 23, 2025 17:47
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 2 times, most recently from 9fc2a29 to 60dedc1 Compare July 24, 2025 22:46
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch from 90ccfdf to 9bcabf9 Compare August 24, 2025 06:59
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 5 times, most recently from c273d86 to 9597b1b Compare September 12, 2025 22:54
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 7 times, most recently from ff72f9d to 3eba389 Compare September 20, 2025 00:47
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 3 times, most recently from 08bad40 to 2f0a1e9 Compare November 3, 2025 22:36
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 4 times, most recently from 15a64d4 to 802f538 Compare November 25, 2025 20:48
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 3 times, most recently from 6ba34d3 to 26df803 Compare December 3, 2025 04:36
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 2 times, most recently from c7c334a to a1894f6 Compare December 11, 2025 09:13
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch from a1894f6 to 9ec016f Compare December 17, 2025 00:37
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch 2 times, most recently from 7c14d27 to 797bc56 Compare January 7, 2026 10:55
@renovate renovate bot force-pushed the renovate/pypi-requests-vulnerability branch from 797bc56 to 88b9abb Compare January 8, 2026 00:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant