build(deps): bump requests from 2.31.0 to 2.32.2 in /ci/fireci #6853

dependabot · 2025-04-09T15:18:33Z

Bumps requests from 2.31.0 to 2.32.2.

Release notes

v2.32.2

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)

Fixed deserialization bug in JSONDecodeError. (#6629)

Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)

Fixed deserialization bug in JSONDecodeError. (#6629)

Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

Deprecations

... (truncated)

Commits

88dce9d v2.32.2
c98e4d1 Merge pull request #6710 from nateprewitt/api_rename
92075b3 Add deprecation warning
aa1461b Move _get_connection to get_connection_with_tls_context
970e8ce v2.32.1
d6ebc4a v2.32.0
9a40d12 Avoid reloading root certificates to improve concurrent performance (#6667)
0c030f7 Merge pull request #6702 from nateprewitt/no_char_detection
555b870 Allow character detection dependencies to be optional in post-packaging steps
d6dded3 Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-test
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

github-actions · 2025-04-09T15:18:44Z

📝 PRs merging into main branch

Our main branch should always be in a releasable state. If you are working on a larger change, or if you don't want this change to see the light of the day just yet, consider using a feature branch first, and only merge into the main branch when the code complete and ready to be released.

github-actions · 2025-04-09T15:18:45Z

📝 PRs merging into main branch

Our main branch should always be in a releasable state. If you are working on a larger change, or if you don't want this change to see the light of the day just yet, consider using a feature branch first, and only merge into the main branch when the code complete and ready to be released.

github-actions · 2025-04-09T15:33:12Z

Test Results

1 034 files ±0 1 034 suites ±0 34m 32s ⏱️ -18s
5 874 tests ±0 5 852 ✅ ±0 22 💤 ±0 0 ❌ ±0
11 811 runs ±0 11 767 ✅ ±0 44 💤 ±0 0 ❌ ±0

Results for commit d0e39a2. ± Comparison against base commit 9293eec.

♻️ This comment has been updated with latest results.

rlazo · 2025-04-15T14:17:35Z

@dependabot rebase

Bumps [requests](https://github.com/psf/requests) from 2.31.0 to 2.32.2. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.32.2) --- updated-dependencies: - dependency-name: requests dependency-version: 2.32.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2025-04-15T14:18:50Z

Vertex AI Mock Responses Check ⚠️

A newer major version of the mock responses for Vertex AI unit tests is available. update_responses.sh should be updated to clone the latest version of the responses: v10.0

dependabot · 2025-04-15T14:24:05Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

google-oss-bot · 2025-04-15T14:50:00Z

Size Report ¹

Affected Products

No changes between base commit (9293eec) and merge commit (574f7dc).

Test Logs

https://storage.googleapis.com/firebase-sdk-metric-reports/FlqXEzAP3R.html

google-oss-bot · 2025-04-15T15:14:12Z

Coverage Report ¹

Affected Products

firebase-database
Overall coverage changed from 50.21% (9293eec) to 50.16% (574f7dc) by -0.04%.
Filename Base (9293eec) Merge (574f7dc) Diff
ChildChangeAccumulator.java 96.67% 83.33% -13.33%
firebase-firestore
Overall coverage changed from 45.78% (9293eec) to 45.78% (574f7dc) by -0.00%.
Filename Base (9293eec) Merge (574f7dc) Diff
DeleteMutation.java 95.24% 90.48% -4.76%
firebase-messaging
Overall coverage changed from 84.13% (9293eec) to 84.02% (574f7dc) by -0.11%.
Filename Base (9293eec) Merge (574f7dc) Diff
Metadata.java 41.27% 36.51% -4.76%
firebase-storage
Overall coverage changed from 84.37% (9293eec) to 84.33% (574f7dc) by -0.04%.
Filename Base (9293eec) Merge (574f7dc) Diff
StreamDownloadTask.java 88.89% 88.41% -0.48%

Test Logs

https://storage.googleapis.com/firebase-sdk-metric-reports/ohxevDPjYG.html

google-oss-bot · 2025-04-15T15:22:44Z

Startup Time Report ¹

The report is too large (122,584 chars) to be displayed on GitHub. Please check this report on GCS.

https://storage.googleapis.com/firebase-sdk-metric-reports/nIX0hgTQ6p/index.html

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 9, 2025

google-oss-bot added the size/XS label Apr 9, 2025

dependabot bot force-pushed the dependabot/pip/ci/fireci/requests-2.32.2 branch from 8409d79 to d0e39a2 Compare April 15, 2025 14:18

rlazo closed this Apr 15, 2025

rlazo reopened this Apr 15, 2025

rlazo approved these changes Apr 15, 2025

View reviewed changes

rlazo merged commit 24b9dad into main Apr 15, 2025
396 of 516 checks passed

rlazo deleted the dependabot/pip/ci/fireci/requests-2.32.2 branch April 15, 2025 15:07

firebase locked and limited conversation to collaborators May 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump requests from 2.31.0 to 2.32.2 in /ci/fireci #6853

build(deps): bump requests from 2.31.0 to 2.32.2 in /ci/fireci #6853

Uh oh!

dependabot bot commented on behalf of github Apr 9, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Apr 9, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Apr 9, 2025

Uh oh!

github-actions bot commented Apr 9, 2025 •

edited

Loading

Uh oh!

rlazo commented Apr 15, 2025

Uh oh!

github-actions bot commented Apr 15, 2025

Uh oh!

dependabot bot commented on behalf of github Apr 15, 2025

Uh oh!

google-oss-bot commented Apr 15, 2025

Uh oh!

Uh oh!

google-oss-bot commented Apr 15, 2025

`firebase-database`

`firebase-firestore`

`firebase-messaging`

`firebase-storage`

Uh oh!

google-oss-bot commented Apr 15, 2025

Uh oh!

Uh oh!

build(deps): bump requests from 2.31.0 to 2.32.2 in /ci/fireci #6853

build(deps): bump requests from 2.31.0 to 2.32.2 in /ci/fireci #6853

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.32.2

2.32.2 (2024-05-21)

v2.32.1

2.32.1 (2024-05-20)

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

2.32.2 (2024-05-21)

2.32.1 (2024-05-20)

2.32.0 (2024-05-20)

Uh oh!

github-actions bot commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 PRs merging into main branch

Uh oh!

github-actions bot commented Apr 9, 2025

📝 PRs merging into main branch

Uh oh!

github-actions bot commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

rlazo commented Apr 15, 2025

Uh oh!

github-actions bot commented Apr 15, 2025

Vertex AI Mock Responses Check ⚠️

Uh oh!

dependabot bot commented on behalf of github Apr 15, 2025

Uh oh!

google-oss-bot commented Apr 15, 2025

Size Report 1

Affected Products

Test Logs

Uh oh!

Uh oh!

google-oss-bot commented Apr 15, 2025

Coverage Report 1

Affected Products

firebase-database

firebase-firestore

firebase-messaging

firebase-storage

Test Logs

Uh oh!

google-oss-bot commented Apr 15, 2025

Startup Time Report 1

Uh oh!

Uh oh!

dependabot bot commented on behalf of github Apr 9, 2025 •

edited

Loading

github-actions bot commented Apr 9, 2025 •

edited

Loading

github-actions bot commented Apr 9, 2025 •

edited

Loading

Size Report ¹

Coverage Report ¹

`firebase-database`

`firebase-firestore`

`firebase-messaging`

`firebase-storage`

Startup Time Report ¹