psf/requests

📋 Changes

• Moved `headers` input type back to `Mapping` to avoid invariance issues with `MutableMapping` and inferred dict types. Users calling `Request.headers.update()` may need to narrow typing in their code. (#7441)

📋 Changes

• Widened `json` input type from `dict` and `list` to `Mapping`
• Changed `headers` input type to MutableMapping and removed `None` from
• `Response.reason` moved from `str | None` to `str` to improve handling
• Fixed a bug where some bodies with custom `__getattr__` implementations

✨ New Contributors

• @k223kim made their first contribution in https://github.com/psf/requests/pull/7433
• Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

📋 Changes

• Requests 2.34.0 introduces inline types, replacing those provided by
• Digest Auth hashing algorithms have added `usedforsecurity=False` to clarify
• Requests added support for Python 3.15 based on beta1. Downstream projects
• Requests added support for Python 3.14t. (#7419)
• ``Response.history`` no longer contains a reference to itself, preventing
• Requests no longer performs greedy matching on no_proxy domains. The
• Requests no longer incorrectly strips duplicate leading slashes in

✨ New Contributors

• @cjriches made their first contribution in https://github.com/psf/requests/pull/7365
• @dsanader made their first contribution in https://github.com/psf/requests/pull/7376
• @DimitriPapadopoulos made their first contribution in https://github.com/psf/requests/pull/7393
• @joshua-51 made their first contribution in https://github.com/psf/requests/pull/7416
• @eggsort made their first contribution in https://github.com/psf/requests/pull/7421
• @typhon8 made their first contribution in https://github.com/psf/requests/pull/7315
• @bastimeyer made their first contribution in https://github.com/psf/requests/pull/7425
• Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2340-2026-05-11

📋 Changes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
• Fixed Content-Type header parsing for malformed values. (#7309)
• Improved error consistency for malformed header values. (#7308)

✨ New Contributors

• @ferdnyc made their first contribution in https://github.com/psf/requests/pull/7277
• Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30

📋 Changes

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣
• CVE-2026-25645 ``requests.utils.extract_zipped_paths`` now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.
• Migrated to a PEP 517 build system using setuptools. (#7012)
• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)
• Dropped support for Python 3.9 following its end of support. (#7196)
• Various typo fixes and doc improvements.

✨ New Contributors

• @M0d3v1 made their first contribution in https://github.com/psf/requests/pull/6865
• @aminvakil made their first contribution in https://github.com/psf/requests/pull/7220
• @E8Price made their first contribution in https://github.com/psf/requests/pull/6960
• @mitre88 made their first contribution in https://github.com/psf/requests/pull/7244
• @magsen made their first contribution in https://github.com/psf/requests/pull/6553
• @Rohan5commit made their first contribution in https://github.com/psf/requests/pull/7227
• Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

📋 Changes

• The SSLContext caching feature originally introduced in 2.32.0 has created
• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

📋 Changes

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
• Numerous documentation improvements
• Added support for pypy 3.11 for Linux and macOS. (#6926)
• Dropped support for pypy 3.9 following its end of support. (#6926)

📋 Changes

• Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of
• Fixed issue where Requests started failing to run on Python versions compiled

📋 Changes

• To provide a more stable migration for custom HTTPAdapters impacted

📋 Changes

• Add missing test certs to the sdist distributed on PyPI.

📦 🐍 PYCON US 2024 EDITION 🐍

• Security
• Fixed an issue where setting `verify=False` on the first request from a
• Session will cause subsequent requests to the _same origin_ to also ignore
• cert verification, regardless of the value of `verify`.
• (https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56)
• Improvements
• `verify=True` now reuses a global SSLContext which should improve
• request time variance between first and subsequent requests. It should
• + 27 more

✨ New Contributors

• @matthewarmand made their first contribution in https://github.com/psf/requests/pull/6258
• @cpzt made their first contribution in https://github.com/psf/requests/pull/6456
• @ittner made their first contribution in https://github.com/psf/requests/pull/6214
• @ZetaTwo made their first contribution in https://github.com/psf/requests/pull/6465
• @joren485 made their first contribution in https://github.com/psf/requests/pull/6475
• @elprimato made their first contribution in https://github.com/psf/requests/pull/6266
• @dependabot made their first contribution in https://github.com/psf/requests/pull/6499
• @Ocupe made their first contribution in https://github.com/psf/requests/pull/6507
• + 17 more

📋 Changes

• Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential

📋 Changes

• ⚠️ Added support for urllib3 2.0. ⚠️

📋 Changes

• Requests now defers chunked requests to the urllib3 implementation to improve
• Requests relaxes header component requirements to support bytes/str subclasses. (#6356)

📋 Changes

• Requests now supports charset\_normalizer 3.x. (#6261)
• Updated MissingSchema exception to suggest https scheme rather than http. (#6188)

✨ New Contributors

• @slyapustin made their first contribution in https://github.com/psf/requests/pull/6188
• @mila made their first contribution in https://github.com/psf/requests/pull/6200
• @DavidCain made their first contribution in https://github.com/psf/requests/pull/6204
• @jaap3 made their first contribution in https://github.com/psf/requests/pull/6234
• @deedy5 made their first contribution in https://github.com/psf/requests/pull/6261
• @winmorre made their first contribution in https://github.com/psf/requests/pull/6262
• @oliviacrain made their first contribution in https://github.com/psf/requests/pull/6291
• @ch-iv made their first contribution in https://github.com/psf/requests/pull/6317
• + 2 more

📋 Changes

• Speed optimization in `iter_content` with transition to `yield from`. (#6170)
• Added support for chardet 5.0.0 (#6179)
• Added support for charset-normalizer 2.1.0 (#6169)

✨ New Contributors

• @hswong3i made their first contribution in https://github.com/psf/requests/pull/6179
• @frenzymadness made their first contribution in https://github.com/psf/requests/pull/6169
• Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2281-2022-06-29

📋 Changes

• ⚠️ Requests has officially dropped support for Python 2.7. ⚠️ (#6091)
• Requests has officially dropped support for Python 3.6 (including pypy3). (#6091)
• Wrap JSON parsing issues in Request's JSONDecodeError for payloads without
• Parse header components consistently, raising an InvalidHeader error in
• Added provisional 3.11 support with current beta build. (#6155)
• Requests got a makeover and we decided to paint it black. (#6095)
• Fixed bug where setting `CURL_CA_BUNDLE` to an empty string would disable
• Fixed urllib3 exception leak, wrapping `urllib3.exceptions.SSLError` with
• + 2 more

✨ New Contributors

• @marwanpro made their first contribution in https://github.com/psf/requests/pull/6035
• @chyzzqo2 made their first contribution in https://github.com/psf/requests/pull/6036
• @Chavithra made their first contribution in https://github.com/psf/requests/pull/6044
• @sha016 made their first contribution in https://github.com/psf/requests/pull/5978
• @BoboTiG made their first contribution in https://github.com/psf/requests/pull/4766
• @davidshivaji made their first contribution in https://github.com/psf/requests/pull/6133
• @ogayot made their first contribution in https://github.com/psf/requests/pull/6136
• Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2280-2022-06-09

📋 Changes

• Fixed parsing issue that resulted in the `auth` component being

📋 Changes

• Officially added support for Python 3.10. (#5928)
• Added a `requests.exceptions.JSONDecodeError` to unify JSON exceptions between
• Improved error text for misnamed `InvalidSchema` and `MissingSchema`
• Improved proxy parsing for proxy URLs missing a scheme. This will address
• Fixed defect in `extract_zipped_paths` which could result in an infinite loop
• Fixed handling for `AttributeError` when calculating length of files obtained
• Fixed urllib3 exception leak, wrapping `urllib3.exceptions.InvalidHeader` with
• Fixed bug where two Host headers were sent for chunked requests. (#5391)
• + 4 more

✨ New Contributors

• @steveberdy made their first contribution in https://github.com/psf/requests/pull/5877
• @Akay7 made their first contribution in https://github.com/psf/requests/pull/5821
• @mgorny made their first contribution in https://github.com/psf/requests/pull/5890
• @tl-hbk made their first contribution in https://github.com/psf/requests/pull/5851
• @itsadok made their first contribution in https://github.com/psf/requests/pull/5899
• @theGOTOguy made their first contribution in https://github.com/psf/requests/pull/5906
• @verhovsky made their first contribution in https://github.com/psf/requests/pull/5910
• @hodbn made their first contribution in https://github.com/psf/requests/pull/5391
• + 5 more