Update dependency httpx to v0.23.0 [SECURITY] #11
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.14.1->==0.23.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2021-41945
Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in
httpx.URL,httpx.Clientand some functions usinghttpx.URL.copy_with.Release Notes
encode/httpx (httpx)
v0.23.0Compare Source
Changed
utf-8as the default character set, instead of falling back tocharset-normalizerfor auto-detection. To enable automatic character set detection, see the documentation. (#2165)Fixed
URL.copy_withfor some oddly formed URL cases. (#2185)iter_bytesnever yields zero-length chunks. (#2068)Authorizationheader for redirects that are to the same origin, but are anhttp-to-httpsupgrade. (#2074)<16086 bytes of binary data>instead. (#2076)--proxiesargument in the command line client help. (#2125).requestonHTTPErrorexceptions. (#2158)v0.22.0Compare Source
Added
socksiopackage. (#2034)Fixed
__del__with unclosed clients. (#2026)Headers.update(...)to correctly handle repeated headers (#2038)v0.21.3Compare Source
Fixed
SyncByteStreamorAsyncByteStream. Regression in 0.21.2. (#2016)v0.21.2Compare Source
Fixed
v0.21.1Compare Source
Fixed
response.urlproperty is now correctly annotated asURL, instead ofOptional[URL]. (#1940)v0.21.0Compare Source
The 0.21.0 release integrates against a newly redesigned
httpcorebackend.Both packages ought to automatically update to the required versions, but if you are
seeing any issues, you should ensure that you have
httpx==0.21.*andhttpcore==0.14.*installed.Added
-v/--verboseis used.-v/--verboseis used.should be formatted as HTTP/1.1 or HTTP/2, based on the result of the HTTP/2 negotiation.
Removed
v0.20.0Compare Source
The 0.20.0 release adds an integrated command-line client, and also includes some
design changes. The most notable of these is that redirect responses are no longer
automatically followed, unless specifically requested.
This design decision prioritises a more explicit approach to redirects, in order
to avoid code that unintentionally issues multiple requests as a result of
misconfigured URLs.
For example, previously a client configured to send requests to
http://api.github.com/would end up sending every API request twice, as each request would be redirected to
https://api.github.com/.If you do want auto-redirect behaviour, you can enable this either by configuring
the client instance with
Client(follow_redirects=True), or on a per-requestbasis, with
.get(..., follow_redirects=True).This change is a classic trade-off between convenience and precision, with no "right"
answer. See discussion #1785 for more
context.
The other major design change is an update to the Transport API, which is the low-level
interface against which requests are sent. Previously this interface used only primitive
datastructures, like so...
Now the interface is much simpler...
Changed
allow_redirectsflag is nowfollow_redirectsand defaults toFalse.raise_for_status()method will now raise an exception for any responsesexcept those with 2xx status codes. Previously only 4xx and 5xx status codes
would result in an exception.
response = transport.handle_request(request).client.send()method no longer accepts atimeout=...argument, but theclient.build_request()does. This required by the signature change of theTransport API. The request timeout configuration is now stored on the request
instance, as
request.extensions['timeout'].Added
httpxcommand-line client..is_informational,.is_success,.is_redirect,.is_client_error, and.is_server_errorproperties for checking 1xx, 2xx, 3xx, 4xx, and 5xx response types. Note that the behaviour of
.is_redirectis slightly different in that it now returns True for all 3xx responses, in order to allow for a consistent set of properties onto the different HTTP status code types. Theresponse.has_redirect_locationlocation may be used to determine responses with properly formed URL redirects.Fixed
response.iter_bytes()no longer raises a ValueError when called on a response with no content. (Pull #1827)'wsgi.error'configuration now defaults tosys.stderr, and is corrected to be aTextIOinterface, not aBytesIOinterface. Additionally, the WSGITransport now accepts awsgi_errorconfiguration. (Pull #1828)v0.19.0Compare Source
Added
Client(allow_redirects=<bool>). (Pull #1790)charsetis included in the responseContent-Typeheader. (Pull #1791)Changed
modeargument fromhttpx.Proxy(..., mode=...). (Pull #1795)v0.18.2Compare Source
Added
httpx.USE_CLIENT_DEFAULT, used as the default toauthandtimeoutparameters in request methods. (Pull #1634)httpx.Client(http1=False, http2=True). (Pull #1624)Fixed
v0.18.1Compare Source
Changed
brotlicffipackage (Pull #1605)Request(..., stream=...)does not auto-generate any headers on the request instance. (Pull #1607)Fixed
timeout=...in top-level httpx.stream() function. (Pull #1613)v0.18.0Compare Source
The 0.18.x release series formalises our low-level Transport API, introducing the base classes
httpx.BaseTransportandhttpx.AsyncBaseTransport.See the "Custom transports" documentation and the
httpx.BaseTransport.handle_request()docstring for more complete details on implementing custom transports.Pull request #1522 includes a checklist of differences from the previous
httpcoretransport API, for developers implementing custom transports.The following API changes have been issuing deprecation warnings since 0.17.0 onwards, and are now fully deprecated...
Changed
httpx.BaseTransportorhttpx.AsyncBaseTransport,and should implement either the
handle_requestmethod orhandle_async_requestmethod. (Pull #1522, #1550)response.extproperty andResponse(ext=...)argument are now namedextensions. (Pull #1522)data=<bytes|str|bytes (a)iterator>in favour ofcontent=<bytes|str|bytes (a)iterator>has now been escalated to a deprecation warning. (Pull #1573)Response(on_close=...)from API, since it was a bit of leaking implementation detail. (Pull #1572)httpx.ResponseClosedis now namedhttpx.StreamClosed. (#1584)httpx.QueryParamsmodel now presents an immutable interface. There is a discussion on the design and motivation here. Useclient.params = client.params.merge(...)instead ofclient.params.update(...). The basic query manipulation methods arequery.set(...),query.add(...), andquery.remove(). (#1600)Added
RequestandResponseclasses can now be serialized using pickle. (#1579)data={"key": [None|int|float|bool]}cases. (Pull #1539)httpx.URL(**kwargs), for examplehttpx.URL(scheme="https", host="www.example.com", path="/'), orhttpx.URL("https://www.example.com/", username="[email protected]", password="123 456"). (Pull #1601)url.copy_with(params=...). (Pull #1601)url.paramsparameter, returning an immutableQueryParamsinstance. (Pull #1601)url.copy_set_param(),url.copy_add_param(),url.copy_remove_param(),url.copy_merge_params(). (Pull #1601)httpx.URLclass now performs port normalization, so:80ports are stripped fromhttpURLs and:443ports are stripped fromhttpsURLs. (Pull #1603)URL.hostproperty returns unicode strings for internationalized domain names. TheURL.raw_hostproperty returns byte strings with IDNA escaping applied. (Pull #1590)Fixed
files=...where unicode string is used as the file content. (Pull #1537)Client(base_url=...). (Pull #1532)request.contentattribute is now always available except for streaming content, which requires an explicit.read(). (Pull #1583)v0.17.1Compare Source
Fixed
CertTypesallowskeyfileandpasswordto be optional. (Pull #1503)v0.17.0Compare Source
Added
httpx.MockTransport(), allowing to mock out a transport using pre-determined responses. (Pull #1401, Pull #1449)httpx.HTTPTransport()andhttpx.AsyncHTTPTransport()default transports. (Pull #1399)httpx.Client(mounts=...). (Pull #1362)chunk_sizeparameter toiter_raw(),iter_bytes(),iter_text(). (Pull #1277)keepalive_expiryparameter tohttpx.Limits()configuration. (Pull #1398)httpx.Cookiesto display available cookies. (Pull #1411)params=<tuple>(previously onlyparams=<list>was supported). (Pull #1426)Fixed
raw_pathto ASGI scope. (Pull #1357)create_ssl_contextdefaults to usetrust_env=True. (Pull #1447)PATH_INFO. (Pull #1391)base_url. (Pull #1407)request.aclose(). (Pull #1465)v0.16.1Compare Source
Fixed
v0.16.0Compare Source
Changed
response.next()andresponse.anext()methods in favour ofresponse.next_requestattribute. (Pull #1339)Added
__enter__/__exit__/__aenter__/__aexit__in a way that supports subclasses ofClientandAsyncClient. (Pull #1336)v0.15.5Compare Source
Added
response.next_request(Pull #1334)v0.15.4Compare Source
Added
Headersand dicts or lists of two-tuples. Eg.assert response.headers == {"Content-Length": 24}(Pull #1326)Fixed
.read()whenResponseinstances are created withcontent=<str>(Pull #1324)v0.15.3Compare Source
Fixed
v0.15.2Compare Source
Fixed
response.elapsedproperty. (Pull #1313).stream(). (Pull #1312)v0.15.1Compare Source
Fixed
pathcomponent, as-per the ASGI spec. (Pull #1307)v0.15.0Compare Source
Added
response.num_bytes_downloaded. (Pull #1268)Request(content=...)for byte content, instead of overloadingRequest(data=...)(Pull #1266)url.copy_with(...). (Pull #1285)Requestinstances, vs defaultclient.headers. (Pull #1248)AsyncClientinstances will now raise warnings if garbage collected. (Pull #1197)Response(content=..., text=..., html=..., json=...)for creating usable response instances in code. (Pull #1265, #1297)Changed
url.pathis now URL escaped. (Pull #1285)url.userinfoandurl.queryare not URL escaped, and so return bytes. (Pull #1285)url.authorityproperty in favour ofurl.netloc, since "authority" was semantically incorrect. (Pull #1285)url.full_pathproperty in favour ofurl.raw_path, for better consistency with other parts of the API. (Pull #1285)chardetlibrary for auto-detecting charsets, instead defaulting to a simpler approach when no charset is specified. (#1269)Fixed
.netrclookups should use host, not host+port. (Pull #1298)Removed
URLLib3Transportclass no longer exists. We've published it instead as an example of a custom transport class. (Pull #1182)request.timerattribute, which was being used internally to setresponse.elapsed. (Pull #1249)response.decoderattribute, which was being used internally. (Pull #1276)Request.prepare()is now a private method. (Pull #1284)Headers.getlist()method had previously been deprecated in favour ofHeaders.get_list(). It is now fully removed.QueryParams.getlist()method had previously been deprecated in favour ofQueryParams.get_list(). It is now fully removed.URL.is_sslproperty had previously been deprecated in favour ofURL.scheme == "https". It is now fully removed.httpx.PoolLimitsclass had previously been deprecated in favour ofhttpx.Limits. It is now fully removed.max_keepalivesetting had previously been deprecated in favour of the more explicitmax_keepalive_connections. It is now fully removed.httpx.Timeout(5.0, connect_timeout=60.0)style had previously been deprecated in favour ofhttpx.Timeout(5.0, connect=60.0). It is now fully removed.httpx.Timeout(connect=60.0), had previously been deprecated in favour of enforcing a more explicit style, such ashttpx.Timeout(5.0, connect=60.0). This is now strictly enforced.v0.14.3Compare Source
Added
http.Response()may now be instantiated without arequest=...parameter. Useful for some unit testing cases. (Pull #1238)103 Early Hintsand425 Too Earlystatus codes. (Pull #1244)Fixed
DigestAuthnow handles responses that include multiple 'WWW-Authenticate' headers. (Pull #1240)__enter__/__exit__or__aenter__/__aexit__when client is used in a context manager style. (Pull #1218)v0.14.2Compare Source
Added
client.get(..., auth=None)to bypass the default authentication on a clients. (Pull #1115)client.auth = ...property setter. (Pull #1185)httpx.get(..., proxies=...)on top-level request functions. (Pull #1198)cookies=[(key, value)]list-of-two-tuples style usage. (Pull #1211)Fixed
Content-Lengthheader on streaming requests. (Pull #1170)HEADrequests, settingallow_redirects=True. (Pull #1183)httpxexception, not the underlyinghttpcoreexception. (Pull #1190)httpcoretraceback, when transport exceptions occur. (Pull #1199)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.