Test regressions with urllib3 2.4.0 on Python 3.13

[musicinmybrain]

Expected Result

(all tests pass)

Actual Result

====================================== short test summary info =======================================
FAILED tests/test_requests.py::TestRequests::test_proxy_error - Failed: DID NOT RAISE <class 'requests.exceptions.ProxyError'>
FAILED tests/test_requests.py::TestRequests::test_pyopenssl_redirect - requests.exceptions.SSLError: HTTPSConnectionPool(host='127.0.0.1', port=36165): Max retries exce...
FAILED tests/test_requests.py::TestRequests::test_auth_is_stripped_on_http_downgrade - requests.exceptions.SSLError: HTTPSConnectionPool(host='127.0.0.1', port=36165): Max retries exce...
FAILED tests/test_requests.py::TestPreparingURLs::test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert - requests.exceptions.SSLError: HTTPSConnectionPool(host='localhost', port=43243): Max retries exce...
============ 4 failed, 586 passed, 15 skipped, 1 xfailed, 18 warnings in 71.93s (0:01:11) ============

Reproduction Steps

$ git clone https://github.com/psf/requests
$ cd requests
$ git checkout v2.32.3
$ tox -e py313

Observe the output from “Actual result,” above.

Now, try upper-bounding the version of urllib3 as an experiment:

diff --git a/setup.py b/setup.py
index 1b0eb377..97baee5f 100755
--- a/setup.py
+++ b/setup.py
@@ -61,7 +61,7 @@ if sys.argv[-1] == "publish":
 requires = [
     "charset_normalizer>=2,<4",
     "idna>=2.5,<4",
-    "urllib3>=1.21.1,<3",
+    "urllib3>=1.21.1,<2.4.0",
     "certifi>=2017.4.17",
 ]
 test_requirements = [

$ tox -e py313
====================================== short test summary info =======================================
FAILED tests/test_requests.py::TestRequests::test_proxy_error - Failed: DID NOT RAISE <class 'requests.exceptions.ProxyError'>
============ 1 failed, 589 passed, 15 skipped, 1 xfailed, 18 warnings in 77.36s (0:01:17) ============

This appears to confirm that three of the failing tests are associated with the upgrade from urllib3 2.3.0 to 2.4.0.

System Information

$ python -m requests.help

{
  "chardet": {
    "version": null
  },
  "charset_normalizer": {
    "version": "3.4.1"
  },
  "cryptography": {
    "version": ""
  },
  "idna": {
    "version": "3.10"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.13.2"
  },
  "platform": {
    "release": "6.13.9-200.fc41.x86_64",
    "system": "Linux"
  },
  "pyOpenSSL": {
    "openssl_version": "",
    "version": null
  },
  "requests": {
    "version": "2.32.3"
  },
  "system_ssl": {
    "version": "30200040"
  },
  "urllib3": {
    "version": "2.4.0"
  },
  "using_charset_normalizer": true,
  "using_pyopenssl": false
}

[hroncok]

cc @illia-v

[illia-v]

#6924 should fix test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert

Please check urllib3/urllib3#3577 (comment) too

[musicinmybrain]

#6924 should fix test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert

Please check urllib3/urllib3#3577 (comment) too

Thanks! I can confirm that backporting 5074096, 9ebebde, and #6924 to v2.32.3 does indeed fix test_different_connection_pool_for_tls_settings_verify_bundle_unexpired_cert, which is the only failure we see downstream in offline builds of the python-requests package for Fedora.

Meanwhile, if I check out https://github.com/RichieB2B/requests/tree/rfc5280, that gets me down to just TestRequests::test_proxy_error again, so somewhere in v2.32.3...main there must exist fixes for the other two regressions.