[PR #251] [MERGED] Update dependency requests to v2.31.0 #404

New issue

Closed

opened 2026-03-02 15:57:48 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 15:57:48 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/probberechts/soccerdata/pull/251
Author: @renovate[bot]
Created: 5/23/2023
Status: ✅ Merged
Merged: 5/24/2023
Merged by: @probberechts

Base: master ← Head: renovate/requests-2.x-lockfile

📝 Commits (1)

dbcf109 Update dependency requests to v2.31.0

📊 Changes

1 file changed (+3 additions, -3 deletions)

View changed files

📝 poetry.lock (+3 -3)

📄 Description

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
requests (source, changelog)	`2.30.0` -> `2.31.0`

Release Notes

psf/requests

`v2.31.0`

Compare Source

Security

Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of Proxy-Authorization headers to destination servers when
following HTTPS redirects.

When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a Proxy-Authorization header that is attached to the request to
authenticate with the proxy.

In cases where Requests receives a redirect response, it previously reattached
the Proxy-Authorization header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.

Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.

Full details can be read in our Github Security Advisory
and CVE-2023-32681.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/probberechts/soccerdata/pull/251 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 5/23/2023 **Status:** ✅ Merged **Merged:** 5/24/2023 **Merged by:** [@probberechts](https://github.com/probberechts) **Base:** `master` ← **Head:** `renovate/requests-2.x-lockfile` --- ### 📝 Commits (1) - [`dbcf109`](https://github.com/probberechts/soccerdata/commit/dbcf109c84457f1cb734f52bda73ed673d9cb41f) Update dependency requests to v2.31.0 ### 📊 Changes **1 file changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `poetry.lock` (+3 -3) </details> ### 📄 Description [![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [requests](https://requests.readthedocs.io) ([source](https://togithub.com/psf/requests), [changelog](https://togithub.com/psf/requests/blob/master/HISTORY.md)) | `2.30.0` -> `2.31.0` | [![age](https://badges.renovateapi.com/packages/pypi/requests/2.31.0/age-slim)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://badges.renovateapi.com/packages/pypi/requests/2.31.0/adoption-slim)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://badges.renovateapi.com/packages/pypi/requests/2.31.0/compatibility-slim/2.30.0)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://badges.renovateapi.com/packages/pypi/requests/2.31.0/confidence-slim/2.30.0)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>psf/requests</summary> ### [`v2.31.0`](https://togithub.com/psf/requests/blob/HEAD/HISTORY.md#2310-2023-05-22) [Compare Source](https://togithub.com/psf/requests/compare/v2.30.0...v2.31.0) **Security** - Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of `Proxy-Authorization` headers to destination servers when following HTTPS redirects. When proxies are defined with user info (https://user:pass@proxy:8080), Requests will construct a `Proxy-Authorization` header that is attached to the request to authenticate with the proxy. In cases where Requests receives a redirect response, it previously reattached the `Proxy-Authorization` header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are *strongly* encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed. Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability. Full details can be read in our [Github Security Advisory](https://togithub.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q) and [CVE-2023-32681](https://nvd.nist.gov/vuln/detail/CVE-2023-32681). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://app.renovatebot.com/dashboard#github/probberechts/soccerdata).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>