Bump requests from 2.20.0 to 2.33.0

[dependabot]

Bumps requests from 2.20.0 to 2.33.0.

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​requests@​2.20.0 ⏵ 2.33.0	+1	+6

View full report

[JonathanPorta]

PR Review

Summary

This PR bumps requests from 2.20.0 to 2.33.0 in requirements.txt. The bump addresses very old HTTP dependency exposure, but it is not compatible with this repository's current Lambda/Python target. The project still builds and advertises Python 3.6, while requests==2.33.0 requires Python >=3.10.

Findings

• Severity: Blocking
• Location: requirements.txt, Makefile deps, Dockerfile, and setup.py package metadata
• Problem: requests==2.33.0 declares Requires-Python: >=3.10, but this repo still creates a Python 3.6 virtualenv in Makefile, builds from lambci/lambda:build-python3.6, manually installs Python 3.6.1 in the Docker image, and advertises Programming Language :: Python :: 3.6 in setup.py.
• Why it matters: pip will not install this version for the runtime the repository is designed around. This package's whole job is to prebuild Lambda-compatible image dependencies, so merging a dependency that excludes the Lambda/build Python version breaks the main build and release path.
• Suggested fix: either migrate the Lambda build/package/runtime target to Python >=3.10 and validate the Docker/package flow there, or choose the newest requests release that still supports the repository's actual Python target.

Test / Verification Notes

Checked the PR metadata, one-line dependency diff, surrounding build/package files, Lambda runtime references, and the requests.get(...) usage in lambda_image_utils_prebuilt/unpack.py.

Ran:

• gh pr checks 20 --repo JonathanPorta/lambda_image_utils_prebuilt: Socket Security checks pass; no repo build/test check is reported.
• tar -xOf requests-2.33.0/PKG-INFO | rg -n "Requires-Python|Requires-Dist|Classifier: Programming Language :: Python": confirmed Requires-Python: >=3.10.
• Scratch venv pip dry-run with --python-version 3.6 --only-binary=:all: --ignore-installed --no-deps requests==2.33.0: failed because requests==2.33.0 requires Python >=3.10.
• git diff --check origin/master...HEAD: passed.
• python3 -m py_compile lambda_image_utils_prebuilt/unpack.py version.py setup.py: passed.
• make test: failed because the repo has no test target.

Blessed-CICD review: because this is dependency automation, I checked policies/tracked-artifacts.md, standards/github-actions/dependabot-secret-guards.md, and docs/project-standards.md. The tracked-artifacts policy explicitly does not cover ordinary package-manager library pins, the Dependabot secret-guard standard is GitHub Actions-specific and this PR only reports Socket checks, and docs/project-standards.md treats AWS Lambda as an emerging precedent rather than a detailed dependency-runtime standard.

Overall Recommendation

Needs changes before merge.