Migrate build system to PEP 517 by nateprewitt · Pull Request #7012 · psf/requests

nateprewitt · 2025-08-17T16:29:40Z

This PR follows up on the original announcement of migrating Requests to a PEP 517 compliant backend in 2.33.0. This PR proposes moving to ~~hatchling which has wide adoption, but there's an argument for staying on setuptools~~ setuptools after reviewing our current needs. I'd be curious to hear from other maintainers on if there's a strong preference in either direction based on other projects.

@pquentin or @sethmlarson may have input from migrating urllib3 as well. Presumably users with urllib3 2.x are already capable of building with this setup in their environment.

pquentin · 2025-08-17T16:35:32Z

The migration to pyproject.toml in urllib3 was surprisingly easy! We no longer have a setup.py file, and had zero complaints about that.

sigmavirus24 · 2025-08-17T20:24:30Z

I'm all for removing setup.py. my worry with hatchling is the bus factor. With setuptools we're at the whim of missing a deprecation warning that no one could reasonably see locally and being broken randomly

sigmavirus24 · 2025-08-17T20:27:57Z

I'm all for removing setup.py. my worry with hatchling is the bus factor. With setuptools we're at the whim of missing a deprecation warning that no one could reasonably see locally and being broken randomly. I don't know that the other backends are as widely used or have support for the variety of standards we likely don't need

pquentin · 2025-08-18T05:28:37Z

The beauty of pyproject.toml is that using a different backend is quite easy. setuptools supports dynamic versions too, so there's nothing in this PR that setuptools cannot do. If we were migrating urllib3 to setuptools today, we would probably have stuck to setuptools.

(setuptools and hatch builds sdists/wheels differently, so I would check that you have everything you want in those files compared to the existing.)

nateprewitt · 2026-01-30T19:48:18Z

I'm planning to go with setuptools at this point I think. It's the least overhead and from both of your comments it seems like it has what we need. I'll validate that and push up a finalized version to take out of draft. Thanks for the input!

nateprewitt · 2026-01-30T23:08:16Z

+name = "requests"
+description = "Python HTTP for Humans."
+readme = "README.md"
+license = {text = "Apache-2.0"}


I'll note here that we left the text identifier instead of using PEP 639 intentionally. While it is marked for deprecation in Feb 2027, the minimum supported version (setuptools 77) is still quite recent and I'm not comfortable bringing the floor up that high yet. We'll evaluate how this initial migration goes and address that later.

It wouldn't be a day ending in y if something in Python Packaging wasn't being deprecated with hard to find warning messages, that's for sure. ;)

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [requests](https://github.com/psf/requests) ([changelog](https://github.com/psf/requests/blob/master/HISTORY.md)) | `2.32.5` → `2.33.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/requests/2.33.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/requests/2.32.5/2.33.0?slim=true) | --- ### Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function [CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645) / [GHSA-gc5v-m9x4-r6x2](GHSA-gc5v-m9x4-r6x2) <details> <summary>More information</summary> #### Details ##### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ##### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted. ##### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access. #### Severity - CVSS Score: 4.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N` #### References - [https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2](https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2) - [https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7](https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7) - [https://github.com/psf/requests](https://github.com/psf/requests) - [https://github.com/psf/requests/releases/tag/v2.33.0](https://github.com/psf/requests/releases/tag/v2.33.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>psf/requests (requests)</summary> ### [`v2.33.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25) [Compare Source](psf/requests@v2.32.5...v2.33.0) **Announcements** - 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at [#7271](psf/requests#7271). Give it a try, and report any gaps or feedback you may have in the issue. 📣 **Security** - CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly. **Improvements** - Migrated to a PEP 517 build system using setuptools. ([#7012](psf/requests#7012)) **Bugfixes** - Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. ([#7205](psf/requests#7205)) **Deprecations** - Dropped support for Python 3.9 following its end of support. ([#7196](psf/requests#7196)) **Documentation** - Various typo fixes and doc improvements. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/epage/pulls/213 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [requests](https://github.com/psf/requests) ([changelog](https://github.com/psf/requests/blob/master/HISTORY.md)) | `2.32.5` → `2.33.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/requests/2.33.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/requests/2.32.5/2.33.0?slim=true) | --- ### Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function [CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645) / [GHSA-gc5v-m9x4-r6x2](GHSA-gc5v-m9x4-r6x2) <details> <summary>More information</summary> #### Details ##### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ##### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted. ##### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access. #### Severity - CVSS Score: 4.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N` #### References - [https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2](https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2) - [https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7](https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7) - [https://github.com/psf/requests](https://github.com/psf/requests) - [https://github.com/psf/requests/releases/tag/v2.33.0](https://github.com/psf/requests/releases/tag/v2.33.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>psf/requests (requests)</summary> ### [`v2.33.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25) [Compare Source](psf/requests@v2.32.5...v2.33.0) **Announcements** - 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at [#7271](psf/requests#7271). Give it a try, and report any gaps or feedback you may have in the issue. 📣 **Security** - CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly. **Improvements** - Migrated to a PEP 517 build system using setuptools. ([#7012](psf/requests#7012)) **Bugfixes** - Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. ([#7205](psf/requests#7205)) **Deprecations** - Dropped support for Python 3.9 following its end of support. ([#7196](psf/requests#7196)) **Documentation** - Various typo fixes and doc improvements. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/PwnedPW/pulls/330 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [requests](https://github.com/psf/requests) ([changelog](https://github.com/psf/requests/blob/master/HISTORY.md)) | `==2.32.5` → `==2.33.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/requests/2.33.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/requests/2.32.5/2.33.0?slim=true) | --- ### Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function [CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645) / [GHSA-gc5v-m9x4-r6x2](GHSA-gc5v-m9x4-r6x2) <details> <summary>More information</summary> #### Details ##### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ##### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted. ##### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access. #### Severity - CVSS Score: 4.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N` #### References - [https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2](https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2) - [https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7](https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7) - [https://github.com/psf/requests](https://github.com/psf/requests) - [https://github.com/psf/requests/releases/tag/v2.33.0](https://github.com/psf/requests/releases/tag/v2.33.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>psf/requests (requests)</summary> ### [`v2.33.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25) [Compare Source](psf/requests@v2.32.5...v2.33.0) **Announcements** - 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at [#7271](psf/requests#7271). Give it a try, and report any gaps or feedback you may have in the issue. 📣 **Security** - CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly. **Improvements** - Migrated to a PEP 517 build system using setuptools. ([#7012](psf/requests#7012)) **Bugfixes** - Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. ([#7205](psf/requests#7205)) **Deprecations** - Dropped support for Python 3.9 following its end of support. ([#7196](psf/requests#7196)) **Documentation** - Various typo fixes and doc improvements. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/pypilot/pulls/427 Reviewed-by: Luke Tainton <luke@tainton.uk> Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [requests](https://github.com/psf/requests) ([changelog](https://github.com/psf/requests/blob/master/HISTORY.md)) | `2.32.5` → `2.33.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/requests/2.33.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/requests/2.32.5/2.33.0?slim=true) | --- ### Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function [CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645) / [GHSA-gc5v-m9x4-r6x2](GHSA-gc5v-m9x4-r6x2) <details> <summary>More information</summary> #### Details ##### Impact The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. ##### Affected usages **Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted. ##### Remediation Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access. #### Severity - CVSS Score: 4.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N` #### References - [https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2](https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2) - [https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7](https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7) - [https://github.com/psf/requests](https://github.com/psf/requests) - [https://github.com/psf/requests/releases/tag/v2.33.0](https://github.com/psf/requests/releases/tag/v2.33.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>psf/requests (requests)</summary> ### [`v2.33.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25) [Compare Source](psf/requests@v2.32.5...v2.33.0) **Announcements** - 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at [#7271](psf/requests#7271). Give it a try, and report any gaps or feedback you may have in the issue. 📣 **Security** - CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly. **Improvements** - Migrated to a PEP 517 build system using setuptools. ([#7012](psf/requests#7012)) **Bugfixes** - Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. ([#7205](psf/requests#7205)) **Deprecations** - Dropped support for Python 3.9 following its end of support. ([#7196](psf/requests#7196)) **Documentation** - Various typo fixes and doc improvements. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/roboluke/pulls/436 Reviewed-by: Luke Tainton <luke@tainton.uk> Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https ://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="http s://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a hre f="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/req uests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/ps f/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/req uests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/req uests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/req uests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/ps f/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requ ests/blob/main/HISTORY.md#2330-2026-03- 25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03- 25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https ://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/ 7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a hre f="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="psf/requests@bc04dfd6dad4cb02cd92 f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="psf/requests@66d21cb07bd6255b1280 291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="psf/requests@8b9bc8fc0f63be846023 87913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293"># 7293</a>)</li> <li><a href="psf/requests@e331a288f369973f5de0 ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#72 92</a>)</li> <li><a href="psf/requests@753fd08c5eacce0aa0df 73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="psf/requests@774a0b837a194ee885d4 fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="psf/requests@9c72a41bec8597f948c9 d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="psf/requests@ebf71906798ec82f34e0 7d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="psf/requests@0e4ae38f0c93d4f92a96 c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect. github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="psf/requests@d568f47278492e630cc9 90a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6 960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot- badges.githubapp.com/badges/compatibility_score?dependency- name=requests&package-manager=uv&previous-version=2.32.5&new- version=2.33.0)](https://docs.github.com/en/github/managing-security- vulnerabilities/about-dependabot-security-updates#about-compatibility- scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/tursodatabase/turso/network/alerts). </details> Closes #6527

nateprewitt force-pushed the hatchling branch from 9984062 to 26d4b6b Compare August 17, 2025 16:30

radoering mentioned this pull request Sep 20, 2025

NOTICE file missing in wheel #7034

Closed

nateprewitt added this to the 2.33.0 milestone Jan 30, 2026

sigmavirus24 approved these changes Jan 30, 2026

View reviewed changes

nateprewitt force-pushed the hatchling branch from 26d4b6b to 08f7fe4 Compare January 30, 2026 22:32

Migrate to PEP 517 build backend

b11f49d

nateprewitt force-pushed the hatchling branch from 08f7fe4 to b11f49d Compare January 30, 2026 22:38

nateprewitt changed the title ~~Migrate build system to hatchling~~ Migrate build system to PEP 517 Jan 30, 2026

Fix linting issues since we haven't fully dropped 3.10 yet.

28f8efc

nateprewitt marked this pull request as ready for review January 30, 2026 22:45

nateprewitt mentioned this pull request Jan 30, 2026

Update maintainers in the AUTHORS.rst #7191

Merged

Remove setup.cfg after rebase, it's no longer needed

477726a

nateprewitt commented Jan 30, 2026

View reviewed changes

nateprewitt enabled auto-merge (squash) January 31, 2026 02:16

Merge branch 'main' into hatchling

c3b4668

nateprewitt disabled auto-merge January 31, 2026 02:17

nateprewitt merged commit cb2c800 into main Jan 31, 2026
70 of 71 checks passed

nateprewitt deleted the hatchling branch January 31, 2026 02:25

SpecLad mentioned this pull request Feb 24, 2026

Fix setuptools deprecation warnings #6265

Closed

nateprewitt mentioned this pull request Mar 25, 2026

v2.33.0 #7294

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Migrate build system to PEP 517#7012

Migrate build system to PEP 517#7012
nateprewitt merged 4 commits intomainfrom
hatchling

nateprewitt commented Aug 17, 2025 •

edited

Loading

Uh oh!

pquentin commented Aug 17, 2025

Uh oh!

sigmavirus24 commented Aug 17, 2025

Uh oh!

sigmavirus24 commented Aug 17, 2025

Uh oh!

pquentin commented Aug 18, 2025

Uh oh!

nateprewitt commented Jan 30, 2026

Uh oh!

nateprewitt Jan 30, 2026

Uh oh!

sigmavirus24 Jan 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

nateprewitt commented Aug 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pquentin commented Aug 17, 2025

Uh oh!

sigmavirus24 commented Aug 17, 2025

Uh oh!

sigmavirus24 commented Aug 17, 2025

Uh oh!

pquentin commented Aug 18, 2025

Uh oh!

nateprewitt commented Jan 30, 2026

Uh oh!

nateprewitt Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

sigmavirus24 Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nateprewitt commented Aug 17, 2025 •

edited

Loading