🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security
- Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (GHSA-2xpw-w6gg-jr37)
- Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the
Content-Encodingheader, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (GHSA-gm62-xv2j-4w53)
Important
- If urllib3 is not installed with the optional
urllib3[brotli]extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer usingurllib3[brotli]to install a compatible Brotli package automatically. - If you use custom decompressors, please make sure to update them to respect the changed API of
urllib3.response.ContentDecoder.
Features
- Enabled retrieval, deletion, and membership testing in
HTTPHeaderDictusing bytes keys. (#3653) - Added host and port information to string representations of
HTTPConnection. (#3666) - Added support for Python 3.14 free-threading builds explicitly. (#3696)
Removals
- Removed the
HTTPResponse.getheaders()method in favor ofHTTPResponse.headers. Removed theHTTPResponse.getheader(name, default)method in favor ofHTTPResponse.headers.get(name, default). (#3622)
Bugfixes
- Fixed redirect handling in
urllib3.PoolManagerwhen an integer is passed for the retries parameter. (#3649) - Fixed
HTTPConnectionPoolwhen used in Emscripten with no explicit port. (#3664) - Fixed handling of
SSLKEYLOGFILEwith expandable variables. (#3700)
Misc
- Changed the
zstdextra to installbackports.zstdinstead ofzstandardon Python 3.13 and before. (#3693) - Improved the performance of content decoding by optimizing
BytesQueueBufferclass. (#3710) - Allowed building the urllib3 package with newer setuptools-scm v9.x. (#3652)
- Ensured successful urllib3 builds by setting Hatchling requirement to ≥ 1.27.0. (#3638)