Skip to content

build(deps): bump requests from 2.32.4 to 2.33.0 in /packages/clip-processor-py#597

Open
dependabot[bot] wants to merge 23 commits into
masterfrom
dependabot/uv/packages/clip-processor-py/requests-2.33.0
Open

build(deps): bump requests from 2.32.4 to 2.33.0 in /packages/clip-processor-py#597
dependabot[bot] wants to merge 23 commits into
masterfrom
dependabot/uv/packages/clip-processor-py/requests-2.33.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 21, 2026

Bumps requests from 2.32.4 to 2.33.0.

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.
Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.
Commits
  • bc04dfd v2.33.0
  • 66d21cb Merge commit from fork
  • 8b9bc8f Move badges to top of README (#7293)
  • e331a28 Remove unused extraction call (#7292)
  • 753fd08 docs: fix FAQ grammar in httplib2 example
  • 774a0b8 docs(socks): same block as other sections
  • 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
  • ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
  • 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
  • d568f47 docs: clarify Quickstart POST example (#6960)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Geczy and others added 23 commits May 20, 2026 09:54
The dota job duplicated the services matrix job's buildx/login/build steps,
and every job computed 5-7 granular *_changed outputs that only ever fed one
OR condition repeated across four steps. Collapse to a single build matrix
(dota becomes a 4th entry with an extended paths regex) gated on one
should_build grep. 165 -> 75 lines, identical build/push/tag/label behavior.

Verified change-detection equivalence exhaustively: all 4096 changed-file
category combinations produce the same per-service build decision as before.
Also adds fail-fast: false so one service's failure no longer cancels others.
The minimap-blocker overlay is unused in production, but minimapParser.init
ran on every GSI tick for any beta_tester with the setting on — parsing
entity positions and serializing them over socket.io to nobody. Comment out
the per-tick block (and its now-unused import) so the work is skipped;
uncomment to revive. emitMinimapBlockerStatus (connect/event-driven, not
per-tick) is left intact.
Image builds were cold every run: the bake set overrode cache with empty
*.cache-from=/*.cache-to=, while docker-compose.yml still declared registry
cache refs the workflow ignored. The earlier GHA-cache attempt failed only
because it shared one scope across all services (scope=github.workflow), so
they clobbered each other (~0% hits).

Use type=gha scoped per matrix.service with mode=max (the bun install lives in
an intermediate stage, so mode=max is required to cache it). Remove the unused
x-bake registry cache blocks from compose so config matches reality. The 4
stale ghcr cache-* packages were deleted separately.
builder.yml: replace the dual hand-maintained path lists + last-commit-only
git diff with a single dorny/paths-filter pre-job that diffs the full push
range. Fixes two rebuild-skip bugs: multi-commit pushes where an earlier
commit touched a service, and root package.json/bun.lock changes that
previously rebuilt only dota. The build matrix is now derived from the
filter output, so only changed services spin up runners.

Add concurrency groups to builder.yml and ci.yml so superseded runs on a
branch are cancelled. Pin CI/health-check Bun to 1.3.14 to match the prod
image. Drop the unused profanity-filter Dockerfile.
A stale socket closing after a reconnect handoff clobbered the live
connection's status flag, so uptime monitors reported "disconnected"
while events kept flowing. twitch-chat now ignores closes from non-current
sockets and treats keepalives/notifications as liveness; twitch-events
derives connectedness from a connected-client count instead of a
clobberable boolean (and drops dead client-only socket handlers).
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
These commands still return real results, so the appended Oct 9 explainer is no longer needed.
Add offline tests across api_server (HTTP routes, image-serving security,
auth, stuck-request reset, stream requests), postgresql_client (match/draft
fetch, queue state, facet merge), dota_heroes helpers, clip_utils URL/error
paths, stream_processor state + backoff, and facet_detection seams.

Five tests fail intentionally to pin real bugs for follow-up:
- get_clip_result(_by_match_id) swallows a facets/player KeyError and returns
  None, silently invalidating an otherwise-valid cached result.
- extract_clip_id returns "" (not None) for path-bearing junk URLs, which can
  collide as a cache/queue-dedup key.
- get_clip_result(_by_match_id): guard facet merge with facets.get(team, [])
  and skip players/heroes missing team/position, so a partial or legacy facets
  payload no longer raises a swallowed KeyError that discarded the whole
  cached result and forced needless reprocessing.
- extract_clip_id: drop empty path segments so path-bearing junk URLs return
  None instead of "", which could collide as a cache/queue-dedup key.

Turns the five intentionally-failing tests from the prior commit green.
…, and dota

Wire up test infra (bunfig + test script + test:all) for twitch-events and
twitch-chat, which previously had no tests, and add offline/mocked suites:
- twitch-events: RateLimiter, isAuthenticated, runSubscriptionHealthCheck
- twitch-chat: handleChatMessage/sendTwitchChatMessage, bet/poll transforms
- shared-utils: conduitManager fetch/retry/cache
- dota: ranks math, subscription gating, and 27 chat commands

All suites run fully offline with zero skipped tests.
The facet-merge guards were copy-pasted verbatim across get_clip_result and
get_clip_result_by_match_id, so a future change had to be applied twice or
silently diverge. Extract a single _merge_facets_into_result helper used by
both. Also hoist the duplicated FakePortrait test double into a shared
_recording_portrait() helper.
Add a MongoDBSingleton mock to the twitch/lib test harness whose delayedGames
findOne returns a controllable state.delayedGame, unlocking the match-data
commands that read live game info from Mongo.
- assert real source constants (DBSettings, LOBBY_TYPE_RANKED) instead of literals
- distinguish ranked yes/no by message content rather than just reply count
- make the RateLimiter reset-wait test deterministic via a patched timer
- reset the handleChat dedupe cache between tests to prevent cross-test leakage
Draft alignment: the token-overlap match path was dead code -- tokens were
split from the already space-stripped normalized name, collapsing multi-word
names to a single token. Word-swapped names ("Team Liquid" / "Liquid Team")
fell below the difflib ratio threshold and went unmatched. Tokenize the raw
name (normalizing each word) so token overlap works as documented.

Queue dedup: a brand-new enqueue returns status 'pending', so it tripped the
"already in the processing queue" branch -- giving a misleading message AND
skipping start_worker_thread(). add_to_queue now flags real dedup hits with
'deduplicated', and the clip/stream paths branch on that instead of status.
With ENABLE_SPECTATE_FRIEND_GAME off, the non-spectator path returns the
Valve-disabled message before any Redis/steam call, so these cover notPlaying,
gameNotFound, the Valve-disabled branch, and alias routing without new mocks.
geo short-circuits to the Valve-disabled message before getAccountsFromMatch,
so its reachable paths are fully covered. gm/np/smurfs/lg only reach
getAccountsFromMatch (owned by gsiMocks) after an early steam32Id guard, so we
cover that collision-safe branch via a parametrized loop.
Bumps [requests](https://github.com/psf/requests) from 2.32.4 to 2.33.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.4...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant