pypi / curl-cffi
curl-cffi
What changed in curl-cffi 0.15 to 0.17, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-29.
2 breaking3 security8 new APIs and options1 performance2 behavior and defaults1 tooling11 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initcurl-cffi 0.1720 changes
Breaking changes 2
A CurlError is raised when curl_mime_data fails.
Setting trust_env=False now ignores proxy environment variables.
Security 2
The bundled brotli version was updated to mitigate the http2shell issue.
certifi was updated to remove the compromised eMudhra certificate.
New APIs and options 7
CurlProxyType is added for HTTP/3 proxies.
CurlShare lets sessions share DNS and TLS caches across threads.
Session and AsyncSession gain a dns option.
Nine new fingerprints are available for developers to use.
WebSockets support permessage-deflate.
Response.json() supports a path argument.
Session gains a cache_backend property.
Performance 1
WebSockets were refactored for performance.
Behavior and default changes 2
ALPN is enabled by default in Fingerprint.
Support is added for httpx 0.28 and later.
Fixes and other changes 6
Charset handling now tolerates quoted, spaced, and case-insensitive values.
Quotes in server-set cookie values are preserved.
Error reporting falls back to curl_easy_strerror when the error buffer is empty.
Response.json() falls back to stdlib json when keyword arguments are passed.
A race condition in response getinfo during streaming is fixed.
WebSocket proxy and verify options are fixed.
curl-cffi 0.167 changes
New APIs and options 1
Adds support for the TLS trust_anchors extension in Chrome 152, usable with the chrome 152 target or vanilla curlopts.
Tooling 1
Android wheels are shipped per CPython minor, including CPython 3.14.
Fixes and other changes 5
Fixes tls_signed_cert_timestamps not being applied.
Active socket information is fixed on Win64.
RequestData is parameterized, improving its type annotations for stream requests.
The Session.request return annotation is restored.
The runtime typing_extensions dependency is avoided.
curl-cffi 0.151 changes
Security 1
curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass)