# What changed in curl-cffi

> 28 changes in curl-cffi 0.15 to 0.17 from its official release notes, upgrade guides and advisories: 2 breaking, 3 security, 8 new APIs and options. Each one cited. Sources checked 2026-10-29. HTML: https://unstale.sh/pypi/curl-cffi/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## curl-cffi 0.17

### Breaking changes

- A CurlError is raised when curl_mime_data fails. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Setting trust_env=False now ignores proxy environment variables. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)

### Security

- The bundled brotli version was updated to mitigate the http2shell issue. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- certifi was updated to remove the compromised eMudhra certificate. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)

### New APIs and options

- CurlProxyType is added for HTTP/3 proxies. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- CurlShare lets sessions share DNS and TLS caches across threads. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Session and AsyncSession gain a dns option. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Nine new fingerprints are available for developers to use. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- WebSockets support permessage-deflate. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Response.json() supports a path argument. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Session gains a cache_backend property. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)

### Performance

- WebSockets were refactored for performance. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)

### Behavior and default changes

- ALPN is enabled by default in Fingerprint. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Support is added for httpx 0.28 and later. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)

### Fixes and other changes

- Charset handling now tolerates quoted, spaced, and case-insensitive values. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Quotes in server-set cookie values are preserved. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Error reporting falls back to curl_easy_strerror when the error buffer is empty. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- Response.json() falls back to stdlib json when keyword arguments are passed. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- A race condition in response getinfo during streaming is fixed. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)
- WebSocket proxy and verify options are fixed. (0.17.0) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.17.0)

## curl-cffi 0.16

### New APIs and options

- Adds support for the TLS trust_anchors extension in Chrome 152, usable with the chrome 152 target or vanilla curlopts. (0.16.3) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.3)

### Tooling

- Android wheels are shipped per CPython minor, including CPython 3.14. (0.16.2) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.2)

### Fixes and other changes

- Fixes tls_signed_cert_timestamps not being applied. (0.16.3) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.3)
- Active socket information is fixed on Win64. (0.16.2) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.2)
- RequestData is parameterized, improving its type annotations for stream requests. (0.16.2) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.2)
- The Session.request return annotation is restored. (0.16.2) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.2)
- The runtime typing_extensions dependency is avoided. (0.16.2) — [release notes](https://github.com/lexiforest/curl_cffi/releases/tag/v0.16.2)

## curl-cffi 0.15

### Security

- curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (with TLS impersonation bypass) (0.15.0) — [security advisory](https://github.com/advisories/GHSA-QW2M-4PQF-RMPP)