unstale

pypi / locust

locust

What changed in locust 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-31.

6 breaking1 security4 new APIs and options27 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.9 on npm

locust 238 changes

Breaking changes 6

  • Malformed HTTP responses are now reported as failed requests.

    2.47.0release notes

  • A non-finite spawn_rate is rejected instead of reporting a successful start.

    2.47.0release notes

  • The /stats/reset endpoint now accepts POST requests only, closing a CSRF vector; callers using the web UI as an API must adjust their requests.

    2.47.0release notes

  • The /stop endpoint now accepts POST requests only, closing a CSRF vector; callers using the web UI as an API must adjust their requests.

    2.47.0release notes

  • constant_throughput() rejects a non-positive rate.

    2.46.7release notes

  • new_dispatch() rejects a non-positive spawn_rate.

    2.46.7release notes

Security 1

New APIs and options 4

Fixes and other changes 27

  • The output directory is created when writing CSV output.

    2.47.0release notes

  • The stats history CSV writer no longer crashes on workers using --csv-full-history.

    2.47.0release notes

  • The worker's message loop stays alive when a custom message listener raises an exception.

    2.47.0release notes

  • locust_exception_handler no longer crashes when Environment.parsed_options is None.

    2.47.0release notes

  • Removing a listener while an event fires no longer causes the next listener to be skipped.

    2.47.0release notes

  • FastHttpUser percent-encodes the request target.

    2.47.0release notes

  • The HTML report file name now preserves a fractional spawn rate.

    2.47.0release notes

  • The output directory is created when writing the HTML report.

    2.47.0release notes

  • The output directory is created when writing JSON output.

    2.47.0release notes

  • A shape class imported from another locustfile is no longer reported as a duplicate.

    2.47.0release notes

  • The output directory is created when writing the log file.

    2.47.0release notes

  • MongoDBClient now queries the correct database and runs the query.

    2.47.0release notes

  • Request names already seen are retained when the name cap is reached.

    2.47.0release notes

  • OTEL and CSV request listeners now accept response_time=None.

    2.47.0release notes

  • Users that are already stopping are no longer asked to stop again.

    2.47.0release notes

  • An exception raised in User.on_start now fires user_error.

    2.47.0release notes

  • Constant pacing is corrected after wall-clock adjustments.

    2.46.7release notes

  • allow_redirects=False works with geventhttpclient 2.5 and later.

    2.46.7release notes

  • Timestamp differences are calculated before truncation, avoiding truncated durations.

    2.46.7release notes

  • The caller-provided headers dict is no longer modified.

    2.46.7release notes

  • Percent-encoded credentials in the host URL are decoded, and IPv6 brackets are retained in base_url.

    2.46.7release notes

  • The web UI user count now persists in parsed_options.

    2.46.7release notes

  • The endpoint rejects a negative spawn_rate instead of reporting a successful start.

    2.46.7release notes

  • Negative --users no longer causes an infinite hang in headless mode.

    2.46.7release notes

  • The median is computed using the same rank as the 50% percentile.

    2.46.6release notes

  • Improves the error message shown when Web UI assets are missing.

    2.46.6release notes

  • An unknown worker's spawning_complete no longer kills client_listener.

    2.46.6release notes