# What changed in locust

> 38 changes in locust 2 from its official release notes, upgrade guides and advisories: 6 breaking, 1 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-31. HTML: https://unstale.sh/pypi/locust/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## locust 2

### Breaking changes

- Malformed HTTP responses are now reported as failed requests. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- A non-finite spawn_rate is rejected instead of reporting a successful start. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The /stats/reset endpoint now accepts POST requests only, closing a CSRF vector; callers using the web UI as an API must adjust their requests. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The /stop endpoint now accepts POST requests only, closing a CSRF vector; callers using the web UI as an API must adjust their requests. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- constant_throughput() rejects a non-positive rate. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- new_dispatch() rejects a non-positive spawn_rate. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)

### Security

- The endpoint rejects a negative user_count. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)

### New APIs and options

- FastHttpSession adds rename_request. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- FastHttpSession adds request_name. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- Adds a rest method to HttpUser. (2.46.6) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.6)
- Adds Poisson-distributed task arrivals for configuring wait times. (2.46.6) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.6)

### Fixes and other changes

- The output directory is created when writing CSV output. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The stats history CSV writer no longer crashes on workers using --csv-full-history. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The worker's message loop stays alive when a custom message listener raises an exception. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- locust_exception_handler no longer crashes when Environment.parsed_options is None. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- Removing a listener while an event fires no longer causes the next listener to be skipped. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- FastHttpUser percent-encodes the request target. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The HTML report file name now preserves a fractional spawn rate. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The output directory is created when writing the HTML report. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The output directory is created when writing JSON output. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- A shape class imported from another locustfile is no longer reported as a duplicate. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- The output directory is created when writing the log file. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- MongoDBClient now queries the correct database and runs the query. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- Request names already seen are retained when the name cap is reached. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- OTEL and CSV request listeners now accept response_time=None. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- Users that are already stopping are no longer asked to stop again. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- An exception raised in User.on_start now fires user_error. (2.47.0) — [release notes](https://github.com/locustio/locust/releases/tag/2.47.0)
- Constant pacing is corrected after wall-clock adjustments. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- allow_redirects=False works with geventhttpclient 2.5 and later. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- Timestamp differences are calculated before truncation, avoiding truncated durations. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- The caller-provided headers dict is no longer modified. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- Percent-encoded credentials in the host URL are decoded, and IPv6 brackets are retained in base_url. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- The web UI user count now persists in parsed_options. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- The endpoint rejects a negative spawn_rate instead of reporting a successful start. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- Negative --users no longer causes an infinite hang in headless mode. (2.46.7) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.7)
- The median is computed using the same rank as the 50% percentile. (2.46.6) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.6)
- Improves the error message shown when Web UI assets are missing. (2.46.6) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.6)
- An unknown worker's spawning_complete no longer kills client_listener. (2.46.6) — [release notes](https://github.com/locustio/locust/releases/tag/2.46.6)