pypi / requests

requests

What changed in requests 2, from its official release notes, upgrade guides and advisories. Also covers types-requests. Sources checked 2026-10-18.

6 breaking2 security1 new APIs and options1 behavior and defaults1 tooling8 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

requests 219 changes

The headers input type is back to Mapping to avoid invariance issues; users calling Request.headers.update() may need to narrow typing.
2.34.2release notes
The input type for headers changed to MutableMapping.
2.34.1release notes
None was removed from the Request.headers typing.
2.34.1release notes
Response.reason changed from str | None to str.
2.34.1release notes
Support for Python 3.9 was dropped following its end of support.
2.33.0release notes
The utility now extracts contents to a non-deterministic location to prevent malicious file replacement. This affects applications that call it directly.
2.33.0release notes security advisory

Digest Auth hashing algorithms now pass usedforsecurity=False to clarify security considerations.
2.34.0release notes
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
2.33.0security advisory

Requests is adding inline types for typed code bases; the notes invite users to try them and report gaps or feedback.
2.33.0release notes

The accepted input type for json was widened from dict and list to Mapping and Sequence.
2.34.1release notes

Requests now provides inline types, replacing those provided by typeshed, with public API types intended to be compatible with mypy, pyright, and ty.
2.34.0release notes

Fixed detection of some bodies with custom __getattr__ implementations as Iterables.
2.34.1release notes
Proxy bypass no longer performs greedy matching on no_proxy domains, following CPython's fix for bpo-39057.
2.34.0release notes
Requests adds support for Python 3.15 based on beta1 and Python 3.14t, allowing downstream projects to test compatibility.
2.34.0release notes
Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list.
2.34.0release notes
Requests no longer incorrectly strips duplicate leading slashes in URI paths, addressing issues with specific presigned URLs; the full fix requires urllib3 2.7.0+.
2.34.0release notes
Parsing of malformed Content-Type header values was fixed.
2.33.1release notes
Errors for malformed header values are now more consistent.
2.33.1release notes
Fixed malformed authentication being applied to Requests when a netrc entry is empty on Python 3.11+.
2.33.0release notes