# What changed in requests

> 19 changes in requests 2 from its official release notes, upgrade guides and advisories: 6 breaking, 2 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/pypi/requests/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## requests 2

### Breaking changes

- The headers input type is back to Mapping to avoid invariance issues; users calling Request.headers.update() may need to narrow typing. (2.34.2) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.2)
- The input type for headers changed to MutableMapping. (2.34.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.1)
- None was removed from the Request.headers typing. (2.34.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.1)
- Response.reason changed from str | None to str. (2.34.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.1)
- Support for Python 3.9 was dropped following its end of support. (2.33.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.33.0)
- The utility now extracts contents to a non-deterministic location to prevent malicious file replacement. This affects applications that call it directly. (2.33.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.33.0), [security advisory](https://github.com/advisories/GHSA-GC5V-M9X4-R6X2)

### Security

- Digest Auth hashing algorithms now pass usedforsecurity=False to clarify security considerations. (2.34.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.0)
- Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function (2.33.0) — [security advisory](https://github.com/advisories/GHSA-GC5V-M9X4-R6X2)

### New APIs and options

- Requests is adding inline types for typed code bases; the notes invite users to try them and report gaps or feedback. (2.33.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.33.0)

### Behavior and default changes

- The accepted input type for json was widened from dict and list to Mapping and Sequence. (2.34.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.1)

### Tooling

- Requests now provides inline types, replacing those provided by typeshed, with public API types intended to be compatible with mypy, pyright, and ty. (2.34.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.0)

### Fixes and other changes

- Fixed detection of some bodies with custom __getattr__ implementations as Iterables. (2.34.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.1)
- Proxy bypass no longer performs greedy matching on no_proxy domains, following CPython's fix for bpo-39057. (2.34.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.0)
- Requests adds support for Python 3.15 based on beta1 and Python 3.14t, allowing downstream projects to test compatibility. (2.34.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.0)
- Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (2.34.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.0)
- Requests no longer incorrectly strips duplicate leading slashes in URI paths, addressing issues with specific presigned URLs; the full fix requires urllib3 2.7.0+. (2.34.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.34.0)
- Parsing of malformed Content-Type header values was fixed. (2.33.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.33.1)
- Errors for malformed header values are now more consistent. (2.33.1) — [release notes](https://github.com/psf/requests/releases/tag/v2.33.1)
- Fixed malformed authentication being applied to Requests when a netrc entry is empty on Python 3.11+. (2.33.0) — [release notes](https://github.com/psf/requests/releases/tag/v2.33.0)