See https://github.com/wikimedia/pywikibot/security/dependabot/5
"requests >= 2.31.0"
should be required but we have
'requests>=2.21.0, <2.28.0; python_version < "3.7"', 'requests>=2.21.0; python_version>="3.7"',
where 2.21.0 is the version in toolforge
As a workaround redirects must be discarded.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Release | Xqt | T378891 Pywikibot 10 release dependencies | ||
| Resolved | Xqt | T347031 Unintended leak of Proxy-Authorization header in requests |
Change 959734 had a related patch set uploaded (by Xqt; author: Xqt):
[pywikibot/core@master] [fix] Set 'allow_redirects' keyword argument of requests.Session to False
The proposed workaround leads to a lot of problems with site_detect_tests, generate_family_file_tests, site_obsoletesites_tests, http_tests and data_ingestion_tests and in summary it is not appropriate for Pywikibot. In adition the requests response code 3xx must be evaluated and a new request to the redirected destination must be done.
See https://integration.wikimedia.org/ci/job/pywikibot-core-tox-deeptest-py36-docker/2780/consoleFull
Change 959734 abandoned by Xqt:
[pywikibot/core@master] [fix] Set 'allow_redirects' keyword argument of requests.Session to False
Reason:
A lot of tests fails. See task.
We now have requests 2.31.0 on tools-bastion-13 6.1.0-21-cloud-amd64:
Python 3.11.2 (main, Aug 26 2024, 07:20:54) [GCC 12.2.0] on linux
>>> from importlib.metadata import version
>>> version('requests')
'2.31.0'Change #1101467 had a related patch set uploaded (by Xqt; author: Xqt):
[pywikibot/core@master] requirements: require requests >= 2.31.0 due to security issues
Change #1101467 merged by jenkins-bot:
[pywikibot/core@master] requirements: require requests >= 2.31.0 due to security issues
Change #1101492 had a related patch set uploaded (by Xqt; author: Xqt):
[pywikibot/core@master] requirements: require requests >= 2.31.0 due to security issues
Change #1101492 merged by Xqt:
[pywikibot/core@master] requirements: require requests >= 2.31.0 due to security issues