Bump the pip group across 1 directory with 8 updates

[dependabot]

Bumps the pip group with 8 updates in the /backend/requirements directory:

Package	From	To
pydantic	1.10.7	1.10.13
black	23.3.0	24.3.0
aiohttp	3.9.2	3.9.4
langchain	0.1.9	0.2.3
litellm	1.34.21	1.40.0
llama-index	0.9.45	0.10.13
msal	1.26.0	1.28.0
requests	2.31.0	2.32.2

Updates pydantic from 1.10.7 to 1.10.13

Release notes

Sourced from pydantic's releases.

V1.10.13 2023-09-27

What's Changed

• Update pip commands to install 1.10 by @​chbndrhnns in pydantic/pydantic#6930
• Make the v1 mypy plugin work with both v1 and v2 by @​dmontagu in pydantic/pydantic#6920
• [Backport] Add max length check to validate_email by @​hramezani in pydantic/pydantic#7673

Full Changelog: pydantic/pydantic@v1.10.12...v1.10.13

V1.10.12

What's Changed

• Deque's maxlen property dropped on V1 validation by @​maciekglowka in pydantic/pydantic#6586
• Prepare release 1.10.12 by @​hramezani in pydantic/pydantic#6825

New Contributors

• @​maciekglowka made their first contribution in pydantic/pydantic#6586

Full Changelog: pydantic/pydantic@v1.10.11...v1.10.12

V1.10.11

What's Changed

• Fix import of create_model in tools.py by @​SharathHuddar in pydantic/pydantic#6364
• Prepare for 1.10.11 by @​hramezani in pydantic/pydantic#6420

New Contributors

• @​SharathHuddar made their first contribution in pydantic/pydantic#6364

Full Changelog: pydantic/pydantic@v1.10.10...v1.10.11

V1.10.10

What's Changed

• Fix racy doctests by @​K900 in pydantic/pydantic#6103
• ✅ Update FastAPI test script by @​Kludex in pydantic/pydantic#6117
• add roadmap to annoucement by @​samuelcolvin in pydantic/pydantic#6120
• Fixed literal validator errors for unhashable values by @​markus1978 in pydantic/pydantic#6194
• Bug fix for forward refs in generics by @​mark-todd in pydantic/pydantic#6157
• Add Pydantic Json field support to settings management by @​hramezani in pydantic/pydantic#6250

New Contributors

• @​K900 made their first contribution in pydantic/pydantic#6103
• @​markus1978 made their first contribution in pydantic/pydantic#6194

Full Changelog: pydantic/pydantic@v1.10.9...v1.10.10

V1.10.9

What's Changed

• Add Pydantic classifier by @​hramezani in pydantic/pydantic#5847
• 📌 Use Cython < v3 by @​lig in pydantic/pydantic#5845
• [cherry-pick] Fix mypy plugin for 1.4.0 (#5927) by @​cdce8p in pydantic/pydantic#5928
• Add future and past date hypothesis strategies by @​bschoenmaeckers in pydantic/pydantic#5850

... (truncated)

Changelog

Sourced from pydantic's changelog.

v1.10.13 (2023-09-27)

• Fix: Add max length check to pydantic.validate_email, #7673 by @​hramezani
• Docs: Fix pip commands to install v1, #6930 by @​chbndrhnns

v1.10.12 (2023-07-24)

• Fixes the maxlen property being dropped on deque validation. Happened only if the deque item has been typed. Changes the _validate_sequence_like func, #6581 by @​maciekglowka

v1.10.11 (2023-07-04)

• Importing create_model in tools.py through relative path instead of absolute path - so that it doesn't import V2 code when copied over to V2 branch, #6361 by @​SharathHuddar

v1.10.10 (2023-06-30)

• Add Pydantic Json field support to settings management, #6250 by @​hramezani
• Fixed literal validator errors for unhashable values, #6188 by @​markus1978
• Fixed bug with generics receiving forward refs, #6130 by @​mark-todd
• Update install method of FastAPI for internal tests in CI, #6117 by @​Kludex

v1.10.9 (2023-06-07)

• Fix trailing zeros not ignored in Decimal validation, #5968 by @​hramezani
• Fix mypy plugin for v1.4.0, #5928 by @​cdce8p
• Add future and past date hypothesis strategies, #5850 by @​bschoenmaeckers
• Discourage usage of Cython 3 with Pydantic 1.x, #5845 by @​lig

v1.10.8 (2023-05-23)

• Fix a bug in Literal usage with typing-extension==4.6.0, #5826 by @​hramezani
• This solves the (closed) issue #3849 where aliased fields that use discriminated union fail to validate when the data contains the non-aliased field name, #5736 by @​benwah
• Update email-validator dependency to >=2.0.0post2, #5627 by @​adriangb
• update AnyClassMethod for changes in python/typeshed#9771, #5505 by @​ITProKyle

Commits

• 8822578 Prepare release 1.10.13 (#7674)
• 59d8f38 [Backport] Add max length check to validate_email (#7673)
• 69b92b5 Make the v1 mypy plugin work with both v1 and v2 (#6920)
• 87bf417 Update pip commands to install 1.10 (#6930)
• d9c2af3 Prepare release 1.10.12 (#6825)
• 2aaddf6 Deque's maxlen property dropped on V1 validation (#6586)
• 15c82d9 Prepare for 1.10.11 (#6420)
• 8750c37 no longer tag docs release as latest
• 2c0e2a6 Fix import of create_model in tools.py (#6364)
• 0e8a387 Prepare for 1.10.10 (#6308)
• Additional commits viewable in compare view

Updates black from 23.3.0 to 24.3.0

Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

• Don't move comments along with delimiters, which could cause crashes (#4248)
• Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
• Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

• Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

• Note what happens when --check is used with --quiet (#4236)

24.2.0

Stable style

• Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)

Preview style

• Move the hug_parens_with_braces_and_square_brackets feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)
• Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
• Checking for newline before adding one on docstring that is almost at the line limit (#4185)
• Remove redundant parentheses in case statement if guards (#4214).

Configuration

... (truncated)

Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

• Don't move comments along with delimiters, which could cause crashes (#4248)
• Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
• Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

• Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

• Note what happens when --check is used with --quiet (#4236)

24.2.0

Stable style

• Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)

Preview style

• Move the hug_parens_with_braces_and_square_brackets feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)
• Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
• Checking for newline before adding one on docstring that is almost at the line limit (#4185)
• Remove redundant parentheses in case statement if guards (#4214).

... (truncated)

Commits

• 552baf8 Prepare release 24.3.0 (#4279)
• f000936 Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)
• 7b5a657 Fix --line-ranges behavior when ranges are at EOF (#4273)
• 1abcffc Use regex where we ignore case on windows (#4252)
• 719e674 Fix 4227: Improve documentation for --quiet --check (#4236)
• e5510af update plugin url for Thonny (#4259)
• 6af7d11 Fix AST safety check false negative (#4270)
• f03ee11 Ensure blib2to3.pygram is initialized before use (#4224)
• e4bfedb fix: Don't move comments while splitting delimiters (#4248)
• d0287e1 Make trailing comma logic more concise (#4202)
• Additional commits viewable in compare view

Updates aiohttp from 3.9.2 to 3.9.4

Release notes

Sourced from aiohttp's releases.

3.9.4

Bug fixes

• The asynchronous internals now set the underlying causes when assigning exceptions to the future objects -- by :user:webknjaz.

  Related issues and pull requests on GitHub: #8089.

• Treated values of Accept-Encoding header as case-insensitive when checking for gzip files -- by :user:steverep.

  Related issues and pull requests on GitHub: #8104.

• Improved the DNS resolution performance on cache hit -- by :user:bdraco.

  This is achieved by avoiding an :mod:asyncio task creation in this case.

  Related issues and pull requests on GitHub: #8163.

• Changed the type annotations to allow dict on :meth:aiohttp.MultipartWriter.append, :meth:aiohttp.MultipartWriter.append_json and :meth:aiohttp.MultipartWriter.append_form -- by :user:cakemanny

  Related issues and pull requests on GitHub: #7741.

• Ensure websocket transport is closed when client does not close it -- by :user:bdraco.

  The transport could remain open if the client did not close it. This change ensures the transport is closed when the client does not close it.

... (truncated)

Changelog

Sourced from aiohttp's changelog.

3.9.4 (2024-04-11)

Bug fixes

• The asynchronous internals now set the underlying causes when assigning exceptions to the future objects -- by :user:webknjaz.

  Related issues and pull requests on GitHub: :issue:8089.

• Treated values of Accept-Encoding header as case-insensitive when checking for gzip files -- by :user:steverep.

  Related issues and pull requests on GitHub: :issue:8104.

• Improved the DNS resolution performance on cache hit -- by :user:bdraco.

  This is achieved by avoiding an :mod:asyncio task creation in this case.

  Related issues and pull requests on GitHub: :issue:8163.

• Changed the type annotations to allow dict on :meth:aiohttp.MultipartWriter.append, :meth:aiohttp.MultipartWriter.append_json and :meth:aiohttp.MultipartWriter.append_form -- by :user:cakemanny

  Related issues and pull requests on GitHub: :issue:7741.

• Ensure websocket transport is closed when client does not close it -- by :user:bdraco.

  The transport could remain open if the client did not close it. This change ensures the transport is closed when the client does not close it.

... (truncated)

Commits

• b3397c7 Release v3.9.4 (#8201)
• a7e240a [PR #8320/9ba9a4e5 backport][3.9] Fix Python parser to mark responses without...
• 2833552 Escape filenames and paths in HTML when generating index pages (#8317) (#8319)
• ed43040 [PR #8309/c29945a1 backport][3.9] Improve reliability of run_app test (#8315)
• ec2be05 [PR #8299/28d026eb backport][3.9] Create marker for internal tests (#8307)
• 292d961 [PR #8304/88c80c14 backport][3.9] Check for backports in CI (#8305)
• cebe526 Fix handling of multipart/form-data (#8280) (#8302)
• 270ae9c [PR #8297/d15f07cf backport][3.9] Upgrade to llhttp 9.2.1 (#8292) (#8298)
• bb23105 [PR #8283/54e13b0a backport][3.9] Fix blocking I/O in the event loop while pr...
• 3f79241 [PR #8286/28f1fd88 backport][3.9] docs: remove repetitive word in comment (#8...
• Additional commits viewable in compare view

Updates langchain from 0.1.9 to 0.2.3

Release notes

Sourced from langchain's releases.

langchain==0.2.3

Release langchain==0.2.3

Changes since langchain==0.2.2

langchain[patch]: Release 0.2.3 (#22644) multiple: get rid of pyproject extras (#22581) langchain[minor]: add universal init_model (#22039)

langchain-community==0.2.3

Release langchain-community==0.2.3

Changes since langchain-community==0.2.2

community[patch]: Release 0.2.3 (#22562) community[patch]: improve test setup to accurately test filtering of labels in neo4j (#22531) community[minor]: Add support for metadata indexing policy in Cassandra vector store (#22548) community[minor]: add user agent for web scraping loaders (#22480) community[minor]: Add native async support to SQLChatMessageHistory (#22065) community[minor]: Improve InMemoryVectorStore with ability to persist to disk and filter on metadata. (#22186) community[patch]: add detailed paragraph and example for BaichuanTextEmbeddings (#22031) community[minor]: Added filter search for LanceDB (#22461) community: fix huggingface deprecations (#22522) community[minor]: Vectara Integration Update - Streaming, FCS, Chat, updates to documentation and example notebooks (#21334)

langchain-community==0.2.2

Release langchain-community==0.2.2

Changes since langchain-community==0.2.1

community[patch]: Release 0.2.2 (#22496) community, milvus, pinecone, qdrant, mongo: Broadcast operation failure while using simsimd beyond v3.7.7 (#22271) community[minor]: Add tools calls to ChatEdenAI (#22320) docs : Update docstrings for OpenAI base.py (#22221) communty[patch]: Native RAG Support in Prem AI langchain (#22238) community[minor]: Enable retrieval api calls in PebbloRetrievalQA (#21958) community[patch]: deprecate all HF classes (#22444) community[minor]: Improve Cassandra VectorStore as_retriever (#22465) community[patch]: Upstash Vector Store Namespace Support (#22251) community[minor]: Updating payload for pebblo discover API (#22309) community: add standard chat model params to Ollama (#22446) community[patch]: Update OpenVINO embedding and reranker to support static input shape (#22171) community[minor]: Implement MiniMaxChat interface (#22391) community[patch]: Airtable to allow for addtl params (#22092) community[patch]: update embeddings/oracleai.py (#22240) community[patch]: Update the default api_url and reqeust_body of sparkllm embedding (#22136) community[minor]: Add IPEX-LLM BGE embedding support on both Intel CPU and GPU (#22226) community: fix AzureSearch delete documents (#22315) community: fix missing apify_api_token field in ApifyWrapper (#22421) add embed_image API to JinaEmbedding (#22416) doc: fix wrong documentation on FAISS load_local function (#22310) community[patch]: Standardize qianfan model init args name (#22322) community: adding tool_call_id for every ToolCall (#22323)

... (truncated)

Commits

• fe2e5a3 langchain[patch]: Release 0.2.3 (#22644)
• a24a9c6 multiple: get rid of pyproject extras (#22581)
• 4367e89 core[patch]: Release 0.2.5 (#22642)
• 28f744c core[patch]: Correctly order parent ids in astream events (from root to immed...
• 8359261 updated oracleai_demo.ipynb (#22635)
• 035a9c9 core[minor]: Add parent_ids to astream_events API (#22563)
• 67e58fd docs[patch]: Fix diffbot docs (#22584)
• 6b8963a docs: Add information about run time binding values to tools (#22623)
• aa49163 docs[patch]: typo in AutoGPT example notebook (#22631)
• ffe75d1 docs: typo in dev container documentation (#22630)
• Additional commits viewable in compare view

Updates litellm from 1.34.21 to 1.40.0

Release notes

Sourced from litellm's releases.

v1.40.0

What's Changed

• fix: fix streaming with httpx client by @​krrishdholakia in BerriAI/litellm#3944
• feat(scheduler.py): add request prioritization scheduler by @​krrishdholakia in BerriAI/litellm#3954
• [FEAT] Perf improvements - litellm.completion / litellm.acompletion - Cache OpenAI client by @​ishaan-jaff in BerriAI/litellm#3956
• fix(http_handler.py): support verify_ssl=False when using httpx client by @​krrishdholakia in BerriAI/litellm#3959
• Litellm docker compose start by @​krrishdholakia in BerriAI/litellm#3961

Full Changelog: BerriAI/litellm@v1.39.6...v1.40.0

Docker Run LiteLLM Proxy

docker run \
-e STORE_MODEL_IN_DB=True \
-p 4000:4000 \
ghcr.io/berriai/litellm:main-v1.40.0

Don't want to maintain your internal proxy? get in touch 🎉

Hosted Proxy Alpha: https://calendly.com/d/4mp-gd3-k5k/litellm-1-1-onboarding-chat

Load Test LiteLLM Proxy Results

Name	Status	Median Response Time (ms)	Average Response Time (ms)	Requests/s	Failures/s	Request Count	Failure Count	Min Response Time (ms)	Max Response Time (ms)
/chat/completions	Passed ✅	120.0	133.63252197830545	6.467733658247951	0.0	1936	0	94.77090299998281	801.180971000008
Aggregated	Passed ✅	120.0	133.63252197830545	6.467733658247951	0.0	1936	0	94.77090299998281	801.180971000008

v1.39.6

We're launching team member invites (No SSO Required) on v1.39.6 🔥 Invite team member to view LLM Usage, Spend per service https://docs.litellm.ai/docs/proxy/ui

👍 [Fix] Cache Vertex AI clients - Major Perf improvement for VertexAI models

✨ Feat - Send new users invite emails on creation (using 'send_invite_email' on /user/new)

💻 UI - allow users to sign in with with email/password

🔓 [UI] Admin UI Invite Links for non SSO

✨ PR - [FEAT] Perf improvements - litellm.completion / litellm.acompletion - Cache OpenAI client

... (truncated)

Commits

• 93c9ea1 fix(openai.py): fix client caching logic
• 63fb3a9 Merge pull request #3961 from BerriAI/litellm_docker_compose_start
• ce4ba80 build(docker-compose.yml): load local .env in docker compose quick start
• 2245ee1 test(test_scheduler.py): fix testing
• 9b4a19b build(docker-compose.yml): startup docker compose with postgres
• 7715267 fix(router.py): simplify scheduler
• 27087f6 Merge pull request #3959 from BerriAI/litellm_support_verify_ssl_false
• d7160eb fix(test_scheduler.py): fix test
• a16a1c4 fix(http_handler.py): allow setting ca bundle path
• f75c15d fix(proxy_server.py): security fix - fix sql injection attack on global spend...
• Additional commits viewable in compare view

Updates llama-index from 0.9.45 to 0.10.13

Release notes

Sourced from llama-index's releases.

v0.10.13

New Features

• Added a llama-pack for KodaRetriever, for on-the-fly alpha tuning (#11311)
• Added support for mistral-large (#11398)
• Last token pooling mode for huggingface embeddings models like SFR-Embedding-Mistral (#11373)
• Added fsspec support to SimpleDirectoryReader (#11303)

Bug Fixes / Nits

• Fixed an issue with context window + prompt helper (#11379)
• Moved OpenSearch vector store to BasePydanticVectorStore (#11400)
• Fixed function calling in fireworks LLM (#11363)
• Made cohere embedding types more automatic (#11288)
• Improve function calling in react agent (#11280)
• Fixed MockLLM imports (#11376)

v0.10.12

No release notes provided.

v0.10.11

No release notes provided.

v0.10.10

No release notes provided.

v0.10.8

No release notes provided.

v0.10.7

New Features

• Added Self-Discover llamapack (#10951)

Bug Fixes / Nits

• Fixed linting in CICD (#10945)
• Fixed using remote graph stores (#10971)
• Added missing LLM kwarg in NoText response synthesizer (#10971)
• Fixed openai import in rankgpt (#10971)
• Fixed resolving model name to string in openai embeddings (#10971)
• Off by one error in sentence window node parser (#10971)

v0.10.6

[0.10.6] - 2024-02-17

First, apologies for missing the changelog the last few versions. Trying to figure out the best process with 400+ packages.

At some point, each package will have a dedicated changelog.

... (truncated)

Changelog

Sourced from llama-index's changelog.

[0.10.13] - 2024-02-26

New Features

• Added a llama-pack for KodaRetriever, for on-the-fly alpha tuning (#11311)
• Added support for mistral-large (#11398)
• Last token pooling mode for huggingface embeddings models like SFR-Embedding-Mistral (#11373)
• Added fsspec support to SimpleDirectoryReader (#11303)

Bug Fixes / Nits

• Fixed an issue with context window + prompt helper (#11379)
• Moved OpenSearch vector store to BasePydanticVectorStore (#11400)
• Fixed function calling in fireworks LLM (#11363)
• Made cohere embedding types more automatic (#11288)
• Improve function calling in react agent (#11280)
• Fixed MockLLM imports (#11376)

[0.10.12] - 2024-02-22

New Features

• Added llama-index-postprocessor-colbert-rerank package (#11057)
• MyMagicAI LLM (#11263)
• MariaTalk LLM (#10925)
• Add retries to github reader (#10980)
• Added FireworksAI embedding and LLM modules (#10959)

Bug Fixes / Nits

• Fixed string formatting in weaviate (#11294)
• Fixed off-by-one error in semantic splitter (#11295)
• Fixed download_llama_pack for multiple files (#11272)
• Removed BUILD files from packages (#11267)
• Loosened python version reqs for all packages (#11267)
• Fixed args issue with chromadb (#11104)

[0.10.11] - 2024-02-21

Bug Fixes / Nits

• Fixed multi-modal LLM for async acomplete (#11064)
• Fixed issue with llamaindex-cli imports (#11068)

[0.10.10] - 2024-02-20

I'm still a bit wonky with our publishing process -- apologies. This is just a version bump to ensure the changes that were supposed to happen in 0.10.9 actually did get published. (AF)

... (truncated)

Commits

• 6d642a0 Logan/release v0.10.13 (#11408)
• 78a4c9e fix prompt helper init (#11379)
• 52383c7 Update opensearch vectorstore to PydanticVectorStore class (#11400)
• 4077fee Astra DB Vector store, package rename for naming consistency (#11056)
• 65290f5 Alpha Tuning Llama Pack: KodaRetriever (#11311)
• 70d4a5c Only firefunction is function calling (#11363)
• 3a10235 Elastic Search retrieval : Bug Fix for Cases when No Relationships Detected (...
• 0b13b8d Add support for mistral-large (#11398)
• 1f48dd9 Astra DB clients identify themselves as coming through LlamaIndex usage (#11396)
• 6024956 Last token pooling for Huggingface models like SFR-Embedding-Mistral (#11373)
• Additional commits viewable in compare view

Updates msal from 1.26.0 to 1.28.0

Release notes

Sourced from msal's releases.

MSAL Python 1.28.0

• New feature: PublicClientApplication and ConfidentialClientApplication have a new oidc_authority parameter that can be used to specify authority of any generic OpenID Connect authority, typically the customized domain for CIAM. (#676, #678)
• Dropping Python 2.7

MSAL Python 1.27.0

What's Changed

Release Notes:

• New feature: remove_tokens_for_client() will remove tokens acquired by acquire_token_for_client() (#640, #650, #666)
• Performance: Throughput of token-cache-hit happy path is roughly 2x faster (#644)
• Adjustment: MSAL no longer attempts to validate an ID token's time (#656, #657)
• Adjustment: Bump upstream broker dependency to 0.14.x
• Improvement: Better chance to remove accounts from broker (#651)
• Improvement: Cleaner console output when the http local server is visited in https protocol (#546)
• Improvement: Reduce a bare except clause (#667)

Note:

• The previous preview features in previous 1.27.0b2 requires more beta testing, so they did NOT make it to 1.27.0. If you want to beta test 1.27.0b2, follow its own instruction.
• MSAL Python 1.27 is the last version that still runs on Python 2.7

New Contributors

• @​Singletoned made their first contribution in AzureAD/microsoft-authentication-library-for-python#667

Full Changelog: AzureAD/microsoft-authentication-library-for-python@1.26.0...1.27.0

MSAL Python 1.27.0b2

This beta release is a preview for the broker-on-Mac support. You can install it by pip install msal==1.27.0b2. Please refer to this staged API Reference Doc for how to opt into this new feature.

Commits

• 2d03ad9 MSAL Python 1.28.0
• e06ca87 A semi-auto script to test Azure CLI with broker
• 70e09fb Implements a new optional oidc_authority parameter
• c442c78 Rebrand from AAD to Microsoft Entra (#655)
• 8ff855e Merge pull request #673 from AzureAD/iulico/update-broker-default-redirect-uri
• c73b7ca update the default broker redirect uri
• 7e04519 Releasing 1.27
• 9a866ca Don't use bare except when importing (#667)
• 59c3000 Pick up latest PyMsalRuntime 0.14.x
• 4f0e03d CCA can be tested by: python -m msal
• Additional commits viewable in compare view

Updates requests from 2.31.0 to 2.32.2

Release notes

Sourced from requests's releases.

v2.32.2

2.32.2 (2024-05-21)

Deprecations

• To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

  A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

• Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

• Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

• verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)
• Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

• Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)
• Fixed deserialization bug in JSONDecodeError. (#6629)
• Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.2 (2024-05-21)

Deprecations

• To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

  A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

• Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

• Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

• verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems ...

  Description has been truncated