chore(deps): bump requests from 2.32.5 to 2.33.0

[dependabot]

Bumps requests from 2.32.5 to 2.33.0.

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

---

Note

Low Risk
Primarily a dependency lockfile refresh; runtime impact is limited to the requests upgrade and its updated dependency constraints.

Overview
Updates poetry.lock to upgrade requests from 2.32.5 to 2.33.0, including tightened requirements (notably python>=3.10, newer certifi baseline, and updated extras metadata).

The lockfile is also regenerated with a different Poetry version, which rewrites environment markers and prunes/reshapes some conditional dependency entries (especially around docs/Jupyter-related packages) without changing application code.

^{Written by Cursor Bugbot for commit 9d8398a. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Lock file regenerated with older Poetry version

Medium Severity

The lock file was regenerated with Poetry 2.2.1 instead of the project's previous Poetry 2.3.1. This older resolver produces a fundamentally different lock file — collapsing per-Python-version package splits (e.g., removing ipython 9.x, sphinx 8.2.3, myst-parser 5.0.0, pydata-sphinx-theme 0.16.1 entries for Python 3.11+) and stripping conditional markers from dozens of packages. A PR intended to only bump requests shouldn't cause these widespread resolution changes.

 

[cursor]

Docs-only markers stripped from many transitive dependencies

Medium Severity

Dozens of packages lost their markers = {main = "extra == \"docs\""} line, including anyio, notebook, jupyterlab, jupyter-server, jinja2, tornado, httpx, and many more. Previously these were only installed in the main group when the docs extra was requested. Now they're unconditional in the main group, so a poetry install --only main without the docs extra will pull in the entire Jupyter/notebook stack and its transitive dependencies — a major unintended expansion of the production dependency footprint.

Additional Locations (2)

• poetry.lock#L3244-L3245
• poetry.lock#L2273-L2274