Httpx

Latest version: v0.27.2

Safety actively analyzes 681874 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 7 of 13

0.14.0

Not secure
The 0.14 release includes a range of improvements to the public API, intended on preparing for our upcoming 1.0 release.

* Our HTTP/2 support is now fully optional. **You now need to use `pip install httpx[http2]` if you want to include the HTTP/2 dependencies.**
* Our HSTS support has now been removed. Rewriting URLs from `http` to `https` if the host is on the HSTS list can be beneficial in avoiding roundtrips to incorrectly formed URLs, but on balance we've decided to remove this feature, on the principle of least surprise. Most programmatic clients do not include HSTS support, and for now we're opting to remove our support for it.
* Our exception hierarchy has been overhauled. Most users will want to stick with their existing `httpx.HTTPError` usage, but we've got a clearer overall structure now. See https://www.python-httpx.org/exceptions/ for more details.

When upgrading you should be aware of the following public API changes. Note that deprecated usages will currently continue to function, but will issue warnings.

* You should now use `httpx.codes` consistently instead of `httpx.StatusCodes`.
* Usage of `httpx.Timeout()` should now always include an explicit default. Eg. `httpx.Timeout(None, pool=5.0)`.
* When using `httpx.Timeout()`, we now have more concisely named keyword arguments. Eg. `read=5.0`, instead of `read_timeout=5.0`.
* Use `httpx.Limits()` instead of `httpx.PoolLimits()`, and `limits=...` instead of `pool_limits=...`.
* The `httpx.Limits(max_keepalive=...)` argument is now deprecated in favour of a more explicit `httpx.Limits(max_keepalive_connections=...)`.
* Keys used with `Client(proxies={...})` should now be in the style of `{"http://": ...}`, rather than `{"http": ...}`.
* The multidict methods `Headers.getlist()` and `QueryParams.getlist()` are deprecated in favour of more consistent `.get_list()` variants.
* The `URL.is_ssl` property is deprecated in favour of `URL.scheme == "https"`.
* The `URL.join(relative_url=...)` method is now `URL.join(url=...)`. This change does not support warnings for the deprecated usage style.

One notable aspect of the 0.14.0 release is that it tightens up the public API for `httpx`, by ensuring that several internal attributes and methods have now become strictly private.

The following previously had nominally public names on the client, but were all undocumented and intended solely for internal usage. They are all now replaced with underscored names, and should not be relied on or accessed.

These changes should not affect users who have been working from the `httpx` documentation.

* `.merge_url()`, `.merge_headers()`, `.merge_cookies()`, `.merge_queryparams()`
* `.build_auth()`, `.build_redirect_request()`
* `.redirect_method()`, `.redirect_url()`, `.redirect_headers()`, `.redirect_stream()`
* `.send_handling_redirects()`, `.send_handling_auth()`, `.send_single_request()`
* `.init_transport()`, `.init_proxy_transport()`
* `.proxies`, `.transport`, `.netrc`, `.get_proxy_map()`

See pull requests 997, 1065, 1071.

Some areas of API which were already on the deprecation path, and were raising warnings or errors in 0.13.x have now been escalated to being fully removed.

* Drop `ASGIDispatch`, `WSGIDispatch`, which have been replaced by `ASGITransport`, `WSGITransport`.
* Drop `dispatch=...`` on client, which has been replaced by `transport=...``
* Drop `soft_limit`, `hard_limit`, which have been replaced by `max_keepalive` and `max_connections`.
* Drop `Response.stream` and` `Response.raw`, which have been replaced by ``.aiter_bytes` and `.aiter_raw`.
* Drop `proxies=<transport instance>` in favor of `proxies=httpx.Proxy(...)`.

See pull requests 1057, 1058.

Added

* Added dedicated exception class `httpx.HTTPStatusError` for `.raise_for_status()` exceptions. (Pull 1072)
* Added `httpx.create_ssl_context()` helper function. (Pull 996)
* Support for proxy exlcusions like `proxies={"https://www.example.com": None}`. (Pull #1099)
* Support `QueryParams(None)` and `client.params = None`. (Pull 1060)

Changed

* Use `httpx.codes` consistently in favour of `httpx.StatusCodes` which is placed into deprecation. (Pull 1088)
* Usage of `httpx.Timeout()` should now always include an explicit default. Eg. `httpx.Timeout(None, pool=5.0)`. (Pull 1085)
* Switch to more concise `httpx.Timeout()` keyword arguments. Eg. `read=5.0`, instead of `read_timeout=5.0`. (Pull 1111)
* Use `httpx.Limits()` instead of `httpx.PoolLimits()`, and `limits=...` instead of `pool_limits=...`. (Pull 1113)
* Keys used with `Client(proxies={...})` should now be in the style of `{"http://": ...}`, rather than `{"http": ...}`. (Pull #1127)
* The multidict methods `Headers.getlist` and `QueryParams.getlist` are deprecated in favour of more consistent `.get_list()` variants. (Pull 1089)
* `URL.port` becomes `Optional[int]`. Now only returns a port if one is explicitly included in the URL string. (Pull 1080)
* The `URL(..., allow_relative=[bool])` parameter no longer exists. All URL instances may be relative. (Pull 1073)
* Drop unnecessary `url.full_path = ...` property setter. (Pull 1069)
* The `URL.join(relative_url=...)` method is now `URL.join(url=...)`. (Pull 1129)
* The `URL.is_ssl` property is deprecated in favour of `URL.scheme == "https"`. (Pull 1128)

Fixed

* Add missing `Response.next()` method. (Pull 1055)
* Ensure all exception classes are exposed as public API. (Pull 1045)
* Support multiple items with an identical field name in multipart encodings. (Pull 777)
* Skip HSTS preloading on single-label domains. (Pull 1074)
* Fixes for `Response.iter_lines()`. (Pull 1033, 1075)
* Ignore permission errors when accessing `.netrc` files. (Pull 1104)
* Allow bare hostnames in `HTTP_PROXY` etc... environment variables. (Pull 1120)
* Settings `app=...` or `transport=...` bypasses any environment based proxy defaults. (Pull 1122)
* Fix handling of `.base_url` when a path component is included in the base URL. (Pull 1130)

---

0.13.3

Not secure
Fixed

* Include missing keepalive expiry configuration. (Pull 1005)
* Improved error message when URL redirect has a custom scheme. (Pull 1002)

0.13.2

Not secure
Fixed

* Include explicit "Content-Length: 0" on POST, PUT, PATCH if no request body is used. (Pull 995)
* Add `http2` option to `httpx.Client`. (Pull 982)
* Tighten up API typing in places. (Pull 992, 999)

0.13.1

Not secure
Fixed

* Fix pool options deprecation warning. (Pull 980)
* Include `httpx.URLLib3ProxyTransport` in top-level API. (Pull 979)

0.13.0

Not secure
This release switches to `httpcore` for all the internal networking, which means:

* We're using the same codebase for both our sync and async clients.
* HTTP/2 support is now available with the sync client.
* We no longer have a `urllib3` dependency for our sync client, although there is still an *optional* `URLLib3Transport` class.

It also means we've had to remove our UDS support, since maintaining that would have meant having to push back our work towards a 1.0 release, which isn't a trade-off we wanted to make.

We also now have [a public "Transport API"](https://www.python-httpx.org/advanced/transports/#custom-transports), which you can use to implement custom transport implementations against. This formalises and replaces our previously private "Dispatch API".

Changed

* Use `httpcore` for underlying HTTP transport. Drop `urllib3` requirement. (Pull 804, 967)
* Rename pool limit options from `soft_limit`/`hard_limit` to `max_keepalive`/`max_connections`. (Pull 968)
* The previous private "Dispatch API" has now been promoted to a public "Transport API". When customizing the transport use `transport=...`. The `ASGIDispatch` and `WSGIDispatch` class naming is deprecated in favour of `ASGITransport` and `WSGITransport`. (Pull 963)

Added

* Added `URLLib3Transport` class for optional `urllib3` transport support. (Pull 804, 963)
* Streaming multipart uploads. (Pull 857)
* Logging via HTTPCORE_LOG_LEVEL and HTTPX_LOG_LEVEL environment variables
and TRACE level logging. (Pull encode/httpcore79)

Fixed

* Performance improvement in brotli decoder. (Pull 906)
* Proper warning level of deprecation notice in `Response.stream` and `Response.raw`. (Pull 908)
* Fix support for generator based WSGI apps. (Pull 887)
* Reuse of connections on HTTP/2 in close concurrency situations. (Pull encode/httpcore81)
* Honor HTTP/2 max concurrent streams settings (Pull encode/httpcore89, encode/httpcore90)
* Fix bytes support in multipart uploads. (Pull 974)
* Improve typing support for `files=...`. (Pull 976)

Removed

* Dropped support for `Client(uds=...)` (Pull 804)

0.13.0.dev2

Not secure
The 0.13.0.dev2 is a *pre-release* version. To install it, use `pip install httpx --pre`.

Added

* Logging via HTTPCORE_LOG_LEVEL and HTTPX_LOG_LEVEL environment variables
and TRACE level logging. (HTTPCore Pull 79)

Fixed

* Reuse of connections on HTTP/2 in close concurrency situations. (HTTPCore Pull 81)
* When using an `app=<ASGI app>` observe neater disconnect behaviour instead of sending empty body messages. (Pull 919)

Page 7 of 13

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.