* Change ``HTTPSConnection`` to load system CA certificates when ``ca_certs``, ``ca_cert_dir``, and ``ssl_context`` are unspecified. (Pull 1608, Issue 1603)
* Upgrade bundled rfc3986 to v1.3.2. (Pull 1609, Issue 1605)
1.25.2
Not secure
===================
* Change ``is_ipaddress`` to not detect IPvFuture addresses. (Pull 1583)
* Change ``parse_url`` to percent-encode invalid characters within the path, query, and target components. (Pull 1586)
1.25.1
Not secure
===================
* Add support for Google's ``Brotli`` package. (Pull 1572, Pull 1579)
* Upgrade bundled rfc3986 to v1.3.1 (Pull 1578)
1.25
Not secure
=================
* Require and validate certificates by default when using HTTPS (Pull 1507)
* Upgraded ``urllib3.utils.parse_url()`` to be RFC 3986 compliant. (Pull 1487)
* Added support for ``key_password`` for ``HTTPSConnectionPool`` to use encrypted ``key_file`` without creating your own ``SSLContext`` object. (Pull 1489)
* Add TLSv1.3 support to CPython, pyOpenSSL, and SecureTransport ``SSLContext`` implementations. (Pull 1496)
* Switched the default multipart header encoder from RFC 2231 to HTML 5 working draft. (Issue 303, Pull 1492)
* Fixed issue where OpenSSL would block if an encrypted client private key was given and no password was given. Instead an ``SSLError`` is raised. (Pull 1489)
* Added support for Brotli content encoding. It is enabled automatically if ``brotlipy`` package is installed which can be requested with ``urllib3[brotli]`` extra. (Pull 1532)
* Drop ciphers using DSS key exchange from default TLS cipher suites. Improve default ciphers when using SecureTransport. (Pull 1496)
* Implemented a more efficient ``HTTPResponse.__iter__()`` method. (Issue 1483)
1.24.3
Not secure
===================
* Apply fix for CVE-2019-9740. (Pull 1591)
1.24.2
Not secure
===================
* Don't load system certificates by default when any other ``ca_certs``, ``ca_certs_dir`` or ``ssl_context`` parameters are specified.
* Remove Authorization header regardless of case when redirecting to cross-site. (Issue 1510)
* Add support for IPv6 addresses in subjectAltName section of certificates. (Issue 1269)