v2.20.0

HISTORY.md

@@ -6,12 +6,29 @@ dev
 
 **Bugfixes**
 
+-   \[Short description of non-trivial change.\]
+
+2.20.0 (2018-10-18)
+-------------------
+
+**Bugfixes**
+
 -   Content-Type header parsing is now case-insensitive (e.g.
     charset=utf8 v Charset=utf8).
 -   Fixed exception leak where certain redirect urls would raise
     uncaught urllib3 exceptions.
+-   Requests removes Authorization header from requests redirected
+    from https to http on the same hostname. (CVE-2018-18074)
+-   `should_bypass_proxies` now handles URIs without hostnames (e.g.
+    files).
 
--   \[Short description of non-trivial change.\]
+**Dependencies**
+
+- Requests now supports urllib3 v1.24.
+
+**Deprecations**
+
+- Requests has officially stopped support for Python 2.6.
 
 2.19.1 (2018-06-14)
 -------------------

requests/__init__.py

@@ -57,10 +57,10 @@ def check_compatibility(urllib3_version, chardet_version):
     # Check urllib3 for compatibility.
     major, minor, patch = urllib3_version  # noqa: F811
     major, minor, patch = int(major), int(minor), int(patch)
-    # urllib3 >= 1.21.1, <= 1.23
+    # urllib3 >= 1.21.1, <= 1.24
     assert major == 1
     assert minor >= 21
-    assert minor <= 23
+    assert minor <= 24
 
     # Check chardet for compatibility.
     major, minor, patch = chardet_version.split('.')[:3]

requests/__version__.py

@@ -5,8 +5,8 @@
 __title__ = 'requests'
 __description__ = 'Python HTTP for Humans.'
 __url__ = 'http://python-requests.org'
-__version__ = '2.19.1'
-__build__ = 0x021901
+__version__ = '2.20.0'
+__build__ = 0x022000
 __author__ = 'Kenneth Reitz'
 __author_email__ = 'me@kennethreitz.org'
 __license__ = 'Apache 2.0'

setup.py

@@ -44,7 +44,7 @@ packages = ['requests']
 requires = [
     'chardet>=3.0.2,<3.1.0',
     'idna>=2.5,<2.8',
-    'urllib3>=1.21.1,<1.24',
+    'urllib3>=1.21.1,<1.25',
     'certifi>=2017.4.17'
 
 ]