Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Initial Update #1

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
Open

Initial Update #1

wants to merge 11 commits into from

Conversation

pyup-bot
Copy link

This is my first visit to this fine repo so I have bundled all updates in a single pull request to make things easier for you to merge.

Close this pull request and delete the branch if you want me to start with single pull requests right away

Here's the executive summary:

Updates

Here's a list of all the updates bundled in this pull request. I've added some links to make it easier for you to find all the information you need.

Flask 0.10.1 » 0.12.2 PyPI | Changelog | Repo
Jinja2 2.7.3 » 2.10 PyPI | Homepage
MarkupSafe 0.23 » 1.0 PyPI | Changelog | Repo
Werkzeug 0.10.1 » 0.13 PyPI | Changelog | Homepage
argparse 1.2.1 » 1.4.0 PyPI | Changelog | Repo
httplib2 0.9 » 0.10.3 PyPI | Changelog | Repo
oauth2 1.5.211 » 1.9.0.post1 PyPI | Repo
oauthlib 0.7.2 » 2.0.6 PyPI | Changelog | Repo
requests 2.5.1 » 2.18.4 PyPI | Changelog | Homepage
requests-oauthlib 0.4.2 » 0.8.0 PyPI | Changelog | Repo
simplejson 3.6.5 » 3.13.2 PyPI | Changelog | Repo

Changelogs

Flask 0.10.1 -> 0.12.2

0.12.2

Released on May 16 2017

  • Fix a bug in safe_join on Windows.

0.12.1

Bugfix release, released on March 31st 2017

  • Prevent flask run from showing a NoAppException when an ImportError occurs
    within the imported application module.
  • Fix encoding behavior of app.config.from_pyfile for Python 3. Fix
    2118.
  • Use the SERVER_NAME config if it is present as default values for
    app.run. 2109, 2152
  • Call ctx.auto_pop with the exception object instead of None, in the
    event that a BaseException such as KeyboardInterrupt is raised in a
    request handler.

0.12

Released on December 21st 2016, codename Punsch.

  • the cli command now responds to --version.
  • Mimetype guessing and ETag generation for file-like objects in send_file
    has been removed, as per issue 104. See pull request 1849.
  • Mimetype guessing in send_file now fails loudly and doesn't fall back to
    application/octet-stream. See pull request 1988.
  • Make flask.safe_join able to join multiple paths like os.path.join
    (pull request 1730).
  • Revert a behavior change that made the dev server crash instead of returning
    a Internal Server Error (pull request 2006).
  • Correctly invoke response handlers for both regular request dispatching as
    well as error handlers.
  • Disable logger propagation by default for the app logger.
  • Add support for range requests in send_file.
  • app.test_client includes preset default environment, which can now be
    directly set, instead of per client.get.

0.11.2

Bugfix release, unreleased

  • Fix crash when running under PyPy3, see pull request 1814.

0.11.1

Bugfix release, released on June 7th 2016.

  • Fixed a bug that prevented FLASK_APP=foobar/__init__.py from working. See
    pull request 1872.

0.11

Released on May 29th 2016, codename Absinthe.

  • Added support to serializing top-level arrays to :func:flask.jsonify. This
    introduces a security risk in ancient browsers. See
    :ref:json-security for details.
  • Added before_render_template signal.
  • Added **kwargs to :meth:flask.Test.test_client to support passing
    additional keyword arguments to the constructor of
    :attr:flask.Flask.test_client_class.
  • Added SESSION_REFRESH_EACH_REQUEST config key that controls the
    set-cookie behavior. If set to True a permanent session will be
    refreshed each request and get their lifetime extended, if set to
    False it will only be modified if the session actually modifies.
    Non permanent sessions are not affected by this and will always
    expire if the browser window closes.
  • Made Flask support custom JSON mimetypes for incoming data.
  • Added support for returning tuples in the form (response, headers)
    from a view function.
  • Added :meth:flask.Config.from_json.
  • Added :attr:flask.Flask.config_class.
  • Added :meth:flask.Config.get_namespace.
  • Templates are no longer automatically reloaded outside of debug mode. This
    can be configured with the new TEMPLATES_AUTO_RELOAD config key.
  • Added a workaround for a limitation in Python 3.3's namespace loader.
  • Added support for explicit root paths when using Python 3.3's namespace
    packages.
  • Added :command:flask and the flask.cli module to start the local
    debug server through the click CLI system. This is recommended over the old
    flask.run() method as it works faster and more reliable due to a
    different design and also replaces Flask-Script.
  • Error handlers that match specific classes are now checked first,
    thereby allowing catching exceptions that are subclasses of HTTP
    exceptions (in werkzeug.exceptions). This makes it possible
    for an extension author to create exceptions that will by default
    result in the HTTP error of their choosing, but may be caught with
    a custom error handler if desired.
  • Added :meth:flask.Config.from_mapping.
  • Flask will now log by default even if debug is disabled. The log format is
    now hardcoded but the default log handling can be disabled through the
    LOGGER_HANDLER_POLICY configuration key.
  • Removed deprecated module functionality.
  • Added the EXPLAIN_TEMPLATE_LOADING config flag which when enabled will
    instruct Flask to explain how it locates templates. This should help
    users debug when the wrong templates are loaded.
  • Enforce blueprint handling in the order they were registered for template
    loading.
  • Ported test suite to py.test.
  • Deprecated request.json in favour of request.get_json().
  • Add "pretty" and "compressed" separators definitions in jsonify() method.
    Reduces JSON response size when JSONIFY_PRETTYPRINT_REGULAR=False by removing
    unnecessary white space included by default after separators.
  • JSON responses are now terminated with a newline character, because it is a
    convention that UNIX text files end with a newline and some clients don't
    deal well when this newline is missing. See
    Add JSONIFY_END_WITH_NEWLINE config variable pallets/flask#1262 -- this came up originally as a
    part of https://github.com/kennethreitz/httpbin/issues/168
  • The automatically provided OPTIONS method is now correctly disabled if
    the user registered an overriding rule with the lowercase-version
    options (issue 1288).
  • flask.json.jsonify now supports the datetime.date type (pull request
    1326).
  • Don't leak exception info of already catched exceptions to context teardown
    handlers (pull request 1393).
  • Allow custom Jinja environment subclasses (pull request 1422).
  • flask.g now has pop() and setdefault methods.
  • Turn on autoescape for flask.templating.render_template_string by default
    (pull request 1515).
  • flask.ext is now deprecated (pull request 1484).
  • send_from_directory now raises BadRequest if the filename is invalid on
    the server OS (pull request 1763).
  • Added the JSONIFY_MIMETYPE configuration variable (pull request 1728).
  • Exceptions during teardown handling will no longer leave bad application
    contexts lingering around.

0.10.2

(bugfix release, release date to be announced)

  • Fixed broken test_appcontext_signals() test case.
  • Raise an :exc:AttributeError in :func:flask.helpers.find_package with a
    useful message explaining why it is raised when a PEP 302 import hook is used
    without an is_package() method.
  • Fixed an issue causing exceptions raised before entering a request or app
    context to be passed to teardown handlers.
  • Fixed an issue with query parameters getting removed from requests in
    the test client when absolute URLs were requested.
  • Made before_first_request into a decorator as intended.
  • Fixed an etags bug when sending a file streams with a name.
  • Fixed send_from_directory not expanding to the application root path
    correctly.
  • Changed logic of before first request handlers to flip the flag after
    invoking. This will allow some uses that are potentially dangerous but
    should probably be permitted.
  • Fixed Python 3 bug when a handler from app.url_build_error_handlers
    reraises the BuildError.

MarkupSafe 0.23 -> 1.0

1.0

  • Fixed custom types not invoking __unicode__ when used
    with format().
  • Added __version__ module attribute
  • Improve unescape code to leave lone ampersands alone.

Werkzeug 0.10.1 -> 0.13

0.13

Released on December 7th 2017

  • Deprecate support for Python 2.6 and 3.3. CI tests will not run
    for these versions, and support will be dropped completely in the next
    version. (pallets/meta24_)
  • Raise TypeError when port is not an integer. (1088_)
  • Fully deprecate werkzeug.script. Use Click_ instead. (1090_)
  • response.age is parsed as a timedelta. Previously, it was
    incorrectly treated as a datetime. The header value is an integer
    number of seconds, not a date string. (414_)
  • Fix a bug in TypeConversionDict where errors are not propagated
    when using the converter. (1102_)
  • Authorization.qop is a string instead of a set, to comply with
    RFC 2617. (984_)
  • An exception is raised when an encoded cookie is larger than, by
    default, 4093 bytes. Browsers may silently ignore cookies larger than
    this. BaseResponse has a new attribute max_cookie_size and
    dump_cookie has a new argument max_size to configure this.
    (780, 1109)
  • Fix a TypeError in werkzeug.contrib.lint.GuardedIterator.close.
    (1116_)
  • BaseResponse.calculate_content_length now correctly works for
    Unicode responses on Python 3. It first encodes using
    iter_encoded. (705_)
  • Secure cookie contrib works with string secret key on Python 3.
    (1205_)
  • Shared data middleware accepts a list instead of a dict of static
    locations to preserve lookup order. (1197_)
  • HTTP header values without encoding can contain single quotes.
    (1208_)
  • The built-in dev server supports receiving requests with chunked
    transfer encoding. (1198_)

.. _Click: https://www.palletsprojects.com/p/click/
.. _pallets/meta24: https://github.com/pallets/meta/issues/24
.. _414: pallets/werkzeug#414
.. _705: pallets/werkzeug#705
.. _780: pallets/werkzeug#780
.. _984: pallets/werkzeug#984
.. _1088: pallets/werkzeug#1088
.. _1090: pallets/werkzeug#1090
.. _1102: pallets/werkzeug#1102
.. _1109: pallets/werkzeug#1109
.. _1116: pallets/werkzeug#1116
.. _1197: pallets/werkzeug#1197
.. _1198: pallets/werkzeug#1198
.. _1205: pallets/werkzeug#1205
.. _1208: pallets/werkzeug#1208

0.12.2

Released on May 16 2017

  • Fix regression: Pull request 892 prevented Werkzeug from correctly
    logging the IP of a remote client behind a reverse proxy, even when using
    ProxyFix.
  • Fix a bug in safe_join on Windows.

0.12.1

Released on March 15th 2017

  • Fix crash of reloader (used on debug mode) on Windows.
    (OSError: [WinError 10038]). See pull request 1081
  • Partially revert change to class hierarchy of Headers. See 1084.

0.12

Released on March 10th 2017

  • Spit out big deprecation warnings for werkzeug.script
  • Use inspect.getfullargspec internally when available as
    inspect.getargspec is gone in 3.6
  • Added support for status code 451 and 423
  • Improved the build error suggestions. In particular only if
    someone stringifies the error will the suggestions be calculated.
  • Added support for uWSGI's caching backend.
  • Fix a bug where iterating over a FileStorage would result in an infinite
    loop.
  • Datastructures now inherit from the relevant baseclasses from the
    collections module in the stdlib. See 794.
  • Add support for recognizing NetBSD, OpenBSD, FreeBSD, DragonFlyBSD platforms
    in the user agent string.
  • Recognize SeaMonkey browser name and version correctly
  • Recognize Baiduspider, and bingbot user agents
  • If LocalProxy's wrapped object is a function, refer to it with wrapped
    attribute.
  • The defaults of generate_password_hash have been changed to more secure
    ones, see pull request 753.
  • Add support for encoding in options header parsing, see pull request
    933.
  • test.Client now properly handles Location headers with relative URLs, see
    pull request 879.
  • When HTTPException is raised, it now prints the description, for easier
    debugging.
  • Werkzeug's dict-like datastructures now have view-methods under Python 2,
    see pull request 968.
  • Fix a bug in MultiPartParser when no stream_factory was provided
    during initialization, see pull request 973.
  • Disable autocorrect and spellchecker in the debugger middleware's Python
    prompt, see pull request 994.
  • Don't redirect to slash route when method doesn't match, see pull request
    907.
  • Fix a bug when using SharedDataMiddleware with frozen packages, see pull
    request 959.
  • Range header parsing function fixed for invalid values 974.
  • Add support for byte Range Requests, see pull request 978.
  • Use modern cryptographic defaults in the dev servers 1004.
  • the post() method of the test client now accept file object through the data
    parameter.
  • Color run_simple's terminal output based on HTTP codes 1013.
  • Fix self-XSS in debugger console, see 1031.
  • Fix IPython 5.x shell support, see 1033.

0.11.16

  • werkzeug.serving: set CONTENT_TYPE / CONTENT_LENGTH if only they're provided by the client
  • werkzeug.serving: Fix crash of reloader when using python -m werkzeug.serving.

0.11.15

Released on December 30th 2016.

  • Bugfix for the bugfix in the previous release.

0.11.14

Released on December 30th 2016.

  • Check if platform can fork before importing ForkingMixIn, raise exception
    when creating ForkingWSGIServer on such a platform, see PR 999.

0.11.13

Released on December 26th 2016.

  • Correct fix for the reloader issuer on certain Windows installations.

0.11.12

Released on December 26th 2016.

  • Fix more bugs in multidicts regarding empty lists. See 1000.
  • Add some docstrings to some EnvironBuilder properties that were previously
    unintentionally missing.
  • Added a workaround for the reloader on windows.

0.11.11

Released on August 31st 2016.

  • Fix JSONRequestMixin for Python3. See 731
  • Fix broken string handling in test client when passing integers. See 852
  • Fix a bug in parse_options_header where an invalid content type
    starting with comma or semi-colon would result in an invalid return value,
    see issue 995.
  • Fix a bug in multidicts when passing empty lists as values, see issue
    979.
  • Fix a security issue that allows XSS on the Werkzeug debugger. See 1001.

0.11.10

Released on May 24th 2016.

  • Fixed a bug that occurs when running on Python 2.6 and using a broken locale.
    See pull request 912.
  • Fixed a crash when running the debugger on Google App Engine. See issue 925.
  • Fixed an issue with multipart parsing that could cause memory exhaustion.

0.11.9

Released on April 24th 2016.

  • Corrected an issue that caused the debugger not to use the
    machine GUID on POSIX systems.
  • Corrected a Unicode error on Python 3 for the debugger's
    PIN usage.
  • Corrected the timestamp verification in the pin debug code.
    Without this fix the pin was remembered for too long.

0.11.8

Released on April 15th 2016.

  • fixed a problem with the machine GUID detection code on OS X
    on Python 3.

0.11.7

Released on April 14th 2016.

  • fixed a regression on Python 3 for the debugger.

0.11.6

Released on April 14th 2016.

  • werkzeug.serving: Still show the client address on bad requests.
  • improved the PIN based protection for the debugger to make it harder to
    brute force via trying cookies. Please keep in mind that the debugger
    is not intended for running on production environments
  • increased the pin timeout to a week to make it less annoying for people
    which should decrease the chance that users disable the pin check
    entirely.
  • werkzeug.serving: Fix broken HTTP_HOST when path starts with double slash.

0.11.5

Released on March 22nd 2016.

  • werkzeug.serving: Fix crash when attempting SSL connection to HTTP server.

0.11.4

Released on February 14th 2016.

  • Fixed werkzeug.serving not working from -m flag.
  • Fixed incorrect weak etag handling.

0.11.3

Released on December 20th 2015.

  • Fixed an issue with copy operations not working against
    proxies.
  • Changed the logging operations of the development server to
    correctly log where the server is running in all situations
    again.
  • Fixed another regression with SSL wrapping similar to the
    fix in 0.11.2 but for a different code path.

0.11.2

Released on November 12th 2015.

  • Fix inheritable sockets on Windows on Python 3.
  • Fixed an issue with the forking server not starting any longer.
  • Fixed SSL wrapping on platforms that supported opening sockets
    by file descriptor.
  • No longer log from the watchdog reloader.
  • Unicode errors in hosts are now better caught or converted into
    bad request errors.

0.11.1

Released on November 10th 2015.

  • Fixed a regression on Python 3 in the debugger.

0.11

Released on November 8th 2015, codename Gleisbaumaschine.

  • Added reloader_paths option to run_simple and other functions in
    werkzeug.serving. This allows the user to completely override the Python
    module watching of Werkzeug with custom paths.
  • Many custom cached properties of Werkzeug's classes are now subclasses of
    Python's property type (issue 616).
  • bind_to_environ now doesn't differentiate between implicit and explicit
    default port numbers in HTTP_HOST (pull request 204).
  • BuildErrors are now more informative. They come with a complete sentence
    as error message, and also provide suggestions (pull request 691).
  • Fix a bug in the user agent parser where Safari's build number instead of
    version would be extracted (pull request 703).
  • Fixed issue where RedisCache set_many was broken for twemproxy, which doesn't
    support the default MULTI command (pull request 702).
  • mimetype parameters on request and response classes are now always
    converted to lowercase.
  • Changed cache so that cache never expires if timeout is 0. This also fixes
    an issue with redis setex (issue 550)
  • Werkzeug now assumes UTF-8 as filesystem encoding on Unix if Python
    detected it as ASCII.
  • New optional has method on caches.
  • Fixed various bugs in parse_options_header (pull request 643).
  • If the reloader is enabled the server will now open the socket in the parent
    process if this is possible. This means that when the reloader kicks in
    the connection from client will wait instead of tearing down. This does
    not work on all Python versions.
  • Implemented PIN based authentication for the debugger. This can optionally
    be disabled but is discouraged. This change was necessary as it has been
    discovered that too many people run the debugger in production.
  • Devserver no longer requires SSL module to be installed.

0.10.5

(bugfix release, release date yet to be decided)

  • Reloader: Correctly detect file changes made by moving temporary files over
    the original, which is e.g. the case with PyCharm (pull request 722).
  • Fix bool behavior of werkzeug.datastructures.ETags under Python 3 (issue
    744).

0.10.4

(bugfix release, released on March 26th 2015)

  • Re-release of 0.10.3 with packaging artifacts manually removed.

0.10.3

(bugfix release, released on March 26th 2015)

  • Re-release of 0.10.2 without packaging artifacts.

0.10.2

(bugfix release, released on March 26th 2015)

  • Fixed issue where empty could break third-party libraries that relied on
    keyword arguments (pull request 675)
  • Improved Rule.empty by providing a ```get_empty_kwargsto allow setting custom kwargs without having to override entireempty`` method. (pull
    request ``675``)
  • Fixed extra_files parameter for reloader to not cause startup
    to crash when included in server params
  • Using MultiDict when building URLs is now not supported again. The behavior
    introduced several regressions.
  • Fix performance problems with stat-reloader (pull request 715).

argparse 1.2.1 -> 1.4.0

1.4.0

  • make argparse behave for default args aka
    issue 12776, 11839: call argparse type function only once.
  • move to github:ThomasWaldmann/argparse
  • add TW as maintainer / give TW's email
  • add some usecase to README, clarify issue tracking
  • add a note to tox.ini about testing on dead snakes

1.3.0

  • added aliases support (thanks to Roland Kammerer!) + tests for it
  • use tox for testing python >= 2.6
  • tests successfully on 3.4 also (without random hash seed)
  • added argparse.external_lib = True so one can test one is really using /
    testing the external library (and not the builtin one in stdlib of recent
    Pythons)

1.2.2

  • added universal wheel support, built, signed and uploaded with:
    python setup.py sdist bdist_wheel upload --identity="Thomas Waldmann" --sign
  • host the files on pypi

httplib2 0.9 -> 0.10.3

0.10.3

Fix certificate validation on Python<=2.7.8 without ssl.CertificateError
httplib2/httplib2#45

0.10.2

Just a reupload of 0.10.1, which was broken for Python3
because wheel distribution doesn't play well with our 2/3 split code base.
httplib2/httplib2#43

0.10.1

This is the first release by new httplib2 team. See post by Joe
https://bitworking.org/news/2016/03/an_update_on_httplib2

Remove VeriSign Class 3 CA from trusted certs
https://googleonlinesecurity.blogspot.com/2015/12/proactive-measures-in-digital.html

Add IdenTrust DST Root CA X3
httplib2/httplib2#26

Support for specifying the SSL protocol version (Python v2)
https://github.com/jcgregorio/httplib2/issues/329

On App Engine use urlfetch's default deadline if None is passed.

Fix TypeError on AppEngine “init() got an unexpected keyword argument 'ssl_version’”
httplib2/httplib2#12

Send SNI data for SSL connections on Python 2.7.9+
Verify the server hostname if certificate validation is enabled
httplib2/httplib2#13

Add proxy_headers argument to ProxyInfo constructor
httplib2/httplib2#21

Make disable_ssl_certificate_validation work with Python 3.5.
httplib2/httplib2#15

Fix socket error handling
httplib2/httplib2@eb74685
httplib2/httplib2@e7f6e62

0.9.2

Fixes in this release:

jcgregorio/httplib2#313

Fix incorrect ResponseNotReady exceptions, retry on transient errors.

0.9.1

Fixes in this release:

jcgregorio/httplib2#296

   There was a problem with headers when a binary string is passed (like
   b&#39;Authorization&#39;).

jcgregorio/httplib2#276

   Default to doing DNS resolution through a proxy server if present.

oauthlib 0.7.2 -> 2.0.6

2.0.5

  • Fix OAuth2Error.response_mode for 463.
  • Documentation improvement.

2.0.4

  • Fixed typo that caused OAuthlib to crash because of the fix in "Address missing OIDC errors and fix a typo in the AccountSelectionRequired exception".

2.0.3

  • Address missing OIDC errors and fix a typo in the AccountSelectionRequired exception.
  • Update proxy keys on CaseInsensitiveDict.update().
  • Redirect errors according to OIDC's response_mode.
  • Added universal wheel support.
  • Added log statements to except clauses.
  • According to RC7009 Section 2.1, a client should include authentication credentials when revoking its tokens.
    As discussed in 339, this is not make sense for public clients.
    However, in that case, the public client should still be checked that is infact a public client (authenticate_client_id).
  • Improved prompt parameter validation.
  • Added two error codes from RFC 6750.
  • Hybrid response types are now be fragment-encoded.
  • Added Python 3.6 to Travis CI testing and trove classifiers.
  • Fixed BytesWarning issued when using a string placeholder for bytes object.
  • Documented PyJWT dependency and improved logging and exception messages.
  • Documentation improvements and fixes.

2.0.2

  • Dropped support for Python 2.6, 3.2 & 3.3.
  • (FIX) OpenIDConnector will no longer raise an AttributeError when calling openid_authorization_validator() twice.

2.0.1

  • (FIX) Normalize handling of request.scopes list

2.0.0

  • (New Feature) OpenID support.
  • Documentation improvements and fixes.

1.1.2

  • (Fix) Query strings should be able to include colons.
  • (Fix) Cast body to a string to ensure that we can perform a regex substitution on it.

1.1.1

  • (Enhancement) Better sanitisation of Request objects repr.

1.1.0

  • (Fix) '(', ')', '/' and '?' are now safe characters in url encoded strings.
  • (Enhancement) Added support for specifying if refresh tokens should be created on authorization code grants.
  • (Fix) OAuth2Token now handles None scopes correctly.
  • (Fix) Request token is now available for OAuth 1.
  • (Enhancement) OAuth2Token is declared with slots for smaller memory footprint.
  • (Enhancement) RefreshTokenGrant now allows to set issue_new_refresh_tokens.
  • Documentation improvements and fixes.

1.0.3

  • (Fix) Changed the documented return type of the invalidate_request_token() method from the RSA key to None since nobody is using the return type.
  • (Enhancement) Added a validator log that will store what the endpoint has computed for debugging and logging purposes (OAuth 1 only for now).

1.0.2

  • (Fix) Allow client secret to be null for public applications that do not mandate it's specification in the query parameters.
  • (Fix) Encode request body before hashing in order to prevent encoding errors in Python 3.

1.0.1

  • (Fix) Added token_type_hint to the list of default Request parameters.

1.0.0

  • (Breaking Change) Replace pycrypto with cryptography from https://cryptography.io
  • (Breaking Change) Update jwt to 1.0.0 (which is backwards incompatible) no oauthlib api changes
    were made.
  • (Breaking Change) Raise attribute error for non-existing attributes in the Request object.
  • (Fix) Strip whitespace off of scope string.
  • (Change) Don't require to return the state in the access token response.
  • (Change) Hide password in logs.
  • (Fix) Fix incorrect invocation of prepare_refresh_body in the OAuth2 client.
  • (Fix) Handle empty/non-parsable query strings.
  • (Fix) Check if an RSA key is actually needed before requiring it.
  • (Change) Allow tuples for list_to_scope as well as sets and lists.
  • (Change) Add code to determine if client authentication is required for OAuth2.
  • (Fix) Fix error message on invalid Content-Type header for OAtuh1 signing.
  • (Fix) Allow ! character in query strings.
  • (Fix) OAuth1 now includes the body hash for requests that specify any content-type that isn't x-www-form-urlencoded.
  • (Fix) Fixed error description in oauth1 endpoint.
  • (Fix) Revocation endpoint for oauth2 will now return an empty string in the response body instead of 'None'.
  • Increased test coverage.
  • Performance improvements.
  • Documentation improvements and fixes.

0.9.4

Released on Jun 9, 2017

  • Handle HTTP Basic Auth for client's access to token endpoint (301)
  • Allow having access tokens without expiration date (311)
  • Log exception traceback. (281)

0.9.3

Released on Jun 2, 2016

  • Revert the wrong implement of non credential oauth2 require auth
  • Catch all exceptions in OAuth2 providers
  • Bugfix for examples, docs and other things

0.9.2

Released on Nov 3, 2015

  • Bugfix in client parse_response when body is none.
  • Update contrib client by tonyseek
  • Typo fix for OAuth1 provider
  • Fix OAuth2 provider on non credential clients by Fleurer

0.9.1

Released on Mar 9, 2015

  • Improve on security.
  • Fix on contrib client.

0.9.0

Released on Feb 3, 2015

  • New feature for contrib client, which will become the official client in
    the future via 136_ and 176_.
  • Add appropriate headers when making POST request for access toke via 169_.
  • Use a local copy of instance 'request_token_params' attribute to avoid side
    effects via 177_.
  • Some minor fixes of contrib by Hsiaoming Yang.

.. _177: lepture/flask-oauthlib#177
.. _169: lepture/flask-oauthlib#169
.. _136: lepture/flask-oauthlib#136
.. _176: lepture/flask-oauthlib#176

0.8.0

+++++++++++++++++++++++++

  • Added Fitbit compliance fix.
  • Fixed an issue where newlines in the response body for the access token
    request would cause errors when trying to extract the token.
  • Fixed an issue introduced in v0.7.0 where users passing auth to several
    methods would encounter conflicts with the client_id and
    client_secret-derived auth. The user-supplied auth argument is now
    used in preference to those options.

requests 2.5.1 -> 2.18.4

2.18.4

+++++++++++++++++++

Improvements

  • Error messages for invalid headers now include the header name for easier debugging

Dependencies

  • We now support idna v2.6.

2.18.3

+++++++++++++++++++

Improvements

  • Running $ python -m requests.help now includes the installed version of idna.

Bugfixes

  • Fixed issue where Requests would raise ConnectionError instead of
    SSLError when encountering SSL problems when using urllib3 v1.22.

2.18.2

+++++++++++++++++++

Bugfixes

  • requests.help no longer fails on Python 2.6 due to the absence of
    ssl.OPENSSL_VERSION_NUMBER.

Dependencies

  • We now support urllib3 v1.22.

2.18.1

+++++++++++++++++++

Bugfixes

  • Fix an error in the packaging whereby the *.whl contained incorrect data that
    regressed the fix in v2.17.3.

2.18.0

+++++++++++++++++++

Improvements

  • Response is now a context manager, so can be used directly in a with statement
    without first having to be wrapped by contextlib.closing().

Bugfixes

  • Resolve installation failure if multiprocessing is not available
  • Resolve tests crash if multiprocessing is not able to determine the number of CPU cores
  • Resolve error swallowing in utils set_environ generator

2.17.3

+++++++++++++++++++

Improvements

  • Improved packages namespace identity support, for monkeypatching libraries.

2.17.2

+++++++++++++++++++

Improvements

  • Improved packages namespace identity support, for monkeypatching libraries.

2.17.1

+++++++++++++++++++

Improvements

  • Improved packages namespace identity support, for monkeypatching libraries.

2.17.0

+++++++++++++++++++

Improvements

  • Removal of the 301 redirect cache. This improves thread-safety.

2.16.5

+++++++++++++++++++

  • Improvements to $ python -m requests.help.

2.16.4

+++++++++++++++++++

  • Introduction of the $ python -m requests.help command, for debugging with maintainers!

2.16.3

+++++++++++++++++++

  • Further restored the requests.packages namespace for compatibility reasons.

2.16.2

+++++++++++++++++++

  • Further restored the requests.packages namespace for compatibility reasons.

No code modification (noted below) should be neccessary any longer.

2.16.1

+++++++++++++++++++

  • Restored the requests.packages namespace for compatibility reasons.
  • Bugfix for urllib3 version parsing.

Note: code that was written to import against the requests.packages
namespace previously will have to import code that rests at this module-level
now.

For example::

from requests.packages.urllib3.poolmanager import PoolManager

Will need to be re-written to be::

from requests.packages import urllib3
urllib3.poolmanager.PoolManager

Or, even better::

from urllib3.poolmanager import PoolManager

2.16.0

+++++++++++++++++++

  • Unvendor ALL the things!

2.15.1

+++++++++++++++++++

  • Everyone makes mistakes.

2.15.0

+++++++++++++++++++

Improvements

  • Introduction of the Response.next property, for getting the next
    PreparedResponse from a redirect chain (when allow_redirects=False).
  • Internal refactoring of __version__ module.

Bugfixes

  • Restored once-optional parameter for requests.utils.get_environ_proxies().

2.14.2

+++++++++++++++++++

Bugfixes

  • Changed a less-than to an equal-to and an or in the dependency markers to
    widen compatibility with older setuptools releases.

2.14.1

+++++++++++++++++++

Bugfixes

  • Changed the dependency markers to widen compatibility with older pip
    releases.

2.14.0

+++++++++++++++++++

Improvements

  • It is now possible to pass no_proxy as a key to the proxies
    dictionary to provide handling similar to the NO_PROXY environment
    variable.
  • When users provide invalid paths to certificate bundle files or directories
    Requests now raises IOError, rather than failing at the time of the HTTPS
    request with a fairly inscrutable certificate validation error.
  • The behavior of SessionRedirectMixin was slightly altered.
    resolve_redirects will now detect a redirect by calling
    get_redirect_target(response) instead of directly
    querying Response.is_redirect and Response.headers[&#39;location&#39;].
    Advanced users will be able to process malformed redirects more easily.
  • Changed the internal calculation of elapsed request time to have higher
    resolution on Windows.
  • Added win_inet_pton as conditional dependency for the [socks] extra
    on Windows with Python 2.7.
  • Changed the proxy bypass implementation on Windows: the proxy bypass
    check doesn't use forward and reverse DNS requests anymore
  • URLs with schemes that begin with http but are not http or https
    no longer have their host parts forced to lowercase.

Bugfixes

  • Much improved handling of non-ASCII Location header values in redirects.
    Fewer UnicodeDecodeErrors are encountered on Python 2, and Python 3 now
    correctly understands that Latin-1 is unlikely to be the correct encoding.
  • If an attempt to seek file to find out its length fails, we now
    appropriately handle that by aborting our content-length calculations.
  • Restricted HTTPDigestAuth to only respond to auth challenges made on 4XX
    responses, rather than to all auth challenges.
  • Fixed some code that was firing DeprecationWarning on Python 3.6.
  • The dismayed person emoticon (/o\\) no longer has a big head. I'm sure
    this is what you were all worrying about most.

Miscellaneous

  • Updated bundled urllib3 to v1.21.1.
  • Updated bundled chardet to v3.0.2.
  • Updated bundled idna to v2.5.
  • Updated bundled certifi to 2017.4.17.

2.13.0

+++++++++++++++++++

Features

  • Only load the idna library when we've determined we need it. This will
    save some memory for users.

Miscellaneous

  • Updated bundled urllib3 to 1.20.
  • Updated bundled idna to 2.2.

2.12.5

+++++++++++++++++++

Bugfixes

  • Fixed an issue with JSON encoding detection, specifically detecting
    big-endian UTF-32 with BOM.

2.12.4

+++++++++++++++++++

Bugfixes

  • Fixed regression from 2.12.2 where non-string types were rejected in the
    basic auth parameters. While support for this behaviour has been readded,
    the behaviour is deprecated and will be removed in the future.

2.12.3

+++++++++++++++++++

Bugfixes

  • Fixed regression from v2.12.1 for URLs with schemes that begin with "http".
    These URLs have historically been processed as though they were HTTP-schemed
    URLs, and so have had parameters added. This was removed in v2.12.2 in an
    overzealous attempt to resolve problems with IDNA-encoding those URLs. This
    change was reverted: the other fixes for IDNA-encoding have been judged to
    be sufficient to return to the behaviour Requests had before v2.12.0.

2.12.2

+++++++++++++++++++

Bugfixes

  • Fixed several issues with IDNA-encoding URLs that are technically invalid but
    which are widely accepted. Requests will now attempt to IDNA-encode a URL if
    it can but, if it fails, and the host contains only ASCII characters, it will
    be passed through optimistically. This will allow users to opt-in to using
    IDNA2003 themselves if they want to, and will also allow technically invalid
    but still common hostnames.
  • Fixed an issue where URLs with leading whitespace would raise
    InvalidSchema errors.
  • Fixed an issue where some URLs without the HTTP or HTTPS schemes would still
    have HTTP URL preparation applied to them.
  • Fixed an issue where Unicode strings could not be used in basic auth.
  • Fixed an issue encountered by some Requests plugins where constructing a
    Response object would cause Response.content to raise an
    AttributeError.

2.12.1

+++++++++++++++++++

Bugfixes

  • Updated setuptools 'security' extra for the new PyOpenSSL backend in urllib3.

Miscellaneous

  • Updated bundled urllib3 to 1.19.1.

2.12.0

+++++++++++++++++++

Improvements

  • Updated support for internationalized domain names from IDNA2003 to IDNA2008.
    This updated support is required for several forms of IDNs and is mandatory
    for .de domains.
  • Much improved heuristics for guessing content lengths: Requests will no
    longer read an entire StringIO into memory.
  • Much improved logic for recalculating Content-Length headers for
    PreparedRequest objects.
  • Improved tolerance for file-like objects that have no tell method but
    do have a seek method.
  • Anything that is a subclass of Mapping is now treated like a dictionary
    by the data= keyword argument.
  • Requests now tolerates empty passwords in proxy credentials, rather than
    stripping the credentials.
  • If a request is made with a file-like object as the body and that request is
    redirected with a 307 or 308 status code, Requests will now attempt to
    rewind the body object so it can be replayed.

Bugfixes

  • When calling response.close, the call to close will be propagated
    through to non-urllib3 backends.
  • Fixed issue where the ALL_PROXY environment variable would be preferred
    over scheme-specific variables like HTTP_PROXY.
  • Fixed issue where non-UTF8 reason phrases got severely mangled by falling
    back to decoding using ISO 8859-1 instead.
  • Fixed a bug where Requests would not correctly correlate cookies set when
    using custom Host headers if those Host headers did not use the native
    string type for the platform.

Miscellaneous

  • Updated bundled urllib3 to 1.19.
  • Updated bundled certifi certs to 2016.09.26.

2.11.1

+++++++++++++++++++

Bugfixes

  • Fixed a bug when using iter_content with decode_unicode=True for
    streamed bodies would raise AttributeError. This bug was introduced in
    2.11.
  • Strip Content-Type and Transfer-Encoding headers from the header block when
    following a redirect that transforms the verb from POST/PUT to GET.

2.11.0

+++++++++++++++++++

Improvements

  • Added support for the ALL_PROXY environment variable.
  • Reject header values that contain leading whitespace or newline characters to
    reduce risk of header smuggling.

Bugfixes

  • Fixed occasional TypeError when attempting to decode a JSON response that
    occurred in an error case. Now correctly returns a ValueError.
  • Requests would incorrectly ignore a non-CIDR IP address in the NO_PROXY
    environment variables: Requests now treats it as a specific IP.
  • Fixed a bug when sending JSON data that could cause us to encounter obscure
    OpenSSL errors in certain network conditions (yes, really).
  • Added type checks to ensure that iter_content only accepts integers and
    None for chunk sizes.
  • Fixed issue where responses whose body had not been fully consumed would have
    the underlying connection closed but not returned to the connection pool,
    which could cause Requests to hang in situations where the HTTPAdapter
    had been configured to use a blocking connection pool.

Miscellaneous

  • Updated bundled urllib3 to 1.16.
  • Some previous releases accidentally accepted non-strings as acceptable header values. This release does not.

2.10.0

+++++++++++++++++++

New Features

  • SOCKS Proxy Support! (requires PySocks; $ pip install requests[socks])

Miscellaneous

  • Updated bundled urllib3 to 1.15.1.

2.9.2

++++++++++++++++++

Improvements

  • Change built-in CaseInsensitiveDict (used for headers) to use OrderedDict
    as its underlying datastore.

Bugfixes

  • Don't use redirect_cache if allow_redirects=False
  • When passed objects that throw exceptions from tell(), send them via
    chunked transfer encoding instead of failing.
  • Raise a ProxyError for proxy related connection issues.

2.9.1

++++++++++++++++++

Bugfixes

  • Resolve regression introduced in 2.9.0 that made it impossible to send binary
    strings as bodies in Python 3.
  • Fixed errors when calculating cookie expiration dates in certain locales.

Miscellaneous

  • Updated bundled urllib3 to 1.13.1.

2.9.0

++++++++++++++++++

Minor Improvements (Backwards compatible)

  • The verify keyword argument now supports being passed a path to a
    directory of CA certificates, not just a single-file bundle.
  • Warnings are now emitted when sending files opened in text mode.
  • Added the 511 Network Authentication Required status code to the status code
    registry.

Bugfixes

  • For file-like objects that are not seeked to the very beginning, we now
    send the content length for the number of bytes we will actually read, rather
    than the total size of the file, allowing partial file uploads.
  • When uploading file-like objects, if they are empty or have no obvious
    content length we set Transfer-Encoding: chunked rather than
    Content-Length: 0.
  • We correctly receive the response in buffered mode when uploading chunked
    bodies.
  • We now handle being passed a query string as a bytestring on Python 3, by
    decoding it as UTF-8.
  • Sessions are now closed in all cases (exceptional and not) when using the
    functional API rather than leaking and waiting for the garbage collector to
    clean them up.
  • Correctly handle digest auth headers with a malformed qop directive that
    contains no token, by treating it the same as if no qop directive was
    provided at all.
  • Minor performance improvements when removing specific cookies by name.

Miscellaneous

  • Updated urllib3 to 1.13.

2.8.1

++++++++++++++++++

Bugfixes

  • Update certificate bundle to match certifi 2015.9.6.2's weak certificate
    bundle.
  • Fix a bug in 2.8.0 where requests would raise ConnectTimeout instead of
    ConnectionError
  • When using the PreparedRequest flow, requests will now correctly respect the
    json parameter. Broken in 2.8.0.
  • When using the PreparedRequest flow, requests will now correctly handle a
    Unicode-string method name on Python 2. Broken in 2.8.0.

2.8.0

++++++++++++++++++

Minor Improvements (Backwards Compatible)

  • Requests now supports per-host proxies. This allows the proxies
    dictionary to have entries of the form
    {&#39;&lt;scheme&gt;://&lt;hostname&gt;&#39;: &#39;&lt;proxy&gt;&#39;}. Host-specific proxies will be used
    in preference to the previously-supported scheme-specific ones, but the
    previous syntax will continue to work.
  • Response.raise_for_status now prints the URL that failed as part of the
    exception message.
  • requests.utils.get_netrc_auth now takes an raise_errors kwarg,
    defaulting to False. When True, errors parsing .netrc files cause
    exceptions to be thrown.
  • Change to bundled projects import logic to make it easier to unbundle
    requests downstream.
  • Changed the default User-Agent string to avoid leaking data on Linux: now
    contains only the requests version.

Bugfixes

  • The json parameter to post() and friends will now only be used if
    neither data nor files are present, consistent with the
    documentation.
  • We now ignore empty fields in the NO_PROXY environment variable.
  • Fixed problem where httplib.BadStatusLine would get raised if combining
    stream=True with contextlib.closing.
  • Prevented bugs where we would attempt to return the same connection back to
    the connection pool twice when sending a Chunked body.
  • Miscellaneous minor internal changes.
  • Digest Auth support is now thread safe.

Updates

  • Updated urllib3 to 1.12.

2.7.0

++++++++++++++++++

This is the first release that follows our new release process. For more, see
our documentation &lt;http://docs.python-requests.org/en/latest/community/release-process/&gt;_.

Bugfixes

  • Updated urllib3 to 1.10.4, resolving several bugs involving chunked transfer
    encoding and response framing.

2.6.2

++++++++++++++++++

Bugfixes

  • Fix regression where compressed data that was sent as chunked data was not
    properly decompressed. (2561)

2.6.1

++++++++++++++++++

Bugfixes

  • Remove VendorAlias import machinery introduced in v2.5.2.
  • Simplify the PreparedRequest.prepare API: We no longer require the user to
    pass an empty list to the hooks keyword argument. (c.f. 2552)
  • Resolve redirects now receives and forwards all of the original arguments to
    the adapter. (2503)
  • Handle UnicodeDecodeErrors when trying to deal with a unicode URL that
    cannot be encoded in ASCII. (2540)
  • Populate the parsed path of the URI field when performing Digest
    Authentication. (2426)
  • Copy a PreparedRequest's CookieJar more reliably when it is not an instance
    of RequestsCookieJar. (2527)

2.6.0

++++++++++++++++++

Bugfixes

  • CVE-2015-2296: Fix handling of cookies on redirect. Previously a cookie
    without a host value set would use the hostname for the redirected URL
    exposing requests users to session fixation attacks and potentially cookie
    stealing. This was disclosed privately by Matthew Daley of
    BugFuzz &lt;https://bugfuzz.com&gt;_. This affects all versions of requests from
    v2.1.0 to v2.5.3 (inclusive on both ends).
  • Fix error when requests is an install_requires dependency and python setup.py test is run. (2462)
  • Fix error when urllib3 is unbundled and requests continues to use the
    vendored import location.
  • Include fixes to urllib3's header handling.
  • Requests' handling of unvendored dependencies is now more restrictive.

Features and Improvements

  • Support bytearrays when passed as parameters in the files argument.
    (2468)
  • Avoid data duplication when creating a request with str, bytes, or
    bytearray input to the files argument.

2.5.3

++++++++++++++++++

Bugfixes

2.5.2

++++++++++++++++++

Features and Improvements

  • Add sha256 fingerprint support. (shazow/urllib3540_)
  • Improve the performance of headers. (shazow/urllib3544_)

Bugfixes

  • Copy pip's import machinery. When downstream redistributors remove
    requests.packages.urllib3 the import machinery will continue to let those
    same symbols work. Example usage in requests' documentation and 3rd-party
    libraries relying on the vendored copies of urllib3 will work without having
    to fallback to the system urllib3.
  • Attempt to quote parts of the URL on redirect if unquoting and then quoting
    fails. (2356)
  • Fix filename type check for multipart form-data uploads. (2411)
  • Properly handle the case where a server issuing digest authentication
    challenges provides both auth and auth-int qop-values. (2408)
  • Fix a socket leak. (shazow/urllib3549_)
  • Fix multiple Set-Cookie headers properly. (shazow/urllib3534_)
  • Disable the built-in hostname verification. (shazow/urllib3526_)
  • Fix the behaviour of decoding an exhausted stream. (shazow/urllib3535_)

Security

  • Pulled in an updated cacert.pem.
  • Drop RC4 from the default cipher list. (shazow/urllib3551_)

.. _shazow/urllib3551: urllib3/urllib3#551
.. _shazow/urllib3549: urllib3/urllib3#549
.. _shazow/urllib3544: urllib3/urllib3#544
.. _shazow/urllib3540: urllib3/urllib3#540
.. _shazow/urllib3535: urllib3/urllib3#535
.. _shazow/urllib3534: urllib3/urllib3#534
.. _shazow/urllib3526: urllib3/urllib3#526

requests-oauthlib 0.4.2 -> 0.8.0

0.8.0

+++++++++++++++++++++++++

  • Added Fitbit compliance fix.
  • Fixed an issue where newlines in the response body for the access token
    request would cause errors when trying to extract the token.
  • Fixed an issue introduced in v0.7.0 where users passing auth to several
    methods would encounter conflicts with the client_id and
    client_secret-derived auth. The user-supplied auth argument is now
    used in preference to those options.

0.7.0

++++++++++++++++++++++++++

  • Allowed OAuth2Session.request to take the client_id and
    client_secret parameters for the purposes of automatic token refresh,
    which may need them.

0.6.2

+++++++++++++++++++++

  • Use client_id and client_secret for the Authorization header if
    provided.
  • Allow explicit bypass of the Authorization header by setting auth=False.
  • Pass through the proxies kwarg when refreshing tokens.
  • Miscellaneous cleanups.

0.6.1

+++++++++++++++++++++++++

  • Fixed a bug when sending authorization in headers with no username and
    password present.
  • Make sure we clear the session token before obtaining a new one.
  • Some improvements to the Slack compliance fix.
  • Avoid timing problems around token refresh.
  • Allow passing arbitrary arguments to requests when calling
    fetch_request_token and fetch_access_token.

0.6.0

+++++++++++++++++++++++++

  • Add compliance fix for Slack.
  • Add compliance fix for Mailchimp.
  • TokenRequestDenied exceptions now carry the entire response, not just the
    status code.
  • Pass through keyword arguments when refreshing tokens automatically.
  • Send authorization in headers, not just body, to maximize compatibility.
  • More getters/setters available for OAuth2 session client values.
  • Allow sending custom headers when refreshing tokens, and set some defaults.

0.5.0

+++++++++++++++++++

  • Fix TypeError being raised instead of TokenMissing error.
  • Raise requests exceptions on 4XX and 5XX responses in the OAuth2 flow.
  • Avoid AttributeError when initializing the OAuth2Session class
    without complete client information.

simplejson 3.6.5 -> 3.13.2

3.13.2

  • Fix additional Python 2.x compilation issue on Windows

3.13.1

3.13.0

3.12.1

3.12.0

3.11.1

3.11.0

3.10.0

3.9.0

3.8.2

3.8.1

3.8.0

  • New iterable_as_array encoder option to perform lazy serialization of
    any iterable objects, without having to convert to tuple or list.

3.7.3

3.7.2

  • Do not cache Decimal class in encoder, only reference the decimal module.
    This may make reload work in more common scenarios.

3.7.1

3.7.0

Once you have closed this pull request, I'll create separate pull requests for every update as soon as I find them.

That's it for now!

Happy merging! 🤖

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@pyup-bot