Bump vcrpy from 8.2.1 to 8.3.0

[dependabot]

Bumps vcrpy from 8.2.1 to 8.3.0.

Release notes

Sourced from vcrpy's releases.

v8.3.0

What's Changed

• Add support for niquests (#980) — thanks @​ionelmc
• Recording now fails fast if a request or response contains a Python object the safe YAML loader (introduced in 8.2.1) couldn't read back, instead of writing a cassette that breaks on replay. The error shows exactly how to register the object if you need it (#1007, #1009) — thanks @​Polandia94
• New vcr.serializers.yamlserializer.with_custom_tags(...) builds a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) — thanks @​Polandia94
• Clearer error when a cassette contains an unsupported YAML tag, and the stale git.io migration link is gone (#1007, #1008) — thanks @​gaoflow
• Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

Full Changelog: kevin1024/vcrpy@v8.2.1...v8.3.0

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

• 8.3.0

  • Add support for niquests (#980) - thanks @​ionelmc
  • Refuse to record a cassette containing a Python object the safe YAML loader could not read back, so recording fails fast instead of producing a cassette that breaks on replay (#1007, #1009) - thanks @​Polandia94
  • Add vcr.serializers.yamlserializer.with_custom_tags to build a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) - thanks @​Polandia94
  • Clearer error when a cassette contains an unsupported YAML tag, and remove the stale git.io migration link (#1007, #1008) - thanks @​gaoflow
  • Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

• 8.2.1

  • SECURITY: Load cassettes with a safe YAML loader, preventing arbitrary code execution when a cassette from an untrusted source is loaded (GHSA-rpj2-4hq8-938g) - thanks @​RamiAltai and @​EQSTLab
  • Validate record_mode and raise a clear error on an invalid value (#208)
  • Recommend pytest-recording over the unmaintained pytest-vcr in the docs (#986)

• 8.2.0

  • Add support for httpx 2.x (#993) - thanks @​dsfaccini
  • Patch httpx transports instead of httpcore (#972) - thanks @​seowalex
  • Fix aiohttp 3.14 compatibility: AsyncStreamReaderMixin removed and ClientResponse now requires stream_writer (#995) - thanks @​dsfaccini
  • Account for modified requests when storing played cassettes, so drop_unused_requests honours before_record_request filtering (#962) - thanks @​jamesbraza
  • Make the request URL available on VCRHTTPResponse (#976) - thanks @​dAnjou
  • Improve error message when a matching request has already been consumed (#985) - thanks @​Polandia94
  • Fix body check in convert_body_to_unicode to use an explicit type check (#982) - thanks @​Polandia94
  • Add env proxy cassette regression test (#994) - thanks @​tine1117
  • Remove milestone references from docs (#984) - thanks @​Polandia94
  • CI: bump sphinx-rtd-theme from 3.0.2 to 3.1.0 (#973)

• 8.1.1

  • Fix sync requests in async contexts for HTTPX (#965) - thanks @​seowalex
  • CI: bump peter-evans/create-pull-request from 7 to 8 (#969)

• 8.1.0

  • Enable brotli decompression if available (via brotli, brotlipy or brotlicffi) (#620) - thanks @​immerrr
  • Fix aiohttp allowing both data and json arguments when one is None (#624) - thanks @​leorochael
  • Fix usage of io-like interface with VCR.py (#906) - thanks @​tito and @​kevdevg
  • Migrate to declarative Python package config (#767) - thanks @​deronnax
  • Various linting fixes - thanks @​jairhenrique
  • CI: bump actions/checkout from 5 to 6 (#955)

• 8.0.0

  • BREAKING: Drop support for Python 3.9 (major version bump) - thanks @​jairhenrique
  • BREAKING: Drop support for urllib3 < 2 - fixes CVE warnings from urllib3 1.x (#926, #880) - thanks @​jairhenrique
  • New feature: drop_unused_requests option to remove unused interactions from cassettes (#763) - thanks @​danielnsilva
  • Rewrite httpx support to patch httpcore instead of httpx (#943) - thanks @​seowalex
    • Fixes httpx.ResponseNotRead exceptions (#832, #834)
    • Fixes KeyError: 'follow_redirects' (#945)
    • Adds support for custom httpx transports
  • Fix HTTPS proxy handling - proxy address no longer ends up in cassette URIs (#809, #914) - thanks @​alga

... (truncated)

Commits

• c599974 Release v8.3.0
• 68cbe59 Show how to register a custom object in the cassette-not-saved error
• 7a898b5 Refuse to record cassettes the safe YAML loader can't read back (#1012)
• 1421b36 fix: show descriptive error when cassette contains unsupported YAML tags (#1008)
• b1fb62b Merge pull request #1000 from kevin1024/dependabot/pre_commit/https-/github.c...
• 9e74117 Fix stale keep-alive connection reuse; unpin werkzeug (#1001)
• 30a721d Loosen up some things to allow vcrpy to work with niquests (#980)
• 393e349 build(deps): bump https://github.com/astral-sh/ruff-pre-commit
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Reviewed. This is a minimal, mechanical dependabot bump (vcrpy 8.2.1 → 8.3.0, one line in requirements/local.txt), so most standard review categories (test coverage, security, perf) don't really apply — no application code changes. A few notes:

Worth checking: is the aiohttp compat shim now dead code?

requirements/local.txt:17-24 carries a comment (and opencontractserver/utils/vcr_replay.py::ensure_aiohttp_vcr_compat() + issue #1920) explaining that vcrpy's aiohttp stub subclasses aiohttp.streams.AsyncStreamReaderMixin, a symbol aiohttp 3.14 removed, and instructs: "Bump vcrpy here and delete the shim once a release ships the vcrpy#996 fix."

Looking at vcrpy's own changelog (pulled from this PR's description), 8.2.0 already lists: "Fix aiohttp 3.14 compatibility: AsyncStreamReaderMixin removed and ClientResponse now requires stream_writer (#995)." Since the pre-PR pin was already 8.2.1 (newer than 8.2.0), it looks like that upstream fix may have shipped before this bump, which would mean:

• ensure_aiohttp_vcr_compat() in vcr_replay.py
• its call sites in conftest.py and maybe_vcr_cassette()
• the regression tests in test_vcr_replay.py::EnsureAiohttpVcrCompatTests
• the stale requirements/local.txt comment referencing an "unreleased PR Add Redis integration tests and CI workflow #996"

...may all now be removable dead code/docs per the repo's "no dead code" guidance in CLAUDE.md.

This predates this specific PR (the shim was already arguably stale at 8.2.1), so it's not a blocker for merging the bump itself — but since this PR touches that exact comment block, it'd be a good moment to verify (e.g. diff vcr/stubs/aiohttp_stubs.py between the old and new pinned versions, or just try removing the shim and confirming test_vcr_cassette_entry_works still passes) and clean up if confirmed. If someone already checked this when 8.1.1→8.2.1 landed and confirmed the shim is still needed for a different reason, disregard.

Otherwise: no breaking changes noted in the 8.2.1→8.3.0 range (the vcrpy 8.0.0 breaking changes — dropping Python 3.9 / urllib3 <2 — predate this bump and aren't relevant here), and the version is only used in requirements/local.txt (dev/test only, not shipped to production), so risk is low. Safe to merge as-is if the shim question above turns out to be a non-issue.