Bump requests from 2.32.4 to 2.33.0

[dependabot]

Bumps requests from 2.32.4 to 2.33.0.

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[claude]

🔍 Dependency Analysis Summary

This PR bumps requests by a single minor version. It is largely a maintenance release: a Python version-support drop, a build-system migration, and a small auth-handling bug fix. commcare-cloud only uses the stable, high-level requests API (get/post/put, RequestException, requests.exceptions.*), none of which are affected.

• Overall risk assessment: LOW

---

📋 Detailed Changelog Review

requests (2.32.4 → 2.33.0)

• Changes:
  • Dropped support for Python 3.9 (following its end of life).
  • Migrated to a PEP 517 build system using setuptools (Migrate build system to PEP 517 psf/requests#7012).
  • Fixed a bug where an empty netrc entry could cause malformed authentication to be applied on Python 3.11+ (Fix empty netrc entry usage psf/requests#7205).
  • Hardening change to the requests.utils.extract_zipped_paths utility (only relevant if you call that function directly).
  • Inline type hints are previewed as landing in the next release (2.34.0), not this one.
• Breaking Changes: None for the runtime API. The only removal is Python 3.9 support.
• Migration Notes: None — commcare-cloud already requires python ~=3.10.0 (see pyproject.toml:10), so the 3.9 drop has no effect.

---

⚠️ Impact Assessment

• Breaking Changes Found: No.
• Affected Files: None require changes. requests is imported in src/commcare_cloud/events.py, src/commcare_cloud/commands/sentry.py, src/commcare_cloud/commands/deploy/sentry.py, src/commcare_cloud/commands/deploy/formplayer.py, src/commcare_cloud/commands/deploy/slack.py, and src/commcare_cloud/commands/terraform/aws.py. All usages are standard request calls and exception handling. No use of requests.utils / extract_zipped_paths, and no reliance on netrc-based auth in these paths.
• Test Impact: None expected.
• Configuration Changes: None.

---

🛠️ Recommendations

• Action Required: None beyond a normal merge once CI passes.
• Testing Focus: A quick smoke check of the HTTP-using commands (Sentry release creation, Slack deploy notifications, formplayer /info health check, AWS instance-identity lookup in terraform/aws.py) is sufficient, though no behavioral change is expected.
• Follow-up Tasks: None. Be aware the next release (2.34.0) introduces inline type hints, which could matter if/when type-checking is enabled.
• Merge Recommendation: APPROVE

---

📚 Useful Links

• requests changelog (HISTORY.md)
• requests releases

[AmitPhulera]

Reviewed changelog. No breaking changes. Safe to merge.