Skip to content

chore: wave5 upstream merge (langchain-ai/deepagents)#47

Merged
ashsolei merged 217 commits into
mainfrom
chore/wave5-upstream-merge-deepagents
Apr 8, 2026
Merged

chore: wave5 upstream merge (langchain-ai/deepagents)#47
ashsolei merged 217 commits into
mainfrom
chore/wave5-upstream-merge-deepagents

Conversation

@ashsolei

@ashsolei ashsolei commented Apr 8, 2026

Copy link
Copy Markdown

Wave 5 hard-fork merge using worldmonitor pattern: git merge -X theirs upstream/main + iAiFy governance overlay re-application.

Divergence at start

  • 74 ahead, 214 behind
  • All ahead commits are governance/dependabot/Wave-4-P1 scaffold (preserved by overlay restore)

Strategy

  1. Plain git merge upstream/main → 79 conflicts, aborted
  2. git merge -X theirs upstream/main → 0 conflicts (auto-committed)
  3. Restored iAiFy .github/CODEOWNERS and .github/dependabot.yml from origin/main
  4. Regenerated 6 uv.lock files (deepagents, evals, cli, harbor, acp, repl) — upstream lockfiles had datasets/aiodns/bedrock-agentcore/openai parse errors after merge

Smoke test

uv lock --check passes for all 10 sub-projects.

Preserved iAiFy customizations

  • CLAUDE.md, AGENTS.md, FORK-CUSTOMIZATIONS.md
  • .github/CODEOWNERS, .github/copilot-instructions.md, .github/copilot-setup-steps.yml, .github/dependabot.yml
  • .github/agents/* (already same)
  • Wave 4 P1 libs/partners/starter_template/ (no conflict — net new path)

Runbook: ai-road-4-you/governance/docs/runbooks/fork-upstream-merge.md

mdrxy and others added 30 commits March 25, 2026 11:47
…langchain-ai#2207)

Fix duplicate `eval_categories` row in the GitHub Actions job summary
when a single category is dispatched. Previously, both a raw `(list)`
row and a `<ul>` row were always rendered — redundant for
single-category runs.
Bump `langchain-openrouter` minimum to `0.2.0`. Previously, OpenRouter
models routed through the SDK hit `init_chat_model` with no attribution
header — only the CLI had those. Now both the CLI and SDK inject app
attribution kwargs, with env var overrides (`OPENROUTER_APP_URL`,
`OPENROUTER_APP_TITLE`) respected in the SDK path.

- Add `check_openrouter_version()` and
`_openrouter_attribution_kwargs()` to `deepagents._models` — the SDK now
validates `langchain-openrouter >= 0.2.0` at runtime and injects
`app_url` / `app_title` defaults for any `openrouter:` prefixed model
- `resolve_model` gains an `openrouter:` branch that calls the version
check and passes attribution kwargs, mirroring what the CLI already does
via `_apply_openrouter_defaults`
- Update `_OPENROUTER_APP_URL` in CLI config from the GitHub repo URL to
the PyPI project page; add `app_categories: ["cli-agent"]` as a new
default attribution field
…in-ai#2208)

`SubAgentMiddleware` was calling `init_chat_model` directly to resolve
string model specs, bypassing `resolve_model`. The SDK's centralized
entrypoint that applies provider-specific defaults (e.g., OpenAI
Responses API, OpenRouter attribution headers). Subagents now route
through the same path as top-level agents.
Follow-up to langchain-ai#2200 — that PR restructured eval categories from
origin-based to capability-based names but left stale references to the
old category names (`hitl`, `tool_usage`) in help strings, CI workflow
descriptions, and the README test suite table.

## Changes
- Replace stale `hitl` and `tool_usage` examples with current category
names (`tool_use`, `retrieval`) in the `--eval-category` help text in
`conftest.py`, the `radar.py` module docstring, and the `evals.yml`
workflow input description
- Rewrite the README test suite table: add a `Category` column showing
current category assignments, reorder rows by category, and add the
previously missing `test_todos.py` entry
- Update the "Adding a new category" guide to document the
`radar_categories` vs `categories` distinction in `categories.json` and
the per-function `@pytest.mark.eval_category(...)` decorator pattern for
mixed-category files
…ain-ai#2216)

Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.32.5&new-version=2.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/deepagents/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…2221)

Add two new model group presets — `frontier` and `fast` — to the unified
model registry. `frontier` targets the strongest reasoning models across
providers (`claude-opus-4-6`, `gemini-3.1-pro-preview`, `gpt-5.4`),
while `fast` targets high-throughput models optimized for speed
(`claude-sonnet-4-6`, `gemini-3-flash-preview`, `gpt-5.4-mini`).

## Changes
- Add `eval:frontier` / `harbor:frontier` tags to
`anthropic:claude-opus-4-6`, `google_genai:gemini-3.1-pro-preview`, and
`openai:gpt-5.4` in `REGISTRY`
- Add `eval:fast` / `harbor:fast` tags to `anthropic:claude-sonnet-4-6`,
`google_genai:gemini-3-flash-preview`, and a new `openai:gpt-5.4-mini`
registry entry
- Register `frontier` and `fast` in both `_EVAL_PRESETS` and
`_HARBOR_PRESETS`
- Add `frontier`, `fast`, and `openai:gpt-5.4-mini` to the workflow
dispatch dropdown options in `evals.yml` and `harbor.yml`
…-builder-agent (langchain-ai#2220)

Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.32.5&new-version=2.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/deepagents/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ngchain-ai#2222)

Bumps the uv group with 1 update in the /examples/nvidia_deep_agent
directory: [requests](https://github.com/psf/requests).
Bumps the uv group with 1 update in the /libs/partners/modal directory:
[requests](https://github.com/psf/requests).
Bumps the uv group with 1 update in the /libs/partners/quickjs
directory: [requests](https://github.com/psf/requests).
Bumps the uv group with 1 update in the /libs/partners/runloop
directory: [requests](https://github.com/psf/requests).

Updates `requests` from 2.32.5 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `requests` from 2.32.5 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `requests` from 2.32.5 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `requests` from 2.32.5 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/deepagents/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…name (langchain-ai#2194)

* bump default recursion limit to 10_000 in deepagents
* set agent name

Users can control recursion limit for subagents using:

```python
agent = create_agent(..) or create_deep_agent(..)

agent = agent.with_config({
   'recursion_limit': 100
})
```


Closes langchain-ai#1698
…-ai#2224)

## Summary

- **Monthly schedule**: change both entries from `weekly` to `monthly`
to reduce PR noise while keeping dependencies current
- **Update-type split**: replace single wildcard groups with
`minor-and-patch` / `major` split so breaking updates arrive in a
separate PR from safe updates
- **Missing directories**: add 4 uv entries that had `pyproject.toml` +
`uv.lock` but were absent from dependabot config:
  - `libs/partners/modal`
  - `libs/partners/quickjs`
  - `libs/partners/runloop`
  - `examples/nvidia_deep_agent`

## Test plan

- [x] Verify dependabot creates PRs at monthly cadence after merge
- [x] Confirm major-version updates arrive in a separate PR from
minor/patch updates
- [x] Confirm the 4 newly added directories start receiving dependency
update PRs
…ai#2230)

The `generate_radar.py` script was adding `unit_test` back to the radar
chart despite `categories.json` excluding it from `radar_categories`.
The script collects all categories present in result scores, then
appends any not already in the ordered list — treating `unit_test` as an
"unknown" category rather than a known-excluded one.

## Changes
- Filter known-excluded categories (those in `ALL_CATEGORIES` but not
`EVAL_CATEGORIES`) from the fallback append in
`generate_radar.py:main()`, so `unit_test` scores no longer sneak onto
the radar chart
…gchain-ai#2231)

`@pytest.mark.langsmith` auto-captures test fixture values as LangSmith
dataset inputs via `inspect.signature.bind_partial()`. When a test takes
`model: BaseChatModel`, this serializes the full Pydantic model config
into the dataset example. Tests that call `run_agent()` (from
`tests.evals.utils`) as their first action are protected because
`run_agent()` calls `t.log_inputs()` internally, replacing the
auto-captured blob. Two test suites were vulnerable: tau2 (multi-turn
loop calls `run_agent()` per turn but never set test-level inputs) and
memory_agent_bench (can `pytest.skip()` before `run_agent()` ever runs).

## Changes
- Add `_log_clean_inputs()` helper to memory_agent_bench that calls
`t.log_inputs()` with a clean `config` + `model` name dict, wrapped in
`contextlib.suppress(Exception)` since these tests can run without
LangSmith
- Call `_log_clean_inputs()` at the top of `test_conflict_resolution`,
`test_time_learning`, and `test_memory_agent_bench_ci` — before
`_require_memory_agent_bench_dependencies()` and the `pytest.skip()` on
empty samples
- Add `t.log_inputs()` twice in `test_tau2_airline`: once before
`run_multi_turn()` (safety net if it raises) and once after (overrides
per-turn inputs from `run_agent()` with test-level `task_id` + `model`)
Remove duplicate model coverage from `set1` in the eval/harbor model
registry. GLM-5 and MiniMax-M2.5 were each represented twice in `set1` —
once via Baseten and once via Ollama. Since the Baseten-hosted variants
already cover these models, the Ollama entries are redundant and waste
CI minutes.
…-ai#2234)

Add a `generate_model_groups.py` script that reads the canonical model
registry in `.github/scripts/models.py` and renders a human-readable
`MODEL_GROUPS.md` listing every eval preset and its member models. This
gives contributors a quick reference for which models belong to which
eval groups without digging through the registry code.
…angchain-ai#2235)

When a tau2-airline eval task fails the DB state check, the only signal
was a log line showing two truncated hashes — useless for diagnosing
*what* diverged. Add a structured diff so failures surface the actual
vs. expected field-level discrepancies directly in the log output.

## Changes
- Add `_diff_db` helper that recursively walks two
`FlightDB.model_dump()` trees and collects human-readable per-field
diffs (extra keys, missing keys, value mismatches, list length
differences)
- `check_db_state` now calls `_diff_db` on mismatch and logs up to 30
diff lines, with a truncation notice if there are more
…angchain-ai#2223)

## Summary

- Add top-level `permissions: contents: read` to three workflow files
that were missing it (`auto-label-by-package.yml`, `_benchmark.yml`,
`release-please.yml`), preventing GITHUB_TOKEN from inheriting broad
org/repo defaults
- SHA-pin all 6 unpinned third-party actions to protect against
tag-hijacking supply chain attacks:
- `pypa/gh-action-pypi-publish@release/v1` → `ed0c5393` (release.yml ×2)
- `googleapis/release-please-action@v4` → `c3fc4de0`
(release-please.yml)
  - `astral-sh/setup-uv@v7` → `94527f2e` (release-please.yml)
  - `dorny/paths-filter@v4` → `fbd0ab8f` (ci.yml)
  - `CodSpeedHQ/action@v4` → `dfaf2584` (_benchmark.yml)

## Test plan

- [x] Verify CI passes on this PR
- [x] Confirm `_benchmark.yml` reusable workflow still functions when
called from `ci.yml`
- [x] Confirm `release-please.yml` jobs still have correct effective
permissions (job-level declarations are unchanged)
- [x] Confirm PyPI publish jobs in `release.yml` still work with the
SHA-pinned action
…ain-ai#2236)

Prewarm the markdown rendering stack (`markdown_it`, `pygments`,
Textual's `Markdown` widget) during app startup so the first
`SkillMessage` expand is instant instead of eating ~170 ms of
cold-import time. The `SkillMessage` widget also now renders its
markdown body at most once — subsequent expand/collapse toggles just
flip `display` visibility, skipping redundant parse + highlight work.

## Changes
- Add `markdown_it`, `pygments`, and `textual.widgets.Markdown` to
`_prewarm_deferred_imports` in `app.py`, including a warm instantiation
of the Python lexer to seed Pygments' internal cache
- Gate `SkillMessage._update_body_display` behind a `_md_rendered` flag
so `Markdown.update(body)` is called only on the first expand —
re-collapses and re-expands toggle `display` without re-parsing
…ai#2237)

The `write_file` and `edit_file` approval widgets displayed file path
information inconsistently — `write_file` used an unstyled plain-text
header while `edit_file` had a styled `File:` header with `+N -M` diff
stats. This PR:

- Extracts a shared `_file_header()` helper that renders a styled `File:
<path> +N -M` header consistently across both widgets
- Removes the redundant file path / line-count from the agent's
plain-text description strings (it was duplicating what the widget
already shows)
- Promotes `_format_stats()` and `_count_diff_stats()` from
`EditFileApprovalWidget` static methods to module-level functions for
reuse

<details>
<summary><code>write_file</code> — before</summary>

<img width="457" height="338" alt="before_write"
src="https://github.com/user-attachments/assets/f106946f-ae96-498c-b142-eae6d252e0f9"
/>

</details>

<details>
<summary><code>write_file</code> — after</summary>

<img width="454" height="301" alt="after_write"
src="https://github.com/user-attachments/assets/60e17f4d-f662-4969-b4d6-d8eb8512aa98"
/>

</details>

<details>
<summary><code>edit_file</code> — before</summary>

<img width="471" height="511" alt="before_edit"
src="https://github.com/user-attachments/assets/062057a3-731b-4fa5-b2e6-14dfff08c416"
/>

</details>

<details>
<summary><code>edit_file</code> — after</summary>

<img width="473" height="500" alt="after_edit"
src="https://github.com/user-attachments/assets/6b24b973-5c04-488b-8b5f-4000a5f71089"
/>

</details>
)

Fix a race condition where session stats from the active agent turn are
lost when the user exits mid-turn (e.g., `Ctrl+D` during a pending tool
call). Previously, `execute_task_textual` created `SessionStats`
internally and returned it — but if the worker was cancelled before
returning, the stats were silently dropped. Now the caller owns the
stats object from the start.
Introduce dedicated semantic color tokens for skill and tool-call
widgets, replacing hardcoded hex values and the overloaded
`$panel`/`$secondary`/`$warning` references. Skills get a purple accent
and tools get amber — both with distinct hover variants.

The unused `primary_dev` / `LC_ORANGE` color pair is removed since the
dev-install banner now reuses the `tool` token.
…n-ai#2243)

Remove the manual `cursor_blink` toggle from
`ChatTextArea.set_app_focus`. The `_app_has_focus` flag and the explicit
`cursor_blink = has_focus` assignment are no longer needed — Textual
handles cursor blink state natively when focus changes. The method still
resets `_backslash_pending_time` and re-focuses the widget when the app
regains focus.
…angchain-ai#2244)

Re: langchain-ai#2241

`_scaffold_workspace` passed absolute resolved paths (`Path.resolve()`)
as graph and checkpointer refs in the generated `langgraph.json`. On
Windows, `importlib.import_module()` receives a backslash path like
`C:\Users\...\server_graph` and raises `ModuleNotFoundError`. Since the
server subprocess already runs with `cwd=work_dir`, relative `./` refs
resolve correctly on all platforms.
mdrxy and others added 28 commits April 7, 2026 14:31
…2530)

Add an advisory CI workflow that catches stale partner dependency bounds
on SDK release PRs. When bumping the `deepagents` version (e.g., `0.5.0`
→ `0.6.0`), partner packages like `langchain-daytona` may still declare
`deepagents>=0.5.0,<0.6.0` — excluding the new release. The workflow
posts an idempotent warning comment listing affected partners and a
suggested fix, following the same marker-based comment pattern as
`check_sdk_pin.yml`.
Onboard `langchain-quickjs` to the release-please pipeline so it gets
automated versioning, changelogs, and PyPI publishing alongside the SDK
and CLI packages. The package was previously released manually; this
brings it in line with the existing release infrastructure.
Onboard `langchain-repl` to the release-please pipeline so it gets
automated versioning, changelogs, and PyPI publishing alongside the SDK
and CLI packages. The package was previously released manually; this
brings it in line with the existing release infrastructure.
)

Release notes previously dropped internal contributors (org members)
entirely — only external community contributors were listed. This adds a
separate "Internal maintainers" section so org members who contributed
to a release get credited too.
)

Release PRs created by release-please were never getting package labels
(e.g., `repl`, `quickjs`, `deepagents`) because release-please uses
`GITHUB_TOKEN`, and GitHub doesn't fire `pull_request_target` events for
PRs created by that token. This also affected all other packages whose
release-please component names (like `langchain-repl`, `deepagents-acp`)
had no `scopeToLabel` mapping.

## Changes
- Add `labelPR()` to `pr-labeler.js` — a reusable function that applies
title-based, file-based, and size labels to a given PR number, composing
the existing `matchTitleLabels`, `matchFileLabels`, and `computeSize`
helpers
- Call `labelPR()` from a new step in `release-please.yml` after
checkout, with `continue-on-error: true` so labeling failures never
block release detection or downstream publish jobs
- Add missing `scopeToLabel` entries for all release-please component
names: `deepagents-acp`, `langchain-daytona`, `langchain-modal`,
`langchain-quickjs`, `langchain-repl`, `langchain-runloop`
- Add missing `fileRules` for `libs/partners/quickjs/` and `libs/repl/`
so file-based labeling works for those packages
…hain-ai#2540)

The `--openrouter-provider` workflow input was being injected into
`PYTEST_ADDOPTS` for every matrix entry, including non-OpenRouter models
like `baseten:` and `ollama:`. Those models hit the conftest
`ValueError` guard and scored 0 across all categories, producing a
combined radar chart that only showed the one OpenRouter model that
actually ran.
- Replaces the base prompt's broad ambiguity rule with a tighter
"minimum useful followup" instruction
- Adds short shared clarification policy block for defaults, constraint
handling, higher-value followups, and monitoring semantics
> [!CAUTION]
> Merging this PR will automatically publish to **PyPI** and create a
**GitHub release**.

For the full release process, see
[`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md).

---

_Everything below this line will be the GitHub release body._

---


##
[0.5.1](langchain-ai/deepagents@deepagents==0.5.0...deepagents==0.5.1)
(2026-04-07)


### Features

* **sdk:** `BASE_AGENT_PROMPT` tweaks
([langchain-ai#2541](langchain-ai#2541))
([812eef1](langchain-ai@812eef1))
* **sdk:** add `artifacts_root` to `CompositeBackend` and middleware
([langchain-ai#2490](langchain-ai#2490))
([753ee56](langchain-ai@753ee56))


### Bug Fixes

* **sdk:** updates for multimodal
([langchain-ai#2514](langchain-ai#2514))
([a2edf3e](langchain-ai@a2edf3e))

---

_Everything above this line will be the GitHub release body._

---

> [!NOTE]
> A **New Contributors** section is appended to the GitHub release notes
automatically at publish time (see [Release
Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline),
step 2).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ai#2544)

Post per-model eval results to each matrix job's summary as it
completes, rather than waiting for the aggregate job (which blocks on
all matrix jobs). Gives progressive visibility into eval runs — useful
when slower models are still in-flight.
Add light and dark theme support to the eval radar charts. The renderer
gets a full visual redesign — themed backgrounds, styled grid/spines,
score annotation pills with background boxes, a staggered radial layout
for multi-model overlap, and a `langchain-ai/deep-agents` watermark.
Both variants are generated on every CI run and served via `<picture>` +
`prefers-color-scheme` so GitHub auto-selects the right one for the
reader's theme.
## Summary

- Updates vendored airline `tasks.json` to tau3, which fixes bugs in the
original tau2 task definitions
- Updates source attribution in docstrings and LICENSE

## Why

The [τ³-bench release
notes](https://github.com/sierra-research/tau2-bench/blob/dev/tau3/CHANGELOG.md)
document 27 airline task fixes — incorrect expected actions, wrong
argument values, ambiguous user instructions, and impossible
constraints. All 15 of our evaluated tasks were affected. This PR
updates `tasks.json` to the corrected upstream version so the eval
grades against correct ground truth.

No code changes were needed. `db.json` and `policy.md` are unchanged
between τ² and τ³, and the evaluation code is compatible with the new
task data.

## Source

[`sierra-research/tau2-bench` `dev/tau3`
branch](https://github.com/sierra-research/tau2-bench/tree/dev/tau3),
specifically the
[CHANGELOG](https://github.com/sierra-research/tau2-bench/blob/dev/tau3/CHANGELOG.md)
"Airline task fixes" section.

---------

Co-authored-by: Mason Daugherty <[email protected]>
Co-authored-by: Mason Daugherty <[email protected]>
Process for selecting the tag of a given eval:
- baseline: ~53 tests (passed on all 3 frontier models)
- hillclimb: ~34 tests (failed on at least 1 frontier model)
Took a recent run of all the evals and aggregated the data as shown
above.

---------

Co-authored-by: Mason Daugherty <[email protected]>
Co-authored-by: Mason Daugherty <[email protected]>
improve prompt, handle some edge cases; this seems to max out our simple
tool usage eval
…i#2454)

Add automated LLM analysis of eval failures in CI. When evals fail, it's
often unclear *why* from raw pass/fail counts — this surfaces
per-failure root-cause explanations directly in the GitHub Actions
summary, with zero overhead on passing runs.

## Changes

- Capture per-test failure details (`test_name`, `category`, truncated
`failure_message`) in `pytest_reporter.py` into the `evals_report.json`
`failures` list — only populated on failures, with a 30k-char truncation
limit to stay within LLM context
- Add `analyze_eval_failures.py` script that reads failures from the
report, fans out to an LLM via `asyncio.gather`, and writes results to
both `failure_analysis.json` artifact and `$GITHUB_STEP_SUMMARY`
- Wire two new `workflow_dispatch` inputs in `evals.yml`:
`analyze_failures` boolean toggle (default on) and `analysis_model`
dropdown to select the analysis LLM (defaults to
`anthropic:claude-haiku-4-5-20251001`)

---------

Co-authored-by: Mason Daugherty <[email protected]>
…gchain-ai#2550)

Clean up the eval CI summary rendering: per-model results were
full-width vertical tables that dominated the page. Now they're compact
horizontal tables inside collapsed `<details>` toggles, radar charts are
constrained to 500px, and the aggregate section has a frontmatter
callout clarifying these are the final results. Also hardens the inline
Python against unclosed `<details>` tags and malformed
`experiment_links` entries.
…i#2553)

Surface the `analyze_failures` and `analysis_model` inputs in the "📝 Log
dispatch inputs" step summary so operators can see at a glance whether
LLM failure analysis is active and which model is being used. Only shown
when enabled — no noise when off.
…n-ai#2555)

Add a startup warning when `TAVILY_API_KEY` is not set, alerting users
that web search is unavailable. Also introduce a `/notifications` slash
command with a modal settings screen so users can toggle individual
startup warnings on or off without hand-editing `config.toml`.

## Changes
- Add `tavily` to `check_optional_tools` — checks `settings.has_tavily`
and the `[warnings].suppress` config, matching the existing `ripgrep`
pattern
- Add `NotificationSettingsScreen` modal with per-warning checkboxes
that persist immediately to `~/.deepagents/config.toml` via
`suppress_warning`/`unsuppress_warning`
- Add `unsuppress_warning()` in `model_config.py` as the inverse of
`suppress_warning`, with the same atomic temp-file write strategy
- Split the old `_RIPGREP_SUPPRESS_HINT` into `_SUPPRESS_HINT_TUI`
(points to `/notifications`) and `_SUPPRESS_HINT_CLI` (shows
`config.toml` snippet with a `<key>` placeholder), and add
Tavily-specific formatting for both output modes
- Harden `suppress_warning` and `unsuppress_warning` against
`[warnings].suppress` not being a list
Add an early credential check in `create_model()` so users get an
actionable error at startup — naming the exact env var to set — instead
of an opaque auth failure on the first LLM call. Providers that support
implicit auth (e.g., Vertex AI's ADC) are excluded via the new
`IMPLICIT_AUTH_PROVIDERS` set.
@ashsolei
ashsolei merged commit 3c939ab into main Apr 8, 2026
10 of 14 checks passed
@ashsolei
ashsolei deleted the chore/wave5-upstream-merge-deepagents branch April 8, 2026 12:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.