HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
psf
requests
Python2017–2026
psf / requests

requests

A simple, yet elegant, HTTP library.

49Distinct people
55Mentions
0Explicit recommenders
54.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A simple, yet elegant, HTTP library.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year55 dated mentions

Observed mentions: 2017-08-14 12:47:34 UTC to 2026-09-21 15:42:58 UTC.

02468102017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 8 mentions; 1 submissions, 7 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments20212022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 7 mentions; 1 submissions, 6 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 10 mentions; 0 submissions, 10 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC505
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC817
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC505
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC413
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC716
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC505
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC422
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC10010
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC404

What Hacker News says

55 sources
The headline changes in this release are related to the Python plugin host: - Upgraded Python 3.8 to Python 3.14 - Python 3.3 is now disabled by default By default, Sublime plugins now all run under the Python 3.14. The 3.8 plugin host was removed (Python 3.8 reached EOL in Oct 2024), and the 3.3 plugin host is deprecated, and will be removed in a future release. This is great for plugin devs. They get improvements to syntax, performance, type hints, the standard library, etc, and they can depend on modern versions of Python packages. Many packages no longer receive updates for 3.8 (e.g. https://github.com/psf/requests), let alone 3.3, and many others simply don't run on these older python versions (e.g. https://github.com/xberg-io/tree-sitter-language-pack). Like the plugin systems for Emacs/Neovim/VS Code (and unlike the sandboxed syste
Read the rest
ms for e.g. Zed and Helix), Sublime's plugin API has low-level access to the editor, and the runtime has full OS access. I think Sublime was smart to bet on Python for the plugin system. They released the plugin system in 2009, before Python was everywhere. The super flexible plugin API and the huge package ecosystem is a powerful combo.
In Sublime Text Build 4213
thankfully more and more projects are supporting the "standard" SSL_CERT_DIR/SSL_CERT_FILE environment variables [1] i think requests is a tricky one, as it _should_ be supporting it already based on the PR [2], but looks like it was merged in the 3.x branch and idk where that is, release-wise. there is also native TLS on linux (idk what exactly you call it); but cp cert.pem /usr/local/share/ca-certificates/cert.pem && update-ca-certificates all languages also seem to have packages around providing cert bundles which get used directly (e.g., certifi [3]), which does cause some pain [1] https://github.com/rustls/rustls-native-certs/issues/16#issu... [2] https://github.com/psf/requests/issues/2899 [3] https://pypi.org/project/certifi/
In Some secret management belongs in your HTTP proxy
Python’s urllib2 (now urllib.request) started out in the year 2000 [0]. .NET’s WebRequest was available in .NET Framework 1.1 in 2003 [1]. But since then, Microsoft noticed the issues with WebRequest and came up with HttpClient in 2012. It has some issues and footguns, like those related to HttpClient lifetime, but it’s a solid library. On the other hand, the requests library for Python started in 2011 [2], but the stdlib library hasn’t seen many improvements. [0] https://github.com/python/cpython/blob/6d7e47b8ea1b8cf82927d... [1] https://learn.microsoft.com/en-us/dotnet/api/system.net.webr... [2] https://github.com/psf/requests/blob/main/HISTORY.md#001-201...
In Why I forked httpx
At a very quick look, no evidence is given that the "bugs" found in requests are in fact reachable, i.e. not prevented by construction. And sure enough, the very first one is impossible because of a validating guard[1]: `address_in_network` only gets called after `is_valid_cidr`, which enforces the presence of a slash. I think we should hold claims about effective static analysis and/or program verification to a higher standard than this. [1]: https://github.com/psf/requests/blob/4bd79e397304d46dfccd76f...
In How to train your program verifier
There's been a branch for it (https://github.com/psf/requests/tree/hatchling) for a little while apparently; I guess they won't merge it until absolutely necessary for the 2.33 release. But that is still just over a year after I offered (https://github.com/psf/requests/issues/6775). ... Ah, I got confused for a bit. When I first noticed the `pyproject.toml` deficiency, it was because Requests was affected by the major Setuptools 72 backwards incompatibility. Then this year they were hit again by the major Setuptools 78 backwards incompatibility (which the Setuptools team consciously ignored in testing because Requests already publishes their own wheel, so this only affected the build-from-source purists like distro maintainers). See also my writeup https://lwn.net/Articles/1020576/ .
In How uv got so fast
> I just always feel frustrated, that during the great breakup from 2-3, they didn't try to fix more of the known issues Absolutely agreed. I would rather they left 2.x in someone else's hands entirely. Instead they were ultimately forced to produce 2.7, wheedle and bargain to not have to produce 2.8, and give 2.7 an extended support window instead; and they still got complaints and abuse from people upset about making changes that were generally quite easy to make. I would still have completely switched to 3.x (at least when it appeared ready) simply based on it coming from the same team and advertising the main features and fixes that it ended up with. > Reference counting instead of using a real garbage collector This is not explicitly part of the design. You are free to use other implementations. But before the `with` block was added
Read the rest
(in 2.5), reference counting was useful for deterministic cleanup. > The absolutely weak support for functional programming, which then was patched by list comprehensions and co later I'll give you this one. GvR actually didn't like this stuff very much, which is how `reduce` lost its builtin status. The basics can take you really far, though. The important thing is that functions are first-class objects. > venv and other solutions to isolate dependencies for a project There is nothing fundamentally wrong with venvs. 99% of the complaints I hear about venvs are not actually the venv's fault. (They're usually pip's fault. Pip is bad.) A venv is literally just a place to put packages (organized roughly the same way the system packages are) and a simple scheme for enabling Python to understand where that place is (so that `sys.path` can be modified at startup). Every other possibility has the same problem: either you have to learn one or more options for telling Python to use that package location, or it works by magic (which means eventually you have to understand the magic, and anyway "Explicit is better than implicit"). > The pyproject.toml format is under-specified, comes decades too late for a problem that has been solved good enough by Apache Maven more than 2 decades ago pom.xml is not at all "good enough". The pyproject.toml format is actually quite detailed (https://packaging.python.org/en/latest/specifications/pyproj...). It also has explicit design goals of a) allowing arbitrary tools to store their config and b) being human-readable and -writable. More importantly, Python didn't have something like Maven in 2004 alongside Maven because Maven only has to worry about Java code; the Python packaging system has to worry about potentially every programming language, and very commonly C, C++, FORTRAN and now Rust. In 2003 (with Python 2.2) it got `distutils`. That was designed (and Setuptools picked up the torch) to use code in `setup.py` for everything, because nobody had any concept of a real "ecosystem" yet (see if you can find some archives of the Cheeseshop from its first year, if you dare) and it was simple and seemed Pythonic at the time. And now we're in a thread where OP is upset that Python code doesn't work for 30 years, which seems like a pretty common take. It turns out that when you accommodate backwards compatibility, it gets in the way of actually fixing old problems quite a bit. There are still projects out there that are just Python code that could be perfectly well built using Flit, that are using (slow!) legacy setup.py-based build setups. Not because there's anything wrong with pyproject.toml for their purposes (there absolutely isn't), but because nobody is forcing them. People don't even keep their setup.py contents up to date, let alone pay attention to any kind of deprecation warnings. Literally the only thing that gets anyone to do anything is to break their setup, and then for most of them their action is to complain and make the Setuptools team put things back how they were. I'm not just talking about random developers on tiny forgettable projects, either. I'm talking about PSF-managed projects like Requests that: * are pure Python code * are among the most popular packages on PyPI (Requests is top ten) * had their "source builds" break this year (https://github.com/psf/requests/issues/6775) because of a removed import in setup.py for something that nobody has actually used for years (a legacy testing setup that has been completely abandoned since the project uses tox) * already had a `pyproject.toml` file but weren't actually using it to store even basic build configuration (still in `setup.cfg`, so they had all three files for really no reason). (Thankfully, something is actually getting done in Requests. Supposedly. The work for this was apparently "already done" in May 2024 and is supposed to appear "in the next minor version release". The last release as a patch release this August. The main branch of the repo doesn't reflect this work.)
In Breaking Changes in Python-3.14
This, I think, is the crux of the matter. As an example, I always knew urllib3 as one of the foundational packages that Requests uses. And I was curious, what versions of urllib3 does Requests pull in? Well, according to https://github.com/psf/requests/blob/main/setup.cfg, it's this: urllib3>=1.21.1,<3 That is exactly the kind of dependency specification I would expect to see for a package that is using semver: The current version of urllib3 is 2.x, so with semver, you set up your dependencies to avoid the next major-version number (in this case, 3). So, it seems to me that even the Requests folks assumed urllib3 was using semver.
In Deprecations via warnings don't work for Python libraries
To be fair, the advice from sigmavirus24 was about dealing with decoding the ':' character: https://github.com/psf/requests/pull/2936/files The code already had `host = ri.netloc.split(':')[0]` before that. The actual root issue is urlparse doesn't split the host, user, pass and port and trying to do it manually is very error prone: urllib.parse.urlparse('http://example.com:@evil.com:8080/') ParseResult(scheme='http', netloc='example.com:@evil.com:8080', path='/', params='', query='', fragment='') Compare this with php: parse_url ('http://example.com:@evil.com:8080/') [ "scheme" => "http", "host" => "evil.com", "port" => 8080, "user" => "example.com", "pass" => "", "path" => "/", ]
In CVE-2024-47081: Netrc credential leak in PSF requests library
Some more thoughts after digging in a bit further: * At first blush, the "breaks the Internet" title on Reddit seems quite histrionic. The initial bug report against Setuptools referenced a project (https://github.com/tomoh1r/ansible-vault) that has only a few dozen starts on GitHub and only a few thousand daily downloads from PyPI (https://pypistats.org/packages/ansible-vault) (compare to tens of millions for the most popular packages). [Removed a point about semver that was not well considered. It turns out that Setuptools version 78.0.0 never actually got released, despite being listed separately in the version history; the 78.0.1 patch was applied first.] * Projects that try to follow modern packaging standards - and pay attention to the basics - seem to run into far fewer problems overall. In particular, ansible-vault is using its py
Read the rest
project.toml only for tool config, and relies on both a setup.cfg and setup.py. Developers and maintainers in 2021 should have been well aware of standards like https://peps.python.org/pep-0621/, and have heard of the problems caused by setup.py-based metadata. The code is 100% Python (even Ansible itself is, as far as I can tell) so a setup.py is completely unnecessary. (Ansible includes a "dummy" setup.py "for compatibility with older tools", but the ecosystem really is supposed to have moved on from that by now.) * But none of this should have been a problem for the OP anyway, because - being 100% Python - the ansible-vault package should have been distributing a wheel (https://pradyunsg.me/blog/2022/12/31/wheels-are-faster-pure-...), but doesn't (https://pypi.org/project/ansible-vault/#files). (Yes, I did notice that Mr. Gedam published that article at the end of 2022. Education efforts about Python packaging around 2020-2021 were apparently quite lacking.) * The purpose of 78.0.1 was to "temporarily remove Requests from integration tests" (https://github.com/pypa/setuptools/pull/4909). In other words, they knew that this would break the build for Requests. Fortunately, Requests does follow good practice and publish a wheel, or there would have indeed been a problem worthy of a sensationalized title. (It's one of the most popular packages out there, and the stats don't even count the vendored copies included in Pip.) * Requests has been bitten by a Setuptools removal before, last July (https://github.com/psf/requests/issues/6775). That time, the removal was the only reason for bumping the version number, and then it got promptly restored in 72.1.0 anyway. This time, there was only a bugfix besides the one removal in 78.0.0, and now it's been undone in 78.0.2. (So undoing a removal is sometimes a minor update and sometimes a patch, interesting...) * When that problem occurred in July, I proposed that the packaging system should be modernized - and was told by a Requests maintainer that this was already planned since the previous release last May, to appear in the next minor version (2.33). But it's been almost a year and that release hasn't appeared yet. (I have to wonder what else they're planning to include...) * The history of the decision for the original deprecation (https://github.com/pypa/setuptools/issues/1608) is also rather interesting.
In Latest Setuptools broke a bunch of packages
> Requests I hate to say it, but the development of Requests itself has stagnated and really needs some attention. The most notable fiasco recently was the introduction of significant changes to TLS/SSL in version 2.32.0 [1][2], which caused widespread breaking issues and even led to a security vulnerability. Attempts to address these problems in versions .2 and .3 introduced new major issues which still exists in current version [3]. A patch to resolve the new issue was provided by one of the core members of the Requests project as early as June 2024 [4], but for some reason, nothing has been done about it, despite repeated pushes from the community. If you check the commit history, updates have been sparse lately, even though there are still many unresolved issues. [1] https://github.com/psf/requests/issues/6655 [2] https://github.com/p
Read the rest
In Ruff: Python linter and code formatter written in Rust

Showing the 15 most recent of 55 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.