requests

The headline changes in this release are related to the Python plugin host: - Upgraded Python 3.8 to Python 3.14 - Python 3.3 is now disabled by default By default, Sublime plugins now all run under the Python 3.14. The 3.8 plugin host was removed (Python 3.8 reached EOL in Oct 2024), and the 3.3 plugin host is deprecated, and will be removed in a future release. This is great for plugin devs. They get improvements to syntax, performance, type hints, the standard library, etc, and they can depend on modern versions of Python packages. Many packages no longer receive updates for 3.8 (e.g. https://github.com/psf/requests), let alone 3.3, and many others simply don't run on these older python versions (e.g. https://github.com/xberg-io/tree-sitter-language-pack). Like the plugin systems for Emacs/Neovim/VS Code (and unlike the sandboxed syste

thankfully more and more projects are supporting the "standard" SSL_CERT_DIR/SSL_CERT_FILE environment variables [1] i think requests is a tricky one, as it _should_ be supporting it already based on the PR [2], but looks like it was merged in the 3.x branch and idk where that is, release-wise. there is also native TLS on linux (idk what exactly you call it); but cp cert.pem /usr/local/share/ca-certificates/cert.pem && update-ca-certificates all languages also seem to have packages around providing cert bundles which get used directly (e.g., certifi [3]), which does cause some pain [1] https://github.com/rustls/rustls-native-certs/issues/16#issu... [2] https://github.com/psf/requests/issues/2899 [3] https://pypi.org/project/certifi/

Python’s urllib2 (now urllib.request) started out in the year 2000 [0]. .NET’s WebRequest was available in .NET Framework 1.1 in 2003 [1]. But since then, Microsoft noticed the issues with WebRequest and came up with HttpClient in 2012. It has some issues and footguns, like those related to HttpClient lifetime, but it’s a solid library. On the other hand, the requests library for Python started in 2011 [2], but the stdlib library hasn’t seen many improvements. [0] https://github.com/python/cpython/blob/6d7e47b8ea1b8cf82927d... [1] https://learn.microsoft.com/en-us/dotnet/api/system.net.webr... [2] https://github.com/psf/requests/blob/main/HISTORY.md#001-201...

At a very quick look, no evidence is given that the "bugs" found in requests are in fact reachable, i.e. not prevented by construction. And sure enough, the very first one is impossible because of a validating guard[1]: `address_in_network` only gets called after `is_valid_cidr`, which enforces the presence of a slash. I think we should hold claims about effective static analysis and/or program verification to a higher standard than this. [1]: https://github.com/psf/requests/blob/4bd79e397304d46dfccd76f...