Update requests requirement from <3.0,>=2.23.0 to >=2.33.1,<3.0

[dependabot]

Updates the requirements on requests to permit the latest version.

Release notes

Sourced from requests's releases.

v2.33.1

2.33.1 (2026-03-30)

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
• Fixed Content-Type header parsing for malformed values. (#7309)
• Improved error consistency for malformed header values. (#7308)

New Contributors

• @​ferdnyc made their first contribution in psf/requests#7277

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30

Changelog

Sourced from requests's changelog.

2.33.1 (2026-03-30)

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
• Fixed Content-Type header parsing for malformed values. (#7309)
• Improved error consistency for malformed header values. (#7308)

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.

... (truncated)

Commits

• 111d2b7 v2.33.1
• f0198e6 Fix malformed value parsing for Content-Type (#7309)
• bc7dd0f Fix cosmetic header validity parsing regex (#7308)
• 4443b1a Fix unintended test extra (#7306)
• 389eea5 Cleanup extracted file after extract_zipped_path test (#7305)
• 7407309 Packaging: DRY out extras definition (#7277)
• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
requests	[>= 2.34.dev0, < 2.35]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codeowners-service-app]

Assigned NoahStapp for team dbx-python because blink1073 is out of office.

[sleepyStick]

i don't think we can do this one at the moment given that we still support python3.9:

[2026/07/24 12:23:44.792] Creating virtual environment at: .venv
[2026/07/24 12:23:44.855] × No solution found when resolving dependencies for split (markers:
[2026/07/24 12:23:44.855] │ python_full_version > '3.9' and python_full_version < '3.10'):
[2026/07/24 12:23:44.855] ╰─▶ Because the requested Python version (>=3.9) does not satisfy
[2026/07/24 12:23:44.855] Python>=3.10 and requests>=2.33.1 depends on Python>=3.10, we can
[2026/07/24 12:23:44.855] conclude that requests>=2.33.1 cannot be used.
[2026/07/24 12:23:44.855] And because only the following versions of requests are available:
[2026/07/24 12:23:44.855] requests<=2.33.1
[2026/07/24 12:23:44.855] requests==2.34.0
[2026/07/24 12:23:44.855] requests==2.34.1
[2026/07/24 12:23:44.855] requests==2.34.2
[2026/07/24 12:23:44.855] we can conclude that requests>=2.33.1 cannot be used.
[2026/07/24 12:23:44.855] And because pymongo[ocsp] depends on requests>=2.33.1 and your project
[2026/07/24 12:23:44.855] requires pymongo[ocsp], we can conclude that your project's requirements
[2026/07/24 12:23:44.855] are unsatisfiable.
[2026/07/24 12:23:44.855] hint: Pre-releases are available for requests in the requested
[2026/07/24 12:23:44.855] range (e.g., 2.34.0.dev1), but pre-releases weren't enabled (try:
[2026/07/24 12:23:44.855] --prerelease=allow)
[2026/07/24 12:23:44.855] hint: The requires-python value (>=3.9) includes Python versions that
[2026/07/24 12:23:44.855] are not supported by your dependencies (e.g., requests>=2.33.1 only
[2026/07/24 12:23:44.855] supports >=3.10). Consider using a more restrictive requires-python
[2026/07/24 12:23:44.855] value (like >=3.10).
[2026/07/24 12:23:44.855] hint: While the active Python version is 3.10, the resolution failed for
[2026/07/24 12:23:44.855] other Python versions supported by your project. Consider limiting your
[2026/07/24 12:23:44.855] project's supported Python versions using requires-python.