old - fix(deps): update dependency requests to v2.32.4 [security]

[oep-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
requests (source, changelog)	==2.32.3 -> ==2.32.4
requests (source, changelog)	2.32.3 -> 2.32.4
requests (source, changelog)	==2.31 -> ==2.32.4

GitHub Vulnerability Alerts

CVE-2024-47081

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2

---

Requests vulnerable to .netrc credentials leak via malicious URLs

CVE-2024-47081 / GHSA-9hjg-9r4m-mvj7

More information

Details

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

• https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
• https://nvd.nist.gov/vuln/detail/CVE-2024-47081
• https://github.com/psf/requests/pull/6965
• https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
• https://github.com/psf/requests
• https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env
• https://seclists.org/fulldisclosure/2025/Jun/2
• http://seclists.org/fulldisclosure/2025/Jun/2
• http://www.openwall.com/lists/oss-security/2025/06/03/11
• http://www.openwall.com/lists/oss-security/2025/06/03/9
• http://www.openwall.com/lists/oss-security/2025/06/04/1
• http://www.openwall.com/lists/oss-security/2025/06/04/6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Requests Session object does not verify requests after making first request with verify=False

CVE-2024-35195 / GHSA-9wx4-h78v-vm56

More information

Details

When making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same origin will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool.

Remediation

Any of these options can be used to remediate the current issue, we highly recommend upgrading as the preferred mitigation.

• Upgrade to requests>=2.32.0.
• For requests<2.32.0, avoid setting verify=False for the first request to a host while using a Requests Session.
• For requests<2.32.0, call close() on Session objects to clear existing connections if verify=False is used.

Related Links

• https://github.com/psf/requests/pull/6655

Severity

• CVSS Score: 5.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56
• https://nvd.nist.gov/vuln/detail/CVE-2024-35195
• https://github.com/psf/requests/pull/6655
• https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
• https://github.com/psf/requests
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

psf/requests (requests)

v2.32.4

Compare Source

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
  environment will retrieve credentials for the wrong hostname/machine from a
  netrc file.

Improvements

• Numerous documentation improvements

Deprecations

• Added support for pypy 3.11 for Linux and macOS.
• Dropped support for pypy 3.9 following its end of support.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[oep-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: interactive_ai/tests/e2e/uv.lock

Command failed: uv lock --upgrade-package requests
Using CPython 3.10.18 interpreter at: /opt/containerbase/tools/python/3.10.18/bin/python3
error: Distribution not found at: file:///tmp/renovate/repos/github/open-edge-platform/geti/interactive_ai/tests/e2e/rest_client

[oep-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[AlexanderBarabanov]

Was implemented in #875