2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at RFC: Adding inline type annotations to Requests #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (Migrate build system to PEP 517 #7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (Fix empty netrc entry usage #7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (Drop support for Python 3.9 #7196)

Documentation

• Various typo fixes and doc improvements.