Requests 2.33.0 drops Python 3.9 and adds inline types — verify agent compatibility

[mitchh456]

Background

Requests 2.33.0 was released on March 25, 2026 with several notable changes:

1. Dropped Python 3.9 support (#7196) — following Python 3.9's end of life.
2. CVE-2026-25645 — requests.utils.extract_zipped_paths now extracts to a non-deterministic location to prevent malicious file replacement. Only affects direct callers of this utility function, not default requests usage.
3. Inline types — Requests is adding inline type annotations (#7271), a major modernization effort.
4. PEP 517 build system — Migrated to setuptools with PEP 517.
5. Netrc bugfix — Fixed empty netrc entry causing malformed auth on Python 3.11+.

Impact

• Python 3.9 drop: If Scout's Python agent still supports Python 3.9, users on that version who upgrade requests to 2.33.0 will hit import errors. Scout's minimum Python version should be reviewed for alignment.
• Inline types: If Scout patches or wraps requests functions (e.g., for HTTP client instrumentation), the addition of type annotations could affect monkey-patching if Scout inspects function signatures.
• CVE-2026-25645: Low direct impact on Scout, but worth awareness for security-conscious users.

Suggested Action

1. Verify Scout's minimum supported Python version. If Scout still supports Python 3.9, document the incompatibility with requests >= 2.33.0 or consider aligning version requirements.
2. If Scout instruments requests (e.g., wrapping Session.send or Session.request), test against 2.33.0 to ensure inline types don't interfere with monkey-patching.
3. Update dependency constraints if needed.

References

• Requests 2.33.0 release
• Full changelog
• Inline types tracking issue (#7271)