2.7.911 (2024-05-24)

• Fixed the ability to override properly the :authority special header via the legacy Host header.

2.7.910 (2024-05-22)

• Removed workaround for a bug that existed in qh3 < 1.0 with cryptography in a concurrent (thread) environment.
• Avoid loading qh3 at runtime in order to improve import delay. It was used to probe HTTP/3 support. We compute it lazily from now on.
• Added the possibility to use the preemptive_quic_cache MutableMapping to exclude endpoints. If your implementation discard the recently set key/entry it will prevent the connection from upgrading itself.

2.7.909 (2024-05-17)

• Improve (large) data download performance by increasing the default blocksize.
• Improve HTTP/1.1 performance by reducing the amount of time we want to infer "if next cycle" should be triggered.

2.7.908 (2024-05-16)

• Improve traffic_state_of function to improve the overall performance in a highly concurrent context.

2.7.907 (2024-05-06)

• Passing a ssl context containing manually loaded root certificates no longer is ignored with HTTP/3 over QUIC.

2.7.906 (2024-05-02)

• Overall performance improvement with HTTP/2 in a highly concurrent context.

2.7.905 (2024-04-28)

• Added support for jh2>=5,<6 instead of h2~=4.0 as a drop-in replacement. Expect a significant performance improvement with HTTP/2. We successfully reduced our dependency footprint to the minimum.

2.7.904 (2024-04-20)

• Added support for qh3 version v1
• Security: Fixed ignored DNS matching with its certificate in certain conditions while negotiating HTTP/3 over QUIC

2.7.903 (2024-04-04)

• Removed warning about "unresponsive" pool of connection due to how it can confuse users.

2.7.902 (2024-04-03)

• Fixed a rare racing condition occurring on PyPy when using DNS-over-HTTPS leading to a socket.gaierror exception.
• Fixed retrieving the dict peer certificate when cert_reqs=0 aka. disabled TLS over TCP verification.

2.7.901 (2024-03-27)

• Fixed an edge case with Response::read() confusing situation where passing a positive amount to read then passing None n-times would continuously return cached data if the stream was closed (content consumed).
• Fixed IncompleteRead exception property expected that did not contain the "remaining" amount expected but rather the total expected.

2.7.900 (2024-03-25)

• Added Happy-Eyeballs support. This feature is disabled by default, you can enable it by passing happy_eyeballs=True into AsyncPoolManager, AsyncHTTPConnectionPool or its synchronous counterparts. See the documentation to learn more.
• Fixed an issue where passing a IPv6 address to the in-memory resolver provider would be improperly registered.
• Fixed unclosed socket when the user attempt to set a impossible port to bind on (i.e. not in range 0-65535) leading to a ResourceWarning.
• Fixed a rare issue with DNS-over-HTTPS where a HTTPS record would also be interpreted as a normal record.

2.6.906 (2024-03-18)

• Fixed SSL context cache construction that did not take key_password into account.
• Prefer return NotImplemented instead of raising NotImplementedError to avoid polluting the stack trace when trying to initialize the external tls layer when not concerned (e.g. not http3 over QUIC).

2.6.905 (2024-03-17)

• Fixed traffic police shutdown procedure to avoid killing needlessly a new connection or pool.

2.6.904 (2024-03-17)

• Overall performance improvements for both async and sync calls.
• Removed TrafficPolice internal caching for obj states of contained elements due to its inability to be up-to-date in some cases.
• Fixed SSLError wrong message displayed when using the underlying qh3 library (HTTP/3 only).
• Fixed graceful shutdown for rare HTTP/2 servers configured to immediately forbid opening new streams.

2.6.903 (2024-03-10)

• Overall performance improvements for both async and sync calls.

2.6.902 (2024-03-04)

• Fixed PyPy error when running asynchronous code on Windows after trying to create a datagram socket. This error is due to an incomplete implementation of the Windows socket API. We silently disabled HTTP/3 if running PyPy+Windows+asyncio until upstream issue resolution.
• Overall performance improvements for both async and sync calls.
• Fixed ProtocolError (No recent network activity after XYZ) error when it should recycle the connection automatically (sync only).
• Added a user-friendly error message when invoking get_response from either PoolManager or ConnectionPool with anything else than a ResponsePromise.

2.6.901 (2024-02-28)

• Fixed blocking IO just after HTTP/3 is negotiated in an asynchronous context.
• Added explicit warning in case your pool of connections is insufficiently sized for the given charge in an asynchronous context.
• Fixed automatic retrieval of the issuer certificate in an asynchronous context (ConnectionInfo).

2.6.900 (2024-02-26)

• Added full asynchronous support using asyncio. urllib3.future officially support asyncio as his asynchronous scheduler. The following public classes are immediately available:

  AsyncPoolManager, AsyncHTTPConnectionPool, AsyncHTTPSConnectionPool, AsyncProxyManager, AsyncResolverDescription.

  Finally, bellow functions are also available:

  async_proxy_from_url, and async_connection_from_url.

  Explore the documentation section about async to learn more about this awesome feature with detailed examples. No extra dependencies are required. We rely exclusively on the standard library.

  Async SOCKS proxies are also supported at no additional costs with contrib.socks.AsyncSOCKSProxyManager.

2.5.904 (2024-02-21)

• Improved reliability with PoliceTraffic.borrow with type as indicator when heavily accessed by many threads.

2.5.903 (2024-02-20)

• Fixed an edge case where a simultaneous call to get_response() without a specific promise could lead to a non-thread safe operation.

2.5.902 (2024-02-04)

• Fixed missed clean-up of unused PoolKey stored in PoliceTraffic upon a full PoolManager.

2.5.901 (2024-02-02)

• Fixed a compatibility issue with boto3 when trying to send data (got an unexpected keyword argument). #79

2.5.900 (2024-02-02)

• Improved performance and reliability for concurrent streams handled by a single connection. We relied on a flat array of events generated by the protocol state-machine that unfortunately was not efficient. urllib3-future now handle the events with a matrix/multi-dimensional array bound to time.
• Fixed a thread safety issue when a single multiplexed connection was used across many threads. We revised in-depth the logic wrapper around the connection locking to make sure you may go all-in when using threads in that particular context. In consequence to that:
  1. We are, effective immediately, deprecating RecentlyUsedContainer in favor of our internal PoliceTraffic that was used in PoolManager.
  2. No longer using Queue to manage the Connection in HTTPConnectionPool. If you try to set HTTPConnectionPool.QueueCls it will raise a deprecation warning. Starting today, we no longer accept implementation like queue.Queue because it cannot fit the need of this complex HTTP client, especially with the multiplexing aspect.
• Increased default pool maxsize for DNS-over-HTTPS from 1 to 10.

2.4.906 (2024-01-19)

• Fixed a rare case of HTTP/3 being disabled when forwarding a custom SSLContext created.
• Re-introduce DEFAULT_CIPHERS constant in urllib3.util.ssl_ due to the demands. It contains the Mozilla recommended cipher suite that was introduced in version 2.2.900.
• Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. Ported from urllib3/3271.
• Fixed request_sent_latency that wasn't computed when request was stopped early (prior to sending the complete body).

2.4.905 (2024-01-16)

• Fixed an edge case where a HTTPS record was misinterpreted when using a DNS-over-HTTPS resolver.

2.4.904 (2024-01-15)

• Fixed an issue where a idle QUIC connection would not be recycled properly when expired.
• Added support for passing -1 as the amt in HTTPResponse (read, or stream) as the strict equivalent of read1. This allows you to fetch content as soon as it arrive.
• Removed orphaned method _handle_chunk, _update_chunk_length from HTTPResponse.
• Fixed the iterator in HTTPResponse that hung until the complete content was downloaded.

2.4.903 (2024-01-07)

• Fixed an issue where setting None for a header value could cause an exception.

2.4.902 (2024-01-01)

• Fixed compatibility with older PyPy 3.7 interpreters when HTTP/3 (qh3) can be unavailable.
• Fixed undesired DGRAM/QUIC preemptive upgrade using insecure protocol.

2.4.901 (2023-12-31)

• Fixed an issue where a stateless resolver (e.g. null resolver, in-memory resolver, ...) could not be recycled.
• Fixed an issue where one would attempt to close a resolver multiple times.

2.4.900 (2023-12-30)

• Added issuer certificate extraction from SSLSocket with native calls with Python 3.10+ in ConnectionInfo.

• Added support for DNS over TLS, DNS over HTTPS, DNS over QUIC, DNS over UDP, and local hosts-like DNS. PoolManager, and HTTPPoolManager constructor now expose an additional keyword argument, resolver=.... You can assign to it one of the presented protocols. Also, you may chain a list of resolvers, each can be limited to a list of host-pattern or not. The default is the system DNS. Our thread-safety promise covers this new feature.

  You can now do the following: PoolManage(resolver="doh://dns.google") for example. Please take a look at the official documentation to learn about the full capabilities.

• Support for SOCKS proxies is now provided by python-socks instead of PySocks due to being largely unmaintained within a reasonable period. This change is made completely transparent.

• Added details in ConnectionInfo about detailed timings and other details. established_latency is a timedelta that represents the amount of time consumed to get an ESTABLISHED network link. resolution_latency is a timedelta that represents the amount of time consumed for the hostname resolution.
  tls_handshake_latency is a timedelta that represents the amount of time consumed for the TLS handshake. request_sent_latency is a timedelta that represents the amount of time consumed to encode and send the whole request through the socket.

• Fixed a rare thread safety issue when using at least one HTTP/3 multiplexed connection.

• Deprecated function util.connection.create_connection(..) in favor of newly added contrib.resolver that will host from now on that function within BaseResolver as a method. Users are encouraged to migrate as soon as possible.

• Support for preemptively negotiating HTTP/3 over QUIC based on RFC 9460 via an HTTPS DNS record.

• Added support for enforcing IPv6, and/or IPv4 using the keyword parameter socket_family that can be provided in PoolManager, HTTP(S)ConnectionPool and HTTP(S)Connection. The three accepted values are socket.AF_UNSPEC socket.AF_INET, and socket.AF_INET6. Respectively, allow all, ipv4 only, and ipv6 only. Anything else will raise ValueError.

2.3.902 (2023-12-08)

• Fixed an issue where specifying cert_reqs=ssl.CERT_NONE or assert_hostname was ignored when using HTTP/3 over QUIC.

2.3.901 (2023-11-26)

• Small performance improvement while in HTTP/1.1
• Any string passed down to the body will enforce a default Content-Type: text/plain; charset=utf-8 for safety, unless you specify a Content-Type header yourself. The charset parameter will always be set to utf-8. It is recommended that you pass bytes instead of a plain string. If a conflicting charset has been set that does not refer to utf-8, a warning will be raised.
• Added callable argument in urlopen, and request named on_upload_body that enables you to track body upload progress for a single request. It takes 4 positional arguments, namely: (total_sent: int, total_to_be_sent: int | None, is_completed: bool, any_error: bool) total_to_be_sent may be set to None if we're unable to know in advance the total size (blind iterator/generator).
• Fixed a rare case where ProtocolError was raised instead of expected IncompleteRead exception.
• Improved HTTP/3 overall performance.
• Changed the default max connection per host for (http, https) pools managed by PoolManager. If the PoolManager is instantiated with num_pools=10, each (managed) subsequent pool will have maxsize=10.
• Improved performance in a multithreading context while using many multiplexed connections.
• Changed the default max saturated multiplexed connections to 64 as the minimum. Now a warning will be fired if you reach the maximum capacity of stored saturated multiplexed connections.

2.3.900 (2023-11-18)

• Disabled unsafe renegotiation option with TLS by default where applicable.
• Added fallback package urllib3_future in addition to urllib3. This became increasingly needed as a significant number of projects require urllib3 and accidentally override this fork.

2.2.907 (2023-11-11)

• Reverted relying on qh3 to dynamically retrieve the max concurrent streams allowed before connection saturation.

2.2.906 (2023-11-11)

• Bumped minimum requirement for qh3 to version 0.14.0 in order to drop private calls in contrib.hface.protocols._qh3.
• Cache the last 1024 parse_url function calls as it is costly.
• Fixed incomplete flow control window checks while sending data in HTTP/2.
• Fixed unexpected BrokenPipeError exception in a rare edge case.
• Changed behavior for efficiency around socket.recv to pull conn.blocksize bytes regardless of Response.read(amt=...).

2.2.905 (2023-11-08)

• Fixed loss of a QUIC connection due to an inappropriate check in conn.is_connected.
• Separate saturated (multiplexed) connections from the main pool to a distinct one.

2.2.904 (2023-11-06)

• Fixed concurrent/multiplexed request overflow in a full connection pool.
• Fixed connection close that had in-flight request (in multiplexed mode), the connection appeared as not idle on clean reuse.

2.2.903 (2023-11-06)

• Improved overall performances in HTTP/2, and HTTP/3, with or without multiplexed.

2.2.902 (2023-11-05)

• Fixed QUIC connection not taking cert_data due to an accidental variable override.

2.2.901 (2023-11-04)

• Fixed several issues with multiplexing. (i) Fixed max concurrent streams in HTTP/2, and HTTP/3. (ii) Fixed tracking of unconsumed response prior to try to upgrade the connection (to HTTP/3). (iii) Fixed (always) releasing multiplexed connections into the pool. (iv) Fixed request having body interrupted by the EarlyResponse exception 'signal'.

2.2.900 (2023-11-01)

• Added support for in-memory client (intermediary) certificate to be used with mTLS. This feature compensates for the complete removal of pyOpenSSL. Unfortunately, it is only available on Linux, OpenBSD, and FreeBSD. Using newly added cert_data and key_data arguments in HTTPSConnection and HTTPSPoolConnection you will be capable of passing the certificate along with its key without getting nowhere near your filesystem. MacOS and Windows are not concerned by this feature when using HTTP/1.1, and HTTP/2 with TLS over TCP.

• Removed remnant SSLTransport.makefile as it was built to circumvent a legacy constraint when urllib3 depended upon http.client.

• Bumped minimum requirement for qh3 to version 0.13.0 in order to support in-memory client certificate (mTLS).

• Symbolic complete detachment from http.client. Removed all references and imports to http.client. Farewell!

• Changed the default ciphers in default SSLContext for an increased security level. Rational: Earlier in v2.1.901 we initialized the SSLContext ciphers with the value DEFAULT but after much consideration, after we saw that the associated ciphers (e.g. DEFAULT from OpenSSL) includes some weak suites we decided to inject a rather safer and limited cipher suite. It is based on https://ssl-config.mozilla.org Starting now, urllib3.future will match Mozilla cipher recommendations (intermediary) and will regularly update the suite.

• Added support for multiplexed connection. HTTP/2 and HTTP/3 can benefit from this. urllib3.future no longer blocks when urlopen(...) is invoked using multiplexed=True, and return a ResponsePromise instead of a HTTPResponse. You may dispatch as many requests as the protocol permits you (concurrent stream) and then retrieve the response(s) using the get_response(...). get_response(...) can take up to one kwarg to specify the target promise, if none is specified, will retrieve the first available response. multiplexed is set to False by default and will likely be the default for a long time. Here is an example:

  from urllib3 import PoolManager
  
  with PoolManager() as pm:
      promise0 = pm.urlopen("GET", "https://pie.dev/delay/3", multiplexed=True)
      # <ResponsePromise 'IOYTFooi0bCuaQ9mwl4HaA==' HTTP/2.0 Stream[1]>
      promise1 = pm.urlopen("GET", "https://pie.dev/delay/1", multiplexed=True)
      # <ResponsePromise 'U9xT9dPVGnozL4wzDbaA3w==' HTTP/2.0 Stream[3]>
      response0 = pm.get_response()
      # the second request arrived first
      response0.json()["url"]  # https://pie.dev/delay/1
      # the first arrived last
      response1 = pm.get_response()
      response1.json()["url"]  # https://pie.dev/delay/3
  

  or you may do:

  from urllib3 import PoolManager
  
  with PoolManager() as pm:
      promise0 = pm.urlopen("GET", "https://pie.dev/delay/3", multiplexed=True)
      # <ResponsePromise 'IOYTFooi0bCuaQ9mwl4HaA==' HTTP/2.0 Stream[1]>
      promise1 = pm.urlopen("GET", "https://pie.dev/delay/1", multiplexed=True)
      # <ResponsePromise 'U9xT9dPVGnozL4wzDbaA3w==' HTTP/2.0 Stream[3]>
      response0 = pm.get_response(promise=promise0)
      # forcing retrieving promise0
      response0.json()["url"]  # https://pie.dev/delay/3
      # then pick first available
      response1 = pm.get_response()
      response1.json()["url"]  # https://pie.dev/delay/1
  

  You may do multiplexing using PoolManager, and HTTPSPoolConnection. Connection upgrade to HTTP/3 cannot be done until all in-flight requests are completed. Be aware that a non-capable connection (e.g. HTTP/1.1) will just ignore the multiplexed=True setting and act traditionally.

• Connections are now released into their respective pool when the connection supports multiplexing (HTTP/2, HTTP/3) before the response has been consumed. This allows to have multiple responses half-consumed from a single connection.

2.1.903 (2023-10-23)

• Removed BaseHTTPConnection, and BaseHTTPSConnection. Rationale: The initial idea, as far as I understand it, was to create a HTTPSConnection per protocols, e.g. HTTP/2, and HTTP/3. From the point of view of urllib3.future it was taken care of in contrib.hface where the protocols state-machines are handled. We plan to always have a unified Connection class that regroup all protocols for convenience. The private module urllib3._base_connection is renamed to urllib3._typing. It brings a lot of simplification, which is welcomed.
• Reduced BaseHTTPResponse to a mere alias of HTTPResponse for the same reasoning as before. There is absolutely no need whatsoever in the foreseeable future to ship urllib3.future with an alternative implementation of HTTPResponse. It will be removed in a future major.
• Removed RECENT_DATE and linked logic as it does not make sense to (i) maintain it (ii) the certificate verification failure won't be avoided anyway, so it is a warning prior to an unavoidable error. The warning class SystemTimeWarning will be removed in a future major.
• Added support for stopping sending body if the server responded early in HTTP/2, or HTTP/3. This can happen when a server says that you exhausted the size limit or if previously sent headers were rejected for example. This should save a lot of time for users in given cases.
• Refactored scattered typing aliases across the sources. urllib3._typing now contain all of our definitions.
• Avoid installation of qh3 in PyPy 3.11+ while pre-built wheels are unavailable.

2.1.902 (2023-10-21)

• Fixed an issue where streaming response did not yield data until the stream was closed.
• Unified peercert/issuercert dict output in ConnectionInfo output format when HTTP/3.
• Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. Headers content-encoding, content-language, content-location, content-type, content-length, digest, last-modified are also stripped in the said case. Port of the security fix GHSA-g4mx-q9vg-27p4
• _TYPE_BODY now accept Iterable[str] in addition to Iterable[bytes].

2.1.901 (2023-10-10)

• Set DEFAULT (as OpenSSL default list) for ciphers in SSLContext if none is provided instead of Python default.
• Fixed an edge case where the chosen state machine would be indicated not to end stream where it should.
• Fixed a rare case where ProtocolError was raised instead of SSLError in the underlying QUIC layer state machine.
• Small performance improvement in sending a body by removing an obsolete logic made for a removed constraint.
• Changed default User-Agent to urllib3.future/x.y.z.
• Removed a compatibility operation that added a Content-Length header on request with an unknown body length. This was present due to a bug in Traefik server. An investigation will be conducted and a relevant issue will be addressed.

2.1.900 (2023-10-07)

• Added cipher in ConnectionInfo when using HTTP/3 over QUIC.

• Added issuer_certificate_der, issuer_certificate_dict into ConnectionInfo.

  By default, it is set to None. This property is filled automatically on a QUIC connection. It cannot be done automatically when using native Python capabilities.

• Removed support for SecureTransport.

• Removed support for PyOpenSSL.

  This module is not deleted but rendered ineffective. An explicit warning still appears.

• Improved automated exchange between the socket and the HTTP state machines.

• Removed all dependencies in the secure extra.

• Fixed disabling HTTP/3 over QUIC if specified settings were incompatible with TLS over QUIC.

  Previously if ssl_context was set and specifying a list of ciphers it was discarded on upgrade. Also, if ssl_maximum_version was set to TLS v1.2. Now those parameters are correctly forwarded to the custom QUIC/TLS layer.

• Fixed ConnectionInfo repr that did not shown the http_version property.

• Undeprecated 'ssl_version' option in create_urllib3_context.

• Undeprecated 'format_header_param_rfc2231'.

• Removed warning about the 'strict' parameter.

• Removed constant IS_PYOPENSSL and IS_SECURETRANSPORT from urllib3.utils.

• Added raise warning when using environment variables SSLKEYLOGFILE, and QUICLOGDIR.

• Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

• Removed warning about ssl not being the OpenSSL backend. You are free to choose.

  Users are encouraged to report issues if any to the jawah/urllib3.future repository. Support will be provided to the best of our abilities.

2.0.936 (2023-10-01)

• Added support for event StreamReset to raise a ProtocolError when received from either h2 or h3. (#28 <https://github.com/jawah/urllib3.future/issues/28>__)

• Fixed a violation in our QUIC transmission due to sending multiple datagrams at once. (#26 <https://github.com/jawah/urllib3.future/issues/26>__)

2.0.934 (2023-09-23)

• Added public ConnectionInfo class that will be present in each HttpConnection instance.

  Passing the kwarg on_post_connection that accept a callable with a single positional argument in PoolManager.urlopen method will result in a call each time a connection is picked out of the pool. The function will be passed a ConnectionInfo object. The same argument (on_post_connection) can be passed down to the HTTPConnectionPool.urlopen method. (#23 <https://github.com/jawah/urllib3.future/issues/23>__)

• #22 <https://github.com/jawah/urllib3.future/issues/22>__

2.0.933 (2023-09-21)

Bugfixes

• Fixed HTTPSConnectionPool not accepting and forwarding ca_cert_data. (#20 <https://github.com/jawah/urllib3.future/issues/20>__)

2.0.932 (2023-09-12)

Bugfixes

• Fixed assert_hostname behavior when HTTPSConnection targets HTTP/3 over QUIC (#8 <https://github.com/jawah/urllib3.future/issues/8>__)
• Fixed protocol violation for HTTP/2 and HTTP/3 where we sent Connection: keep-alive when it is forbidden. (#16 <https://github.com/jawah/urllib3.future/issues/16>__)
• Fixed unpack_chunk workaround function in the send method when body is multipart/form-data (#17 <https://github.com/jawah/urllib3.future/issues/17>__)
• Fixed the flow control when sending a body for a HTTP/2 connection. The body will be split into numerous chunks if the size exceed the specified blocksize when not using HTTP/1.1 in order to avoid ProtocolError (flow control) (#18 <https://github.com/jawah/urllib3.future/issues/18>__)

2.0.931 (2023-07-16)

Features

• Added support for HTTP/1.1, HTTP/2 and HTTP/3 independently of httplib.

  Currently urllib3 does not offer async http request and the backend is the http.client package shipped alongside Python. This implementation is not scheduled to improve, even less to support the latest protocols.

  Without proxies, the negotiation is as follows:

  • http requests are always made using HTTP/1.1.

  • https requests are made with HTTP/2 if TLS-ALPN yield its support otherwise HTTP/1.1.

  • https requests may upgrade to HTTP/3 if the latest response contains a valid Alt-Svc header.

  With proxies:

  • The initial proxy request is always issued using HTTP/1.1 regardless if its http or https.
  • Subsequent requests follow the previous section (Without proxies) except that HTTP/3 upgrade is disabled.

  You may explicitly disable HTTP/2 or, and, HTTP/3 by passing disabled_svn={HttpVersion.h2} to your BaseHttpConnection instance. Disabling HTTP/1.1 is forbidden and raises an error.

  Note that a valid or accepted Alt-Svc header in urllib3 means looking for the "h3" (final specification) protocol and disallow switching hostname for security reasons. (#1 <https://github.com/jawah/urllib3.future/issues/1>__)

• Added BaseHTTPResponse to __all__ in __init__.py (#3078 <https://github.com/urllib3/urllib3/issues/3078>__)