[dependabot]

Bumps vcrpy from 8.3.0 to 9.4.2.

Release notes

Sourced from vcrpy's releases.

v9.4.2

What's Changed

• Fix urllib3 pools with block=True, e.g. a requests session with HTTPAdapter(pool_block=True), waiting forever for a free connection in a cassette, or when used before, after or across cassettes. A response now returns its connection to the pool once its body has been read, as in urllib3, and vcrpy keeps a pool's free slots when it takes connections out of it as a cassette starts or stops using the pool. A response finished after its cassette has exited gives back only the slot, not the cassette's connection (#949, #1094) - thanks @​nk-batman21

Full Changelog: kevin1024/vcrpy@v9.4.1...v9.4.2

v9.4.1

What's Changed

• Don't fail with ImportError: cannot import name 'HTTPHeaderDict' on urllib3 1.x, such as the 1.26 that Debian oldstable ships. The urllib3 stub imported HTTPHeaderDict from the top level of urllib3, which only exports it from 2.0 on, so use_cassette() raised while building its patchers and nothing could be recorded (#1092, #1093) - thanks @​inchang-ing

Full Changelog: kevin1024/vcrpy@v9.4.0...v9.4.1

v9.4.0

What's Changed

SOCKS proxies

Requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h://, with PySocks installed) are now recorded and played back. urllib3 uses its own connection classes for them, which vcrpy didn't patch, so these requests skipped the cassette entirely (#547, #548, #1087).

Multipart form filtering

filter_post_data_parameters now filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data={"api_key": ...}, files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded (#521, #1090).

If you match on body: requests are filtered before they're matched, so cassettes recorded with unfiltered multipart bodies need re-recording.

Fixes

• Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use (#979, #1051, #1088) - thanks @​yeion7, from #1052
• Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response() (#956, #1089)

Full Changelog: kevin1024/vcrpy@v9.3.2...v9.4.0

v9.3.2

What's Changed

• Don't open a real connection for HTTPS requests played back from a cassette in the new_episodes record mode. urllib3 connects before sending a request, before vcrpy knows whether it will be played back, so every such request made a TLS handshake, and failed without network access (#515, #1086)
• Raise a clear TypeError when use_cassette() without a path is used as a context manager, instead of KeyError: 'path'. A path can be left out only when decorating a function (#570)
• Fix filter_post_data_parameters crashing with AttributeError on iterator request bodies, e.g. a generator passed as data. Like file bodies, they're left unfiltered (#814)
• Docs: document inject_cassette, which passes the cassette to a decorated function, e.g. to rewind it or make assertions (#207, #493)

Full Changelog: kevin1024/vcrpy@v9.3.1...v9.3.2

v9.3.1

What's Changed

• Log a warning when a cassette file exists but can't be decoded, instead of silently treating it as empty, where recording could overwrite it (#501, #1022) - thanks @​agu2347, and @​philsong4-ai for #1023
• Request can be imported from vcr, e.g. vcr.Request("GET", uri, body, headers), as the docs already called it (#759) - thanks @​lewisdawson

... (truncated)

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

• Unreleased

  • CI: also test with urllib3 1.26, which vcrpy supports but CI didn't test, so #1092 wasn't caught

• 9.4.2

  • Fix urllib3 pools with block=True, e.g. a requests session with HTTPAdapter(pool_block=True), waiting forever for a free connection in a cassette, or when used before, after or across cassettes. A response now returns its connection to the pool once its body has been read, as in urllib3, and vcrpy keeps a pool's free slots when it takes connections out of it as a cassette starts or stops using the pool. A response finished after its cassette has exited gives back only the slot, not the cassette's connection (#949) - thanks @​nk-batman21

• 9.4.1

  • Don't fail with ImportError: cannot import name 'HTTPHeaderDict' on urllib3 1.x, such as the 1.26 that Debian oldstable ships. The urllib3 stub imported HTTPHeaderDict from the top level of urllib3, which only exports it from 2.0 on, so use_cassette() raised while building its patchers and nothing could be recorded (#1092) - thanks @​inchang-ing

• 9.4.0

  • Record and play back requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h:// proxies, with PySocks installed). urllib3 uses its own connection classes for them, which weren't patched, so these requests skipped the cassette (#547, #548)
  • Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use (#979, #1051) - thanks @​yeion7, from #1052
  • Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response(). urllib.request replaces the response's msg with the reason phrase, and requests then read it as headers to extract cookies from (#956)
  • filter_post_data_parameters filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data=..., files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded. Requests are filtered before they're matched, so if you match on body, re-record cassettes that have unfiltered multipart bodies (#521, #561)

• 9.3.2

  • Don't open a real connection for HTTPS requests that are played back from a cassette in the new_episodes record mode. urllib3 connects before sending a request, before vcrpy knows whether it will be played back, so every such request made a TLS handshake, and failed without network access (#515)
  • Raise a clear TypeError when use_cassette() without a path is used as a context manager, instead of KeyError: 'path'. A path can be left out only when decorating a function (#570)
  • Fix filter_post_data_parameters crashing with AttributeError on iterator request bodies, e.g. a generator passed as data. Like file bodies, they're left unfiltered (#814)
  • Docs: document inject_cassette, which passes the cassette to a decorated function (#207, #493)

• 9.3.1

  • Log a warning when a cassette file exists but can't be decoded, instead of silently treating it as empty (#501, #1022) - thanks @​agu2347, and @​philsong4-ai for #1023
  • Request can be imported from vcr, e.g. vcr.Request("GET", uri, body, headers), as the docs already called it (#759) - thanks @​lewisdawson

• 9.3.0

  • New Cassette.get_metadata(key, default): store values that aren't part of an interaction in the cassette, such as a seed for random values a test sends, so they're the same when the cassette is recorded and played back. Cassettes with metadata have a metadata key, and custom persisters' load_cassette can return it as a third value (#934) - thanks @​hasier
  • New skip_patchers option to leave some HTTP libraries unpatched, e.g. skip_patchers=["httpx"] when an httpx client uses an aiohttp transport (httpx-aiohttp), so requests aren't recorded twice (#944, #1070) - thanks @​smoltafet
  • New filter_nested_post_data_parameters option: make filter_post_data_parameters also filter keys in nested objects of JSON request bodies, such as JSON-RPC params. vcr.filters.replace_body_parameters and replace_post_data_parameters take a matching recursive argument (#936, #937) - thanks @​tighwm and @​JargeZ
  • ignore_hosts also accepts compiled regular expressions, which match whole host names, e.g. re.compile(r".*\.example\.com") (#779) - thanks @​silviumarcu
  • allow_playback_repeats now also applies while recording: a request that matches one already recorded in the cassette gets the recorded response, instead of being sent again and recorded a second time. When played back, such requests got the first response anyway (#878, #879) - thanks @​pyoor
  • Fix drop_unused_requests saving an interaction once per playback when allow_playback_repeats is set
  • Fix use_cassette crashing with TypeError: 'NoneType' object is not subscriptable (or JSONDecodeError with the JSON serializer) when the cassette file is empty, e.g. after emptying it to record it again. An empty cassette is now recorded like a missing one, as in Ruby VCR (#579) - thanks @​nk-batman21
  • Don't read aiohttp response bodies for requests that aren't recorded, e.g. with ignore_localhost or ignore_hosts, so they can be streamed as usual (#978) - thanks @​AronsonDan
  • Return leased urllib3 connections to their pool when release_conn() is called on a streamed response, during recording and playback (#949) - thanks @​edsonsims
  • Docs: note that before_record_response also runs when a cassette is loaded, so it should be idempotent (#1042, #1044) - thanks @​ciastek
  • Docs: replace Python 2's urllib2 with urllib.request in the examples - thanks @​TejasAmle
  • CI: run pre-commit's steps directly, with actions/cache@v6 on Node.js 24 (#1072) - thanks @​pylaterreur
  • CI: bump ruff to 0.17.2 (#1083), and allow Sphinx 9 for the docs (#1082)

• 9.2.0

  • New before_save_interaction and after_load_interaction options: hooks that get each interaction's request and response (and the cassette, if they take a third argument) when a cassette is saved and loaded, and can change them or leave the interaction out. Cassettes also get a public path. Like Ruby VCR's before_record and before_playback hooks (#527, #556) - thanks @​tzturner and co-authors for #679, and @​akaihola for #594, which explored this
  • New filter_sensitive_data option: replace secrets with placeholders everywhere in recorded interactions (URL, headers and bodies), and put the real values back when a cassette is loaded, built on the new hooks, so requests still match and your code sees the same responses whether they're recorded or played back. Inspired by Ruby VCR's option of the same name (#527, #544, #912)

• 9.1.0

... (truncated)

Commits

• 86e22b4 Release v9.4.2
• f86e65f Merge pull request #1094 from nk-batman21/fix/949-release-conn-after-read
• b784286 Merge remote-tracking branch 'origin/master' into HEAD
• b9061a6 Release v9.4.1
• 6224432 Merge pull request #1093 from inchang-ing/fix/urllib3-1x-httpheaderdict
• 169cd4b Fix blocking urllib3 pools hanging in and around cassettes
• 4eb08d2 Import HTTPHeaderDict from urllib3._collections on urllib3 1.x (#1092)
• 7aaaefe Release v9.4.0
• d3bb531 Merge pull request #1090 from kevin1024/filter-multipart
• 7eabb26 Merge pull request #1089 from kevin1024/fix-original-response
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)