New release of #urllib3, v1.26.16 backports a bugfix for PoolManager thread-safety when accessing a high number of distinct origins to not close responses before they complete: https://github.com/urllib3/urllib3/releases/tag/1.26.16
#urllib3 wersja 2.0* to prawdziwy horror. Ilekroć poprawię jakąś paczkę, żeby przestała blokować aktualizację w moim kontenerze testowym, kolejna się sypie.
Najgorsze w tym wszystkim jest to, że zazwyczaj nie zmiany API są problemem, ale to, że paczki polegają na detalach implementacji!
#urllib3 2.0* is a true horror story. Whenever I fix one package not to downgrade my whole testing container to the previous version, I discover another broken package.
The most horrendous part is that they usuall yaren't broken by deliberate API changes — they rely on implementation details!
Oh, just great!
It turns out that #urllib3 added a totally bonkers OpenSSL version check, and they broke a lot of systems as a result. Ofc the immediate result is dozens of packages pinning urllib3 < 2, and if they continue their negligence it's going to go into hundreds.
Ofc, it is a mess that distro maintainers will have to clean up eventually. I mean, removing the pins when they do not apply to us.
https://github.com/urllib3/urllib3/issues/2168#issuecomment-1535053569
https://github.com/urllib3/urllib3/pull/2705/files#diff-793e73e680de400394dedf7d080fbcef6e74c065ffcc10b8c3dc11217a786e0b
One thing that the #urllib3 team does that I wonder if other #opensource projects do is ensure someone is around to help in case of disasters. Very similar to on-call but ad-hoc and during fragile moments like releases of new default behaviors/major versions. Do any other projects do this?
New #urllib3 JSON APIs making a cameo in @pamelafox's presentation slides! 🤩 #Python
#urllib3 v2.0.1 has been released with two small fixes:
– Fixed socket leak after failed cert hostname or fingerprint verification (thanks @graingert !)
– Fixed an issue when .read(0) was called on an empty response buffer (thanks @quentinpradet !)
Over 1 million installs of a new major version in 24 hours (and single-digit number of integration issues 😏) #urllib3
https://pepy.tech/project/urllib3?versions=2.0.0
Next hurdle is being unpinned by Requests, then we'll *really* know if there are any big issues... 😬
Already over 250,000 installs of #urllib3 v2.0.0: https://pepy.tech/project/urllib3?versions=2.0.0
#urllib3 2.0.0 was released! FWICS most of the "breaking" changes are delayed until 2.1.0. However, I'm pretty sure I've seen some project importing vendored six from urllib3, and that's certainly going to break since it is gone ;-).
Ofc pinned <2 in random places is going to be a pain.
https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html
#urllib3 v2.0.0a4 has been released, this will be the last pre-release before v2.0.0 is released (hopefully tomorrow!)