Upgrade requests to 2.32.4 to fix .netrc credentials leak vulnerability

[Copilot]

The requests library prior to 2.32.4 has a URL parsing vulnerability that can leak .netrc credentials to third parties via maliciously-crafted URLs.

Changes

• Upgraded requests from 2.32.3 to 2.32.4 in requirements.txt and pyproject.toml

References

• Only use hostname to do netrc lookup instead of netloc psf/requests#6965
• https://seclists.org/fulldisclosure/2025/Jun/2

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Requests vulnerable to .netrc credentials leak via malicious URLs</issue_title>
<issue_description>> Upgrade requests to fix 1 Dependabot alert in requirements.txt

Upgrade requests to version 2.32.4 or later.

Package	Affected versions	Patched version
requests (pip)	< 2.32.4	2.32.4

Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds
For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References
psf/requests#6965
https://seclists.org/fulldisclosure/2025/Jun/2

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Requests vulnerable to .netrc credentials leak via malicious URLs #5

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[tmyymmt]

LGTM

[Copilot]

Pull request overview

This PR upgrades the requests library from version 2.32.3 to 2.32.4 to address a critical security vulnerability (CVE) where maliciously-crafted URLs could leak .netrc credentials to third parties due to a URL parsing issue.

Key Changes:

• Updated requests dependency from 2.32.3 to 2.32.4 in both dependency specification files

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
requirements.txt	Updated requests version to 2.32.4 to patch the .netrc credentials leak vulnerability
pyproject.toml	Updated requests version to 2.32.4 in the project dependencies to maintain consistency with requirements.txt

---

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.