[icanhasmath]

ActiveState release requests 2.27.1.post4 for Python 2.7 (inventory 2.27.1.4, Linear PROD-2111). No new CVEs or GHSAs affect 2.27.1: OSV and GitHub's database list only CVE-2023-32681, CVE-2024-35195, CVE-2024-47081 and CVE-2026-25645, all fixed in 2.27.1.1 and 2.27.1.2. This release carries one hardening fix and one compatibility fix.

• no_proxy domain boundaries (hardening, no CVE): should_bypass_proxies matched entries with a plain endswith, so no_proxy=example.com also sent badexample.com direct instead of through the proxy. Entries now match the exact host (or host:port) or a subdomain, and a leading dot is ignored. Backport of psf/requests a4f9a59 (Port bpo-39057 to Requests psf/requests#7427, 2.34.0), the port of CPython bpo-39057. Python 2.7's own urllib.proxy_bypass_environment already matches this way.
• urllib3 .postN versions: our urllib3 security builds are now 1.26.20.post3 / .post4. check_compatibility() split those into four parts and raised ValueError, so every import requests emitted a RequestsDependencyWarning, which is an ImportError under -W error. It now parses only major.minor.patch.
• Release commit: moves to the .postN scheme, where earlier releases used +security.N.

Tests (2.7.18): the full suite gives 407 passing against 388 on 2.27.1.3. The 165 errors are the same on both trees, because the httpbin fixture is missing. Of the new tests, 2 no_proxy cases and 3 compatibility cases fail on 2.27.1.3.

Tag 2.27.1.4 (the fork's existing tag style) and create the release (--latest=false) after merge.

[ezequielp-activestate]

Approving. No blockers.

🔴 Blockers: None.

Checked

• No missed advisories: OSV for requests==2.27.1 returns only CVE-2023-32681, CVE-2024-35195, CVE-2024-47081 and CVE-2026-25645, matching the description. All four are already in HISTORY from earlier releases.
• no_proxy fix: the should_bypass_proxies change is line-for-line upstream's a4f9a59 (psf#7427), and its test is the same as upstream's. Upstream has not changed this code since.
• check_compatibility: keeping only the first three parts of the urllib3 version is correct. A 4-part version like 1.26.20.post4 used to hit the major, minor, patch unpack and raise ValueError. chardet and charset_normalizer were already cut to 3 parts.
• Python 2.7.18 (python:2.7 container), running tests/test_utils.py plus tests/test_check_compatibility.py:
  • The PR gives 223 passed and 10 skipped.
  • On the base code, the new tests fail in exactly 5 places: the 2 no_proxy boundary cases (prelocalhost, badanotherdomain.com) and the 3 .postN cases.
  • With no_proxy=example.com, the base bypasses the proxy for badexample.com, while the PR sends it through the proxy. example.com, a.example.com, example.com:8080, a host:port entry and a leading-dot entry still bypass on the PR.
  • python -W error -c "import requests" succeeds on the PR.
• Python 3.7: the same two test files give 222 passed and 11 skipped, and import requests under -W error succeeds.

Not assessed

• The full suite with the httpbin fixture. The description notes those 165 errors are the same on both trees.
• An end-to-end request through a real proxy.