[dependabot]

Bumps vcrpy from 8.3.0 to 9.2.0.

Release notes

Sourced from vcrpy's releases.

v9.2.0

What's Changed

Keep secrets out of cassettes with filter_sensitive_data

my_vcr = vcr.VCR(filter_sensitive_data={"<API_KEY>": os.environ.get("API_KEY", "fake-api-key")})

Every occurrence of the value in a recorded interaction, in the URL, headers and request and response bodies, is replaced with the placeholder when the cassette is saved, and put back when it's loaded. So:

• the cassette file only contains <API_KEY>,
• requests made with the real value still match the recorded ones, and
• your code gets the same responses whether they're recorded or played back, including parts of responses that contained the secret.

Values can also be functions of the interaction. See the docs for using it in CI without the real secret, and for values that are encoded differently in different places. Modeled on Ruby VCR's option of the same name.

Save and load hooks

before_save_interaction and after_load_interaction get each interaction's request and response, plus the cassette if they take a third argument, when a cassette is saved and loaded. They return them, changed or not, or None to leave the interaction out. Unlike before_record_request and before_record_response, they run exactly once per interaction. Some uses, from issues:

• change a response based on its request, e.g. scrub a token only from a login response (#527, #556)
• keep cookies out of cassettes (#569)
• replay part of a cassette and record the rest again (#892)
• keep using old cassettes after an API or URL format changes

See the docs for examples. They're modeled on Ruby VCR's before_record and before_playback hooks, and filter_sensitive_data is built on them. Thanks to the authors of #679 and #594, which explored this.

Cassettes also have a new read-only path property.

Full Changelog: kevin1024/vcrpy@v9.1.0...v9.2.0

v9.1.0

What's Changed

Fixes

• Replayed aiohttp responses now have raw_headers, so code that reads them (e.g. httpx-aiohttp) works on replay (#970, #1034). Thanks @​HostX0
• Replayed urllib3 responses have release_conn(), for code that releases pooled responses (#816, #1054). Thanks @​cristianchiriac
• pathlib.Path and other path-like objects work for cassette paths and cassette_library_dir (#567, #920, #1064). Thanks @​fredrikblau
• filter_post_data_parameters matches urlencoded parameter names, so e.g. api:key also filters api%3Akey (#686, #1066). Thanks @​b84330808
• The body matcher no longer crashes on form-urlencoded and XML-RPC requests without a body (#913, #1032). Thanks @​M001N
• The response stream is closed when reading an httpx response fails while recording (#1068). Thanks @​Claire-ovo
• ignore_localhost also ignores ::1 (#639). Thanks @​dragonpaw for the report

New

• Replayed urllib3 responses have json(), as urllib3 2.x responses do (#774). Thanks @​gschnellOnera for the report
• use_cassette accepts a persister option, to use a custom persister for one cassette (#575). Thanks @​gioele for the report

Releases

• vcrpy is now published to PyPI from GitHub Actions with trusted publishing (#860, #1078)

... (truncated)

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

• 9.4.0

  • Record and play back requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h:// proxies, with PySocks installed). urllib3 uses its own connection classes for them, which weren't patched, so these requests skipped the cassette (#547, #548)
  • Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use (#979, #1051) - thanks @​yeion7, from #1052
  • Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response(). urllib.request replaces the response's msg with the reason phrase, and requests then read it as headers to extract cookies from (#956)
  • filter_post_data_parameters filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data=..., files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded. Requests are filtered before they're matched, so if you match on body, re-record cassettes that have unfiltered multipart bodies (#521, #561)

• 9.3.2

  • Don't open a real connection for HTTPS requests that are played back from a cassette in the new_episodes record mode. urllib3 connects before sending a request, before vcrpy knows whether it will be played back, so every such request made a TLS handshake, and failed without network access (#515)
  • Raise a clear TypeError when use_cassette() without a path is used as a context manager, instead of KeyError: 'path'. A path can be left out only when decorating a function (#570)
  • Fix filter_post_data_parameters crashing with AttributeError on iterator request bodies, e.g. a generator passed as data. Like file bodies, they're left unfiltered (#814)
  • Docs: document inject_cassette, which passes the cassette to a decorated function (#207, #493)

• 9.3.1

  • Log a warning when a cassette file exists but can't be decoded, instead of silently treating it as empty (#501, #1022) - thanks @​agu2347, and @​philsong4-ai for #1023
  • Request can be imported from vcr, e.g. vcr.Request("GET", uri, body, headers), as the docs already called it (#759) - thanks @​lewisdawson

• 9.3.0

  • New Cassette.get_metadata(key, default): store values that aren't part of an interaction in the cassette, such as a seed for random values a test sends, so they're the same when the cassette is recorded and played back. Cassettes with metadata have a metadata key, and custom persisters' load_cassette can return it as a third value (#934) - thanks @​hasier
  • New skip_patchers option to leave some HTTP libraries unpatched, e.g. skip_patchers=["httpx"] when an httpx client uses an aiohttp transport (httpx-aiohttp), so requests aren't recorded twice (#944, #1070) - thanks @​smoltafet
  • New filter_nested_post_data_parameters option: make filter_post_data_parameters also filter keys in nested objects of JSON request bodies, such as JSON-RPC params. vcr.filters.replace_body_parameters and replace_post_data_parameters take a matching recursive argument (#936, #937) - thanks @​tighwm and @​JargeZ
  • ignore_hosts also accepts compiled regular expressions, which match whole host names, e.g. re.compile(r".*\.example\.com") (#779) - thanks @​silviumarcu
  • allow_playback_repeats now also applies while recording: a request that matches one already recorded in the cassette gets the recorded response, instead of being sent again and recorded a second time. When played back, such requests got the first response anyway (#878, #879) - thanks @​pyoor
  • Fix drop_unused_requests saving an interaction once per playback when allow_playback_repeats is set
  • Fix use_cassette crashing with TypeError: 'NoneType' object is not subscriptable (or JSONDecodeError with the JSON serializer) when the cassette file is empty, e.g. after emptying it to record it again. An empty cassette is now recorded like a missing one, as in Ruby VCR (#579) - thanks @​nk-batman21
  • Don't read aiohttp response bodies for requests that aren't recorded, e.g. with ignore_localhost or ignore_hosts, so they can be streamed as usual (#978) - thanks @​AronsonDan
  • Return leased urllib3 connections to their pool when release_conn() is called on a streamed response, during recording and playback (#949) - thanks @​edsonsims
  • Docs: note that before_record_response also runs when a cassette is loaded, so it should be idempotent (#1042, #1044) - thanks @​ciastek
  • Docs: replace Python 2's urllib2 with urllib.request in the examples - thanks @​TejasAmle
  • CI: run pre-commit's steps directly, with actions/cache@v6 on Node.js 24 (#1072) - thanks @​pylaterreur
  • CI: bump ruff to 0.17.2 (#1083), and allow Sphinx 9 for the docs (#1082)

• 9.2.0

  • New before_save_interaction and after_load_interaction options: hooks that get each interaction's request and response (and the cassette, if they take a third argument) when a cassette is saved and loaded, and can change them or leave the interaction out. Cassettes also get a public path. Like Ruby VCR's before_record and before_playback hooks (#527, #556) - thanks @​tzturner and co-authors for #679, and @​akaihola for #594, which explored this
  • New filter_sensitive_data option: replace secrets with placeholders everywhere in recorded interactions (URL, headers and bodies), and put the real values back when a cassette is loaded, built on the new hooks, so requests still match and your code sees the same responses whether they're recorded or played back. Inspired by Ruby VCR's option of the same name (#527, #544, #912)

• 9.1.0

  • Set raw_headers on replayed aiohttp responses, so code that reads them (e.g. httpx-aiohttp) works on replay (#970, #1034) - thanks @​HostX0
  • Add release_conn() to replayed urllib3 responses, for code that releases pooled responses (#816, #1054) - thanks @​cristianchiriac
  • Accept pathlib.Path and other path-like objects for cassette paths and cassette_library_dir (#567, #920, #1064) - thanks @​fredrikblau
  • Make filter_post_data_parameters match urlencoded parameter names, so e.g. api:key also filters api%3Akey (#686, #1066) - thanks @​b84330808
  • Fix the body matcher crashing on form-urlencoded and XML-RPC requests without a body (#913, #1032) - thanks @​M001N
  • Close the response stream when reading an httpx response fails while recording (#1068) - thanks @​Claire-ovo
  • ignore_localhost also ignores ::1 (#639) - thanks @​dragonpaw for the report
  • Add json() to replayed urllib3 responses, as urllib3 2.x responses have (#774) - thanks @​gschnellOnera for the report
  • Allow a persister option on use_cassette, to use a custom persister for one cassette (#575) - thanks @​gioele for the report

... (truncated)

Commits

• 37b2d42 Release v9.2.0
• 15fa53a Merge pull request #1080 from kevin1024/filter-sensitive-data
• fea7239 Document when to use the save and load hooks
• 3121164 Align interaction hooks with the existing record hooks
• c25b4b9 Pass the cassette to interaction hooks that take a third argument
• 0f06870 Add before_save_interaction and after_load_interaction hooks
• 4fe3425 Accept non-string values in filter_sensitive_data
• 8ca28c9 Add a filter_sensitive_data option
• e1fb275 Merge pull request #1079 from kevin1024/remove-setup-cfg
• c3ceccd Remove setup.cfg
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)