{"slug": "requests", "name": "Requests", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 12, "warners": 4, "score": 0.201, "rising": -0.98, "first": "2025-12-10", "latest": "2026-08-29", "why": "I used to write Python scripts with Requests or run from terminal. It has a nicer syntax, all LLMs know it", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 3, "compare": 2, "warn": 4}, "spark": [0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I used to write Python scripts with Requests or run from terminal. It has a nicer syntax, all LLMs know it", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/psf/requests", "official_url": "https://requests.readthedocs.io", "pricing": "", "aliases": ["Requests", "requests"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 771730672, "item_id": 48233167, "url": "https://news.ycombinator.com/item?id=48233167", "by": "aitchnyu", "date": "2026-05-22", "version": null, "stance": "recommend", "quote": "I used to write Python scripts with Requests or run from terminal. It has a nicer syntax, all LLMs know it", "excerpt": "I used to write Python scripts with Requests or run from terminal. It has a nicer syntax, all LLMs know it, and we all used Python in the backend. https://docs.python-requests.org/en/latest/index.html", "context": "", "use_case": "HTTP requests scripting", "switched_from": "", "story": "Slumber a TUI HTTP Client"}, {"id": 760051138, "item_id": 47503196, "url": "https://news.ycombinator.com/item?id=47503196", "by": "santiagobasulto", "date": "2026-03-24", "version": null, "stance": "recommend", "quote": "just stick to `requests.post('...')", "excerpt": "I blogged about this last year[0]... > ### Software Supply Chain is a Pain in the A* > On top of that, the room for vulnerabilities and supply chain attacks has increased dramatically AI Is not about fancy models, is about plain old Software Engineering. I strongly advised our team of \"not-so-senior\" devs to not use LiteLLM or LangChain or anything like that and just stick to `requests.post('...')\". [0] https://sb.th", "context": "", "use_case": "HTTP calls", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 741966032, "item_id": 46372877, "url": "https://news.ycombinator.com/item?id=46372877", "by": "kerkeslager", "date": "2025-12-23", "version": null, "stance": "recommend", "quote": "which worked well", "excerpt": "Ah, I'm not so aware of the numerical/scientific computing space beyond numpy--I will say the numpy transition was pretty quick, though. I did take the approach of writing my own OAuth using `requests`, which worked well, but I don't think I ever wrote in such a general way to make it a library. Part of the problem is that OAuth isn't really a standard[1]. There are well-maintained libraries for Facebook and Google O", "context": "", "use_case": "HTTP requests and custom OAuth", "switched_from": "", "story": "Deprecate like you mean it"}, {"id": 741947346, "item_id": 46371709, "url": "https://news.ycombinator.com/item?id=46371709", "by": "kerkeslager", "date": "2025-12-23", "version": null, "stance": "recommend", "quote": "Django, Pillow, Requests, BeautifulSoup, and pretty much every other library I use regularly", "excerpt": "Well, I'll point out one thing: Your definition of \"core libraries\" is likely a lot broader than mine. I'm old, and I remember back in the day when Perl developers started learning the hard way that CPAN isn't the Perl standard library. JavaScript's culture has embraced pulling in libraries for every single little thing, which has resulted in stuff like the left pad debacle, but that very public failing is just the t", "context": "consults on cleaning up codebases", "use_case": "", "switched_from": "", "story": "Deprecate like you mean it"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 791833840, "item_id": 49489615, "url": "https://news.ycombinator.com/item?id=49489615", "by": "JimDabell", "date": "2026-08-29", "version": null, "stance": "warn", "quote": "Nobody should use requests.", "excerpt": "Requests has been dead for over a decade. It doesn\u2019t support HTTP/2, it doesn\u2019t support HTTP/3, it doesn\u2019t support async, and they ignore security vulnerabilities for months. Nobody should use requests. If you are still using it, the quickest way to get off it is to switch to niquests, which is actively developed, supports all the things I mentioned above, and API-compatible with requests - you can just do `import ni", "context": "", "use_case": "", "switched_from": "", "story": "Migrating to HTTPX2"}, {"id": 776396976, "item_id": 48524811, "url": "https://news.ycombinator.com/item?id=48524811", "by": "necovek", "date": "2026-06-13", "version": null, "stance": "warn", "quote": "People mostly defer to requests because they do not track language development closely", "excerpt": "Parts of requests has been adopted into stdlib: https://docs.python.org/3/library/urllib.request.html People mostly defer to requests because they do not track language development closely and because we are creatures of habit. I try to avoid non-stdlib packages when stdlib will do a good job, but I received negative feedback from people who aren't aware of the updates and couldn't foresee supply-chain attacks.", "context": "", "use_case": "", "switched_from": "", "story": "Python 3.14 garbage collection rigamarole"}, {"id": 742475488, "item_id": 46404718, "url": "https://news.ycombinator.com/item?id=46404718", "by": "zahlman", "date": "2025-12-27", "version": null, "stance": "warn", "quote": "they won't merge it until absolutely necessary for the 2.33 release", "excerpt": "There's been a branch for it (https://github.com/psf/requests/tree/hatchling) for a little while apparently; I guess they won't merge it until absolutely necessary for the 2.33 release. But that is still just over a year after I offered (https://github.com/psf/requests/issues/6775). ... Ah, I got confused for a bit. When I first noticed the `pyproject.toml` deficiency, it was because Requests was affected by the majo", "context": "", "use_case": "", "switched_from": "", "story": "How uv got so fast"}, {"id": 739452817, "item_id": 46215801, "url": "https://news.ycombinator.com/item?id=46215801", "by": "gschizas", "date": "2025-12-10", "version": null, "stance": "warn", "quote": "Python (or rather requests, or maybe urllib3) only looks at its own certificate store", "excerpt": "The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to \"http.schannel\". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul", "context": "", "use_case": "HTTP client certificates", "switched_from": "", "story": "Stop Breaking TLS"}]}], "who": [{"by": "kerkeslager", "context": "consults on cleaning up codebases", "url": "https://news.ycombinator.com/item?id=46371709", "date": "2025-12-23"}], "tags": [], "use_cases": ["http requests scripting", "http client library", "http calls", "http requests and custom oauth", "http client certificates"], "compared": [{"slug": "niquests", "name": "niquests", "co": 3, "switched_from": 0, "switched_to": 2}, {"slug": "httpx", "name": "httpx", "co": 4, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47514603", "title": "I Forked Httpx", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46232898", "title": "Deprecate like you mean it", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49477212", "title": "Migrating to HTTPX2", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48503009", "title": "Python 3.14 garbage collection rigamarole", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48231938", "title": "Slumber a TUI HTTP Client", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47825888", "title": "Some secret management belongs in your HTTP proxy", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"warn": 2, "neutral": 1, "recommend": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 1, "neutral": 1, "compare": 1}, "2026-04": {"compare": 1, "neutral": 1}, "2026-05": {"recommend": 1}, "2026-06": {"warn": 1}, "2026-07": {}, "2026-08": {"warn": 1}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 791833840, "item_id": 49489615, "url": "https://news.ycombinator.com/item?id=49489615", "by": "JimDabell", "date": "2026-08-29", "version": null, "stance": "warn", "quote": "Nobody should use requests.", "excerpt": "Requests has been dead for over a decade. It doesn\u2019t support HTTP/2, it doesn\u2019t support HTTP/3, it doesn\u2019t support async, and they ignore security vulnerabilities for months. Nobody should use requests. If you are still using it, the quickest way to get off it is to switch to niquests, which is actively developed, supports all the things I mentioned above, and API-compatible with requests - you can just do `import ni", "context": "", "use_case": "", "switched_from": "", "story": "Migrating to HTTPX2"}, {"id": 776396976, "item_id": 48524811, "url": "https://news.ycombinator.com/item?id=48524811", "by": "necovek", "date": "2026-06-13", "version": null, "stance": "warn", "quote": "People mostly defer to requests because they do not track language development closely", "excerpt": "Parts of requests has been adopted into stdlib: https://docs.python.org/3/library/urllib.request.html People mostly defer to requests because they do not track language development closely and because we are creatures of habit. I try to avoid non-stdlib packages when stdlib will do a good job, but I received negative feedback from people who aren't aware of the updates and couldn't foresee supply-chain attacks.", "context": "", "use_case": "", "switched_from": "", "story": "Python 3.14 garbage collection rigamarole"}, {"id": 771730672, "item_id": 48233167, "url": "https://news.ycombinator.com/item?id=48233167", "by": "aitchnyu", "date": "2026-05-22", "version": null, "stance": "recommend", "quote": "I used to write Python scripts with Requests or run from terminal. It has a nicer syntax, all LLMs know it", "excerpt": "I used to write Python scripts with Requests or run from terminal. It has a nicer syntax, all LLMs know it, and we all used Python in the backend. https://docs.python-requests.org/en/latest/index.html", "context": "", "use_case": "HTTP requests scripting", "switched_from": "", "story": "Slumber a TUI HTTP Client"}, {"id": 765768801, "item_id": 47860550, "url": "https://news.ycombinator.com/item?id=47860550", "by": "thewisenerd", "date": "2026-04-22", "version": null, "stance": "neutral", "quote": "i think requests is a tricky one", "excerpt": "thankfully more and more projects are supporting the \"standard\" SSL_CERT_DIR/SSL_CERT_FILE environment variables [1] i think requests is a tricky one, as it _should_ be supporting it already based on the PR [2], but looks like it was merged in the 3.x branch and idk where that is, release-wise. there is also native TLS on linux (idk what exactly you call it); but cp cert.pem /usr/local/share/ca-certificates/cert.pem ", "context": "", "use_case": "HTTP client library", "switched_from": "", "story": "Some secret management belongs in your HTTP proxy"}, {"id": 764113648, "item_id": 47757103, "url": "https://news.ycombinator.com/item?id=47757103", "by": "tmoertel", "date": "2026-04-13", "version": null, "stance": "compare", "quote": "as opposed to using an external package such as Requests", "excerpt": "For exactly this reason, when I write software, I go out of my way to avoid using external packages. For example, I recently wrote a tool in Python to synchronize weather-statation data to a local database. [1] It took only a little more effort to use the Python standard library to manage the downloads, as opposed to using an external package such as Requests [2], but the result is that I have no dependencies beyond ", "context": "", "use_case": "", "switched_from": "", "story": "Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them"}, {"id": 760334674, "item_id": 47520917, "url": "https://news.ycombinator.com/item?id=47520917", "by": "Kwpolska", "date": "2026-03-25", "version": null, "stance": "compare", "quote": "the requests library for Python started in 2011", "excerpt": "Python\u2019s urllib2 (now urllib.request) started out in the year 2000 [0]. .NET\u2019s WebRequest was available in .NET Framework 1.1 in 2003 [1]. But since then, Microsoft noticed the issues with WebRequest and came up with HttpClient in 2012. It has some issues and footguns, like those related to HttpClient lifetime, but it\u2019s a solid library. On the other hand, the requests library for Python started in 2011 [2], but the s", "context": "", "use_case": "", "switched_from": "", "story": "I Forked Httpx"}, {"id": 760242673, "item_id": 47515167, "url": "https://news.ycombinator.com/item?id=47515167", "by": "localuser13", "date": "2026-03-25", "version": null, "stance": "neutral", "quote": "Which was fine when requests were the de-facto-standard only player in town", "excerpt": ">Honestly the thing that consistently surprises me is that requests hasn't been standardised and brought into the standard library Instead, official documentation seems comfortable with recommending a third party package: https://docs.python.org/3/library/urllib.request.html#module-urllib.request >The Requests package is recommended for a higher-level HTTP client interface. Which was fine when requests were the de-fa", "context": "", "use_case": "", "switched_from": "", "story": "I Forked Httpx"}, {"id": 760051138, "item_id": 47503196, "url": "https://news.ycombinator.com/item?id=47503196", "by": "santiagobasulto", "date": "2026-03-24", "version": null, "stance": "recommend", "quote": "just stick to `requests.post('...')", "excerpt": "I blogged about this last year[0]... > ### Software Supply Chain is a Pain in the A* > On top of that, the room for vulnerabilities and supply chain attacks has increased dramatically AI Is not about fancy models, is about plain old Software Engineering. I strongly advised our team of \"not-so-senior\" devs to not use LiteLLM or LangChain or anything like that and just stick to `requests.post('...')\". [0] https://sb.th", "context": "", "use_case": "HTTP calls", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 742475488, "item_id": 46404718, "url": "https://news.ycombinator.com/item?id=46404718", "by": "zahlman", "date": "2025-12-27", "version": null, "stance": "warn", "quote": "they won't merge it until absolutely necessary for the 2.33 release", "excerpt": "There's been a branch for it (https://github.com/psf/requests/tree/hatchling) for a little while apparently; I guess they won't merge it until absolutely necessary for the 2.33 release. But that is still just over a year after I offered (https://github.com/psf/requests/issues/6775). ... Ah, I got confused for a bit. When I first noticed the `pyproject.toml` deficiency, it was because Requests was affected by the majo", "context": "", "use_case": "", "switched_from": "", "story": "How uv got so fast"}, {"id": 741966032, "item_id": 46372877, "url": "https://news.ycombinator.com/item?id=46372877", "by": "kerkeslager", "date": "2025-12-23", "version": null, "stance": "recommend", "quote": "which worked well", "excerpt": "Ah, I'm not so aware of the numerical/scientific computing space beyond numpy--I will say the numpy transition was pretty quick, though. I did take the approach of writing my own OAuth using `requests`, which worked well, but I don't think I ever wrote in such a general way to make it a library. Part of the problem is that OAuth isn't really a standard[1]. There are well-maintained libraries for Facebook and Google O", "context": "", "use_case": "HTTP requests and custom OAuth", "switched_from": "", "story": "Deprecate like you mean it"}, {"id": 741947346, "item_id": 46371709, "url": "https://news.ycombinator.com/item?id=46371709", "by": "kerkeslager", "date": "2025-12-23", "version": null, "stance": "recommend", "quote": "Django, Pillow, Requests, BeautifulSoup, and pretty much every other library I use regularly", "excerpt": "Well, I'll point out one thing: Your definition of \"core libraries\" is likely a lot broader than mine. I'm old, and I remember back in the day when Perl developers started learning the hard way that CPAN isn't the Perl standard library. JavaScript's culture has embraced pulling in libraries for every single little thing, which has resulted in stuff like the left pad debacle, but that very public failing is just the t", "context": "consults on cleaning up codebases", "use_case": "", "switched_from": "", "story": "Deprecate like you mean it"}, {"id": 739540353, "item_id": 46221272, "url": "https://news.ycombinator.com/item?id=46221272", "by": "CaliforniaKarl", "date": "2025-12-10", "version": null, "stance": "neutral", "quote": "urllib3 as one of the foundational packages that Requests uses", "excerpt": "This, I think, is the crux of the matter. As an example, I always knew urllib3 as one of the foundational packages that Requests uses. And I was curious, what versions of urllib3 does Requests pull in? Well, according to https://github.com/psf/requests/blob/main/setup.cfg, it's this: urllib3>=1.21.1,<3 That is exactly the kind of dependency specification I would expect to see for a package that is using semver: The c", "context": "", "use_case": "", "switched_from": "", "story": "Deprecations via warnings don't work for Python libraries"}, {"id": 739452817, "item_id": 46215801, "url": "https://news.ycombinator.com/item?id=46215801", "by": "gschizas", "date": "2025-12-10", "version": null, "stance": "warn", "quote": "Python (or rather requests, or maybe urllib3) only looks at its own certificate store", "excerpt": "The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to \"http.schannel\". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul", "context": "", "use_case": "HTTP client certificates", "switched_from": "", "story": "Stop Breaking TLS"}]}