chore(deps): bump niquests from 3.20.1 to 3.21.0

[dependabot]

Bumps niquests from 3.20.1 to 3.21.0.

Release notes

Sourced from niquests's releases.

Version 3.21.0

3.21.0 (2026-07-29)

Added

• First-class support for the WebAssembly System Interface (WASI) Component Model. (#364)

  Niquests can now run inside sandboxed WebAssembly components using the same Requests-compatible API available on native Python. This enables HTTP clients for edge functions, plug-ins, agent runtimes, and other capability-constrained applications without requiring application-specific adapters.

  Niquests automatically discovers the interfaces imported by the component and selects the most capable available transport. Synchronous applications can use native WASI Preview 2 sockets, while asynchronous applications can use Preview 3 sockets. The socket transports retain urllib3.future's native behavior, including connection pooling, HTTP/2 multiplexing, streaming, trailers, WebSocket, SSE, redirects, retries, cookies, and timeout handling.

  Components that intentionally omit raw socket authority can instead use the host-managed wasi:http interfaces: HTTP 0.2 for synchronous applications and HTTP 0.3 for asynchronous applications. This provides a narrower capability surface in which the host controls DNS, TCP, TLS, certificate trust, protocol negotiation, and connection reuse. Niquests also supports hybrid worlds, using sockets where possible and WIT HTTP where host-managed TLS is required.

  No network or filesystem authority is ambient under WASI. A component's WIT world declares which interfaces it can access, while the runtime independently decides which capabilities to grant. Native hostname resolution therefore requires an explicit DNS grant, and host filesystem access remains unavailable unless a directory is deliberately preopened.

  HTTPS over native WASI sockets requires the rtls extra and urllib3.future 2.24.900 or newer. When using WIT HTTP, TLS is provided according to the host's security policy instead.

  With this release, Niquests supports native Python, browser-side WebAssembly through Pyodide, and server-side WebAssembly through WASI while preserving the same familiar request API. See the WASI quickstart and advanced capability guide for deployment examples and transport-specific constraints.

• Explicit support for Python 3.15

• Custom json_encoder in Session and AsyncSession for request bodies. (#437)

• Top-level request APIs accept custom JSON encoders and TLS configuration.

Fixed

• CRL or OCSP unparsable/corrupted may raise CryptoError. (#430)
• A demoted (i.e. failed) HTTP/3 upgrade attempt could be retried when it should be permanently disabled. (#431)

Changelog

Sourced from niquests's changelog.

3.21.0 (2026-07-29)

Added

• First-class support for the WebAssembly System Interface (WASI) Component Model. (#364)

  Niquests can now run inside sandboxed WebAssembly components using the same Requests-compatible API available on native Python. This enables HTTP clients for edge functions, plug-ins, agent runtimes, and other capability-constrained applications without requiring application-specific adapters.

  Niquests automatically discovers the interfaces imported by the component and selects the most capable available transport. Synchronous applications can use native WASI Preview 2 sockets, while asynchronous applications can use Preview 3 sockets. The socket transports retain urllib3.future's native behavior, including connection pooling, HTTP/2 multiplexing, streaming, trailers, WebSocket, SSE, redirects, retries, cookies, and timeout handling.

  Components that intentionally omit raw socket authority can instead use the host-managed wasi:http interfaces: HTTP 0.2 for synchronous applications and HTTP 0.3 for asynchronous applications. This provides a narrower capability surface in which the host controls DNS, TCP, TLS, certificate trust, protocol negotiation, and connection reuse. Niquests also supports hybrid worlds, using sockets where possible and WIT HTTP where host-managed TLS is required.

  No network or filesystem authority is ambient under WASI. A component's WIT world declares which interfaces it can access, while the runtime independently decides which capabilities to grant. Native hostname resolution therefore requires an explicit DNS grant, and host filesystem access remains unavailable unless a directory is deliberately preopened.

  HTTPS over native WASI sockets requires the rtls extra and urllib3.future 2.24.900 or newer. When using WIT HTTP, TLS is provided according to the host's security policy instead.

  With this release, Niquests supports native Python, browser-side WebAssembly through Pyodide, and server-side WebAssembly through WASI while preserving the same familiar request API. See the WASI quickstart and advanced capability guide for deployment examples and transport-specific constraints.

• Explicit support for Python 3.15

• Custom json_encoder in Session and AsyncSession for request bodies. (#437)

• Top-level request APIs accept custom JSON encoders and TLS configuration.

Fixed

• CRL or OCSP unparsable/corrupted may raise CryptoError. (#430)
• A demoted (i.e. failed) HTTP/3 upgrade attempt could be retried when it should be permanently disabled. (#431)

Commits

• 7633aa3 Feat custom json encoder (#438)
• e4165cb feat: top-level apis to accept json_encoder+tls_configuration
• 6466cea feat: custom json encoder
• edef42d Release 3.21 (#436)
• b1e7791 Merge branch 'main' into release-3.21
• 4a1ada3 chore: ignore py3.15 deprecation warning
• 312bc32 chore: fix comment in typing.py for TimeoutType
• 5c5b5dd chore: fix CI wasmtime setup
• 972a511 docs: mention missing wit by default from pypi whl
• 76436b6 chore: add nox session py3.15
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)