Bump responses from 0.25.8 to 0.26.2

[dependabot]

Bumps responses from 0.25.8 to 0.26.2.

Release notes

Sourced from responses's releases.

0.26.2

• Default headers (such as Content-Type, Date and Server) are now stripped from recorded files regardless of header name case. Previously, responses recorded from servers that send lowercase header names (for example over HTTP/2) kept these redundant headers in the generated file.
• Fixed query_param_matcher mutating the caller's params dict when numeric values are provided. See #801

0.26.1

• Added Spanish translation of the README (README.es.rst)
• When both content_type and headers['content-type'] are in a response mock file, content_type is now used.
• Added strict_match to urlencoded_params_matcher, enabling partial request parameter matching.

0.26.0

• When using assert_all_requests_are_fired=True, assertions about unfired requests are now raised even when an exception occurs in the context manager or decorated function. Previously, these assertions were suppressed when exceptions occurred. This new behavior provides valuable debugging context about which mocked requests were or weren't called.
• Consider the Retry-After header when handling retries

Changelog

Sourced from responses's changelog.

0.26.2

• Default headers (such as Content-Type, Date and Server) are now stripped from recorded files regardless of header name case. Previously, responses recorded from servers that send lowercase header names (for example over HTTP/2) kept these redundant headers in the generated file.
• Fixed query_param_matcher mutating the caller's params dict when numeric values are provided. See #801

0.26.1

• Added Spanish translation of the README (README.es.rst)
• When both content_type and headers['content-type'] are in a response mock file, content_type is now used.
• Added strict_match to urlencoded_params_matcher, enabling partial request parameter matching.

0.26.0

• When using assert_all_requests_are_fired=True, assertions about unfired requests are now raised even when an exception occurs in the context manager or decorated function. Previously, these assertions were suppressed when exceptions occurred. This new behavior provides valuable debugging context about which mocked requests were or weren't called.
• Consider the Retry-After header when handling retries

Commits

• 31d28eb release: 0.26.2
• 6fb610d Fix CHANGES (#802)
• aae1d47 Set license format to SPDX identifier in setup.py (#803)
• a19add7 fix: query_param_matcher no longer mutates the caller's params dict (#801)
• 88e15db Strip default headers from recorded files case-insensitively (#798)
• 1d48f2f docs: fix typos (#800)
• 853e7d2 docs: update tox Python version examples (#797)
• 705067b Merge branch 'release/0.26.1'
• 7a80232 release: 0.26.1
• 1fda897 Add strict_match parameter to urlencoded_params_matcher (#796)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[rtibblesbot]

🔵 Review posted

Last updated: 2026-08-01 01:10 UTC

[rtibblesbot]

PR #727 — responses 0.25.8 → 0.26.2, a minor bump of a test-only dependency ([dependency-groups] test, re-included by dev). CI passing: 15/15 unit-test jobs (ubuntu/macos/windows × Python 3.9–3.13) plus the docs build.

• Breaking changes: none declared. One behavior change in 0.26.0 — with assert_all_requests_are_fired=True, unfired-request assertions now raise even when an exception occurs in the context manager or decorated function. Not applicable here.
• Security fixes: none; no CVEs in the range.
• Peer/transitive deps: unchanged — still pyyaml, requests, urllib3 under the same CPython marker; the uv.lock diff is confined to the responses entry and two [package.metadata] specifier lines.
• Code changes required: none. Nothing in the repo imports responses — the only match outside the pin is the word "responses" in a tests/test_tree.py docstring, and uv.lock lists it solely under ricecooker's own dev/test groups, not as a transitive requirement. HTTP mocking in the suite is handled by vcrpy and locally-served media.

Other changes in range, for the record: Retry-After honored during retries (0.26.0); strict_match for urlencoded_params_matcher and content_type precedence over headers['content-type'] in mock files (0.26.1); case-insensitive default-header stripping and a query_param_matcher params-mutation fix (0.26.2).

Suggestion for a follow-up, not this PR: consider dropping the unused responses pin so Dependabot stops opening PRs for a package nothing exercises — or add a short comment on the pin if it's kept deliberately.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

• Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
• Extracted the changelog and release notes across the version range
• Assessed compatibility with this project's usage and whether any code changes are required
• Treated CI as the primary safety net
• Scaled the review depth to the update's risk
• Chose the verdict from semver risk, changelog findings, and CI status

[dependabot]

Looks like responses is no longer a dependency, so this is no longer needed.