Bump scrapy from 2.14.2 to 2.17.0

[dependabot]

Bumps scrapy from 2.14.2 to 2.17.0.

Release notes

Sourced from scrapy's releases.

2.17.0

• Security bug fixes
• HTTP/2 and SOCKS proxy support for HttpxDownloadHandler
• Improved settings for changing allowed TLS versions

Full Changelog

2.16.0

• Official support for Python 3.14
• Support for Twisted 26.4.0+

Full Changelog

2.15.2

What's Changed

• Fixed links in https://docs.scrapy.org/llms.txt (#7467)

Full Changelog: scrapy/scrapy@2.15.1...2.15.2

2.15.1

• Bug fixes

Full Changelog

2.15.0

• Experimental support for running without a Twisted reactor
• Experimental httpx-based download handler

Full Changelog

Changelog

Sourced from scrapy's changelog.

Scrapy 2.17.0 (2026-07-07)

Highlights:

• Security bug fixes

• HTTP/2 and SOCKS proxy support for HttpxDownloadHandler

• Improved settings for changing allowed TLS versions

Security bug fixes

-   ``s3://`` requests now use HTTPS by default, instead of plaintext HTTP.
Previously, :class:`~scrapy.core.downloader.handlers.s3.S3DownloadHandler`
sent signed S3 requests over plaintext HTTP unless
``request.meta["is_secure"]`` was set to a true value, exposing the request
path, the AWS ``Authorization`` header, the ``X-Amz-Security-Token`` header
(when using temporary credentials), and the response contents to network
attackers, who could also tamper with responses. See the `76g3-c3x4-crvx`_
security advisory for details.
To restore the previous behavior for a given request, set

request.meta["is_secure"] to False.
.. _76g3-c3x4-crvx: https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx


Deprecations

-   The ``DOWNLOADER_CLIENT_TLS_METHOD`` setting is deprecated. You should use
    the :setting:`DOWNLOAD_TLS_MIN_VERSION` and/or
    :setting:`DOWNLOAD_TLS_MAX_VERSION` settings instead if you want to change
    the TLS method selection.
    (:gh:`3288`, :gh:`6546`)


The following spider attributes are deprecated in favor of settings:


http_user (use :setting:HTTPAUTH_USER)


http_pass (use :setting:HTTPAUTH_PASS)


http_auth_domain (use :setting:HTTPAUTH_DOMAIN)


(:gh:7590)


The scrapy.commands.ScrapyCommand.help() method is deprecated. It was

never called by Scrapy.

</tr></table>

</code></pre>

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>


<ul>

<li><a href="https://github.com/scrapy/scrapy/commit/feb692f552e3ed4533cf4e3af4809908d84cd763&quot;&gt;&lt;code&gt;feb692f&lt;/code&gt;&lt;/a> Bump version: 2.16.0 → 2.17.0</li>

<li><a href="https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b&quot;&gt;&lt;code&gt;9523e1e&lt;/code&gt;&lt;/a> Merge commit from fork</li>

<li><a href="https://github.com/scrapy/scrapy/commit/5ccc8dbe8a735b322bacca16848ab9dfed839b99&quot;&gt;&lt;code&gt;5ccc8db&lt;/code&gt;&lt;/a> Release notes for 2.17.0 (<a href="https://redirect.github.com/scrapy/scrapy/issues/7723&quot;&gt;#7723&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/dd10cb8e9a982fe3d311078d6e1207596e272717&quot;&gt;&lt;code&gt;dd10cb8&lt;/code&gt;&lt;/a> LxmlLinkExtractor: add deny_attrs and deny_tags (<a href="https://redirect.github.com/scrapy/scrapy/issues/7679&quot;&gt;#7679&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/870803b7fb1ed56c296eb6b51d0212f0460dfdda&quot;&gt;&lt;code&gt;870803b&lt;/code&gt;&lt;/a> fix-utf16-response-test-on-big-endian-systems (<a href="https://redirect.github.com/scrapy/scrapy/issues/7508&quot;&gt;#7508&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/361f689df785959a59cf939b9efaefc72079f037&quot;&gt;&lt;code&gt;361f689&lt;/code&gt;&lt;/a> Improve test coverage for crawler.py (<a href="https://redirect.github.com/scrapy/scrapy/issues/7682&quot;&gt;#7682&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/fc5216f15611e40d795f5ab566acff8f9ca0af1e&quot;&gt;&lt;code&gt;fc5216f&lt;/code&gt;&lt;/a> Clarify/cleanup Selector.type (<a href="https://redirect.github.com/scrapy/scrapy/issues/7704&quot;&gt;#7704&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/a6d6a48aa600d1b4c3deb6409c17d0d7f55db312&quot;&gt;&lt;code&gt;a6d6a48&lt;/code&gt;&lt;/a> Keep Item fields in definition order (<a href="https://redirect.github.com/scrapy/scrapy/issues/7694&quot;&gt;#7694&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/00098cb596d0d3957236ba1ba193b09172696bc5&quot;&gt;&lt;code&gt;00098cb&lt;/code&gt;&lt;/a> Assorted docstring fixes (<a href="https://redirect.github.com/scrapy/scrapy/issues/7698&quot;&gt;#7698&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/deb7e2861e616bbfefb96433bd72e0d50055cd0e&quot;&gt;&lt;code&gt;deb7e28&lt;/code&gt;&lt;/a> Fix _get_tag_name() crash for non-string elem.tag (<a href="https://redirect.github.com/scrapy/scrapy/issues/7686&quot;&gt;#7686&lt;/a>) (<a href="https://redirect.github.com/scrapy/scrapy/issues/7687&quot;&gt;#7687&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/scrapy/scrapy/compare/2.14.2...2.17.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

You can disable automated security fix PRs for this repo from the Security Alerts page.