What's Changed

• Add support for niquests (#980) — thanks @ionelmc
• Recording now fails fast if a request or response contains a Python object the safe YAML loader (introduced in 8.2.1) couldn't read back, instead of writing a cassette that breaks on replay. The error shows exactly how to register the object if you need it (#1007, #1009) — thanks @Polandia94
• New vcr.serializers.yamlserializer.with_custom_tags(...) builds a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) — thanks @Polandia94
• Clearer error when a cassette contains an unsupported YAML tag, and the stale git.io migration link is gone (#1007, #1008) — thanks @gaoflow
• Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

Full Changelog: v8.2.1...v8.3.0

What's Changed

• SECURITY: Cassettes are now loaded with a safe YAML loader, preventing arbitrary code execution when a cassette from an untrusted source is loaded. Previously a crafted cassette containing a Python object tag (e.g. !!python/object/apply:os.system) would execute code on load, including via the normal vcr.use_cassette() path. Existing cassettes (including file-upload/streaming bodies) continue to load. Advisory: GHSA-rpj2-4hq8-938g — thanks @RamiAltai and @EQSTLab for the reports.
• Validate record_mode and raise a clear error on an invalid value (#208)
• Recommend pytest-recording over the unmaintained pytest-vcr in the docs (#986)

Full Changelog: v8.2.0...v8.2.1

What's Changed

• Add support for httpx 2.x (#993) - thanks @dsfaccini
• Patch httpx transports instead of httpcore (#972) - thanks @seowalex
• Fix aiohttp 3.14 compatibility: AsyncStreamReaderMixin removed and ClientResponse now requires stream_writer (#995) - thanks @dsfaccini
• Account for modified requests when storing played cassettes, so drop_unused_requests honours before_record_request filtering (#962) - thanks @jamesbraza
• Make the request URL available on VCRHTTPResponse (#976) - thanks @dAnjou
• Improve error message when a matching request has already been consumed (#985) - thanks @Polandia94
• Fix body check in convert_body_to_unicode to use an explicit type check (#982) - thanks @Polandia94
• Add env proxy cassette regression test (#994) - thanks @tine1117
• Remove milestone references from docs (#984) - thanks @Polandia94
• CI: bump sphinx-rtd-theme from 3.0.2 to 3.1.0 (#973)

Full Changelog: v8.1.1...v8.2.0

What's Changed

• Fix sync requests in async contexts for HTTPX (#965) - thanks @seowalex
• CI: bump peter-evans/create-pull-request from 7 to 8 (#969)

New Features

• Enable brotli decompression if available (via brotli, brotlipy or brotlicffi) (#620) - thanks @immerrr

Bug Fixes

• Fix aiohttp allowing both data and json arguments when one is None (#624) - thanks @leorochael
• Fix usage of io-like interface with VCR.py (#906) - thanks @tito and @kevdevg

Other Changes

• Migrate to declarative Python package config (#767) - thanks @deronnax
• Various linting fixes - thanks @jairhenrique
• CI: bump actions/checkout from 5 to 6 (#955)

Full Changelog: v8.0.0...v8.1.0

Breaking Changes

• Drop support for Python 3.9 - thanks @jairhenrique
• Drop support for urllib3 < 2 - fixes CVE warnings from urllib3 1.x (#926, #880) - thanks @jairhenrique

New Features

• New drop_unused_requests option to remove unused interactions from cassettes (#763) - thanks @danielnsilva

Bug Fixes

• Rewrite httpx support to patch httpcore instead of httpx (#943) - thanks @seowalex
  • Fixes httpx.ResponseNotRead exceptions (#832, #834)
  • Fixes KeyError: 'follow_redirects' (#945)
  • Adds support for custom httpx transports
• Fix HTTPS proxy handling - proxy address no longer ends up in cassette URIs (#809, #914) - thanks @alga
• Fix iscoroutinefunction deprecation warning on Python 3.14 - thanks @kloczek

Other Changes

• Only log message if response is appended - thanks @talfus-laddus
• Optimize urllib.parse calls - thanks @Martin-Brunthaler
• Fix CI for Ubuntu 24.04 - thanks @hartwork
• Various CI improvements: migrate to uv, update GitHub Actions - thanks @jairhenrique
• Various linting and test improvements - thanks @jairhenrique and @hartwork

Full Changelog: v7.0.0...v8.0.0

What's Changed

- Drop support for python 3.8 (major version bump) - thanks @jairhenrique
- Various linting and test fixes - thanks @jairhenrique
- Bugfix for urllib2>=2.3.0 - missing version_string (#888)
- Bugfix for asyncio.run - thanks @alekeik1

New Contributors

• @exslim made their first contribution in #889
• @alekseik1 made their first contribution in #886

• Ensure body is consumed only once (#846) - thanks @sathieu
• Permit urllib3 2.x for non-PyPy Python >=3.10
• Fix typos in test commands - thanks @chuckwondo
• Several test and workflow improvements - thanks @hartwork and @graingert

Bugfix with to Tornado cassette generator (thanks @graingert)

• BREAKING: Fix issue with httpx support (thanks @parkerhancock) in #784. NOTE: You may have to recreate some of your cassettes produced in previous releases due to the binary format being saved incorrectly in previous releases
• BREAKING: Drop support for boto (vcrpy still supports boto3, but is dropping the deprecated boto support in this release. (thanks @jairhenrique)
• Fix compatibility issue with Python 3.12 (thanks @hartwork)
• Drop simplejson (fixes some compatibility issues) (thanks @jairhenrique)
• Run CI on Python 3.12 and PyPy 3.9-3.10 (thanks @mgorny)
• Various linting and docs improvements (thanks @jairhenrique)
• Tornado fixes (thanks @graingert)