Update requirements: drop requests

This also removes RequestsFetcher from tuf.ngclient.__init__.py:
Otherwise we can't drop the requests dependency.

This means RequestsFetcher is not currently public.

Signed-off-by: Jussi Kukkonen <[email protected]>

Author: jku

pyproject.toml

@@ -45,7 +45,6 @@ classifiers = [
   "Topic :: Software Development",
 ]
 dependencies = [
-  "requests>=2.19.1",
   "securesystemslib~=1.0",
   "urllib3<3,>=1.21.1",
 ]

requirements/main.txt

@@ -7,4 +7,4 @@
 # triggers CI/CD builds to automatically test against updated dependencies.
 #
 securesystemslib[crypto]
-requests
+urllib3

requirements/pinned.txt

@@ -4,21 +4,13 @@
 #
 #    pip-compile --output-file=requirements/pinned.txt --strip-extras requirements/main.txt
 #
-certifi==2025.1.31
-    # via requests
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.1
-    # via requests
 cryptography==44.0.0
     # via securesystemslib
-idna==3.10
-    # via requests
 pycparser==2.22
     # via cffi
-requests==2.32.3
-    # via -r requirements/main.txt
 securesystemslib==1.2.0
     # via -r requirements/main.txt
 urllib3==2.3.0
-    # via requests
+    # via -r requirements/main.txt

tuf/ngclient/__init__.py

@@ -8,15 +8,13 @@
 # requests_fetcher is public but comes from _internal for now (because
 # sigstore-python 1.0 still uses the module from there). requests_fetcher
 # can be moved out of _internal once sigstore-python 1.0 is not relevant.
-from tuf.ngclient._internal.requests_fetcher import RequestsFetcher
 from tuf.ngclient._internal.urllib3_fetcher import Urllib3Fetcher
 from tuf.ngclient.config import UpdaterConfig
 from tuf.ngclient.fetcher import FetcherInterface
 from tuf.ngclient.updater import Updater
 
 __all__ = [  # noqa: PLE0604
     FetcherInterface.__name__,
-    RequestsFetcher.__name__,
     Urllib3Fetcher.__name__,
     TargetFile.__name__,
     Updater.__name__,