Issue 5000 remove requests certifi (#5146)

* Depend on requests and certifi from vendored pip and remove it as explicit vendor dependency.

* Documentation tweak.

* Add a news fragment.

* Update remaining vendor dependencies to point at the pip requests.

* vendoring task needs requests.

.github/workflows/ci.yaml

@@ -58,7 +58,7 @@ jobs:
         with:
           python-version: 3.9
       - run: |
-          python -m pip install --upgrade wheel invoke parver bs4 vistir towncrier
+          python -m pip install --upgrade wheel invoke parver bs4 vistir towncrier requests
           python -m invoke vendoring.update
   tests:
     name: ${{matrix.os}} / ${{ matrix.python-version }}

docs/advanced.rst

@@ -280,8 +280,8 @@ flag::
     py==1.4.34
     pytest==3.2.3
 
-Adding the ``--hash`` flag will add package hashes to the output for extra security.
-Adding the ``--exclude-markers`` flagwill exclude the markers from the output.
+Adding the ``--hash`` flag adds package hashes to the output for extra security.
+Adding the ``--exclude-markers`` flag excludes the markers from the output.
 
 The locked requirements are written to stdout, with shell output redirection
 used to write them to a file::

news/5000.vendor.rst

@@ -0,0 +1 @@
+Depend on ``requests`` and ``certifi`` from vendored ``pip`` and remove them as explicit vendor dependencies.

news/5092.behavior.rst

@@ -1 +1 @@
-Adjust ``pipenv requirements`` to add markers and add an ``--exclude-markers`` option to allow the exclusion of markers
+Adjust ``pipenv requirements`` to add markers and add an ``--exclude-markers`` option to allow the exclusion of markers.

pipenv/core.py

@@ -168,7 +168,7 @@ def import_requirements(project, r=None, dev=False):
     from pipenv.patched.notpip._internal.req.constructors import (
         install_req_from_parsed_requirement,
     )
-    from pipenv.patched.notpip._vendor import requests as pip_requests
+    from pipenv.patched.notpip._vendor import requests
     from pipenv.vendor.pip_shims.shims import parse_requirements
 
     # Parse requirements.txt file with Pip's parser.
@@ -196,7 +196,7 @@ def import_requirements(project, r=None, dev=False):
     trusted_hosts = sorted(set(trusted_hosts))
     reqs = [
         install_req_from_parsed_requirement(f)
-        for f in parse_requirements(r, session=pip_requests)
+        for f in parse_requirements(r, session=requests)
     ]
     for package in reqs:
         if package.name not in BAD_PACKAGES:

pipenv/patched/safety/safety.py

@@ -5,7 +5,7 @@
 import time
 from collections import namedtuple
 
-import pipenv.vendor.requests as requests
+import pipenv.patched.notpip._vendor.requests as requests
 from pipenv.vendor.packaging.specifiers import SpecifierSet
 
 from .constants import (API_MIRRORS, CACHE_FILE, CACHE_LICENSES_VALID_SECONDS,

pipenv/utils/internet.py

@@ -13,7 +13,7 @@ def _get_requests_session(max_retries=1):
     global requests_session
     if requests_session is not None:
         return requests_session
-    import requests
+    from pipenv.patched.notpip._vendor import requests
 
     requests_session = requests.Session()
     adapter = requests.adapters.HTTPAdapter(max_retries=max_retries)

pipenv/vendor/pip_shims/compat.py

@@ -48,7 +48,7 @@
         Union,
     )
 
-    from requests import Session
+    from pipenv.patched.notpip._vendor.requests import Session
 
     from .utils import TShim, TShimmedFunc, TShimmedPath