Issue 1:
On Windows, the proxy settings in Windows Registry will override the proxies attribute in session object. Here is a sample code:

import requests

url = 'https://finance.yahoo.com/quote/AAPL/history'
params = {'period1': 1648497600, 'period2': 1649793599, 'interval': '1d', 'frequency': '1d', 'filter': 'history'}
proxies = {'http': 'socks5h://127.0.0.1:10808', 'https': 'socks5h://127.0.0.1:10808'}
headers = {'User-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'}

# using session
session = requests.Session()
session.headers.update(headers)
session.proxies.update(proxies)
# r1 = session.get(url, params=params) # this line will raise exception
#
# Exception has occurred: SSLError
# HTTPSConnectionPool(host='finance.yahoo.com', port=443): Max retries exceeded with url: /quote/AAPL/history?period1=1648497600&period2=1649793599&interval=1d&frequency=1d&filter=history (Caused by SSLError(SSLEOFError(8, 'EOF occurred in violation of protocol (_ssl.c:1129)')))

# using requests.get
r2 = requests.get(url, params=params, headers=session.headers, proxies=session.proxies) # OKAY
r3 = requests.get(url, params=params, headers=headers, proxies=proxies) # OKAY
r4 = session.get(url, params=params, headers=headers, proxies=proxies) # OKAY

Expected Result

By setting proxies in Session object, the r1 line should use this setting and return successfully, like r2, r3 and r4.

Actual Result

r1 = session.get(url, params=params) line raises exception, since it is not using the proxy as specified in my code.

By tracing into the source code of requests, I found the proxies setting in Session object is override by Windows registry's proxy settings, hence an Exception is raised.

Below I listed the relevant pieces of codes along with the variable content of proxies.

# my code
proxies = {'https': 'socks5h://127.0.0.1:10808'}
session.proxies.update(proxies)
r1 = session.get(url, params=params)

# requests > sessions.py > Session > get
def get(self, url, **kwargs)
#...
return self.request('GET', url, **kwargs)

# requests > sessions.py
class Session:
# ...
def request(...):
#...
proxies = proxies or {}
# after this, proxies is {}

settings = self.merge_environment_settings(
prep.url, proxies, stream, verify, cert
)
# now settings['proxies'] is:
#. OrderedDict([('https', 'https://127.0.0.1:10809'), ('http', 'http://127.0.0.1:10809'), ('ftp', 'ftp://127.0.0.1:10809')])

def merge_environment_settings(...):
#...
env_proxies = get_environ_proxies(url, no_proxy=no_proxy)
# after this call, env_proxies ends to be:
# {'http': 'http://127.0.0.1:10809', 'https': 'https://127.0.0.1:10809', 'ftp': 'ftp://127.0.0.1:10809'}
#...
# before entering merge_setting(), proxies=
# {'http': 'http://127.0.0.1:10809', 'https': 'https://127.0.0.1:10809', 'ftp': 'ftp://127.0.0.1:10809'}
# self.proxies={'https': 'socks5h://127.0.0.1:10808'}
proxies = merge_setting(proxies, self.proxies)
# after exit of merge_setting(), proxies=
# OrderedDict([('https', 'https://127.0.0.1:10809'), ('http', 'http://127.0.0.1:10809'), ('ftp', 'ftp://127.0.0.1:10809')])
# which is completely different from what I expected

# requests > utils.py
def get_environ_proxies(url, no_proxy=None):
#...
return getproxies()

# urllib> request.py
def get proxies():
return getproxies_environment() or getproxies_registry()

# urllib> request.py
def getproxies_registry():
# ....
return proxies # here, proxies ends to be: {'http': 'http://127.0.0.1:10809', 'https': 'https://127.0.0.1:10809', 'ftp': 'ftp://127.0.0.1:10809'}, which is taken from Windows Regsitry

# requests > sessions.py
def merge_setting(request_setting, session_setting, dict_class=OrderedDict):
# this function considers the first argument as setting (eg proxies) within request; however, with the study above,
# it could be a setting from system registry. My take is that it is of the lower priority than session setting, which is lower
# request setting.

Reproduction Steps

Refer to the post above.

System Information

$ python -m requests.help

{
"chardet": {
"version": null
},
"charset_normalizer": {
"version": "2.0.8"
},
"cryptography": {
"version": ""
},
"idna": {
"version": "3.3"
},
"implementation": {
"name": "CPython",
"version": "3.9.7"
},
"platform": {
"release": "10",
"system": "Windows"
},
"pyOpenSSL": {
"openssl_version": "",
"version": null
},
"requests": {
"version": "2.27.1"
},
"system_ssl": {
"version": "101010cf"
},
"urllib3": {
"version": "1.26.7"
},
"using_charset_normalizer": true,
"using_pyopenssl": false
}

Issue 2:
See https://iscinumpy.dev/post/bound-version-constraints/ as for why this is a problem.

This is a source of byzantine issues such as nexB/scancode-toolkit#3195