Skip to content

chore(deps): bump urllib3 from 2.5.0 to 2.7.0#4

Open
dependabot[bot] wants to merge 9 commits into
mainfrom
dependabot/uv/urllib3-2.7.0
Open

chore(deps): bump urllib3 from 2.5.0 to 2.7.0#4
dependabot[bot] wants to merge 9 commits into
mainfrom
dependabot/uv/urllib3-2.7.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps urllib3 from 2.5.0 to 2.7.0.

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @​Cycloctane)
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @​kimkou2024)

    See GHSA-mf9v-mfxr-j63j for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @​christos-spearbit)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)
  • Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)
  • Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)
  • Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)
  • Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)
  • Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)
  • Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

2.6.2

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

    See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)
  • Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)
  • Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 17, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented May 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying equilens with  Cloudflare Pages  Cloudflare Pages

Latest commit: 4d7f7da
Status: ✅  Deploy successful!
Preview URL: https://7eec6c8a.equilens.pages.dev
Branch Preview URL: https://dependabot-uv-urllib3-2-7-0.equilens.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 17, 2026
VKrishna04 and others added 3 commits May 18, 2026 03:29
@VKrishna04 @claude
docs: add dashboard + root cleanup design spec
cc7b7c8 
Spec for replacing Gradio UIs with FastAPI+Jinja2 dashboard,
adding periodic backups, SSE job streaming, OpenAPI contract,
and moving Docker files to infra/.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@VKrishna04 @claude
docs: add dashboard implementation plan (18 tasks)
8e2434f 
Full plan for FastAPI+Jinja2+Alpine.js dashboard, APScheduler
backups, SSE streaming, OpenAPI annotations, and infra/ cleanup.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@VKrishna04 @claude
chore: move Docker/infra files to infra/ directory
f878775 
Relocates Dockerfile, docker-compose.yml, docker-compose.full-stack.yml,
.dockerignore, and equilens_cli.py into infra/ to declutter project root.
Updates build contexts and dockerfile paths to reference correct relative
paths from infra/. Updates CLAUDE.md docker compose command accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/urllib3-2.7.0 branch from 9037468 to cee111b Compare May 17, 2026 22:56
VKrishna04 and others added 6 commits May 18, 2026 04:28
@VKrishna04
fix: harden Docker infra files — layer ordering, volumes, paths, .doc…
99f57d2 
…kerignore
@VKrishna04
deps: remove gradio, add apscheduler+aiofiles+jinja2 to core
7257a61 
- Remove gradio>=4.0.0 from core dependencies
- Add apscheduler>=3.10.0, aiofiles, jinja2>=3.1.0 to core
- Remove pytest>=8.4.1 from core deps (belongs in dev extras only)
- Remove duplicate jinja2 entry from viz optional-dependencies group
@VKrishna04
chore: remove legacy Gradio UI files (web_ui, gradio_app, start_all)
8264497 
Deleted three files that depended on gradio (now removed):
- src/equilens/web_ui.py (legacy standalone Gradio UI)
- src/equilens/gradio_app.py (backend-connected Gradio UI)
- src/equilens/start_all.py (multi-service launcher)

Remaining imports in cli.py will be cleaned up in Task 17.
@VKrishna04
feat: add periodic backup system with APScheduler (12 tests)
65adb6b
@VKrishna04
fix: anchor backup paths to project root (fixes CWD-relative APSchedu…
c476b48 
…ler bug)
@dependabot
chore(deps): bump urllib3 from 2.5.0 to 2.7.0
4d7f7da 
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.7.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.5.0...2.7.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/urllib3-2.7.0 branch from cee111b to 4d7f7da Compare May 18, 2026 05:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@VKrishna04