chore(deps): update dependency urllib3 to v2.5.0 [security] #10
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==2.0.7
->==2.5.0
GitHub Vulnerability Alerts
CVE-2024-37891
When using urllib3's proxy support with
ProxyManager
, theProxy-Authorization
header is only sent to the configured proxy, as expected.However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the
Proxy-Authorization
header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat theProxy-Authorization
HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects.Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the
Proxy-Authorization
header during cross-origin redirects to avoid the small chance that users are doing this on accident.Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the
Proxy-Authorization
header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach.Affected usages
We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:
Proxy-Authorization
header without using urllib3's built-in proxy support.Remediation
Proxy-Authorization
header with urllib3'sProxyManager
.redirects=False
when sending requests.Proxy-Authorization
header.CVE-2025-50181
urllib3 handles redirects and retries using the same mechanism, which is controlled by the
Retry
object. The most common way to disable redirects is at the request level, as follows:However, it is also possible to disable redirects, for all requests, by instantiating a
PoolManager
and specifyingretries
in a way that disable redirects:However, the
retries
parameter is currently ignored, which means all the above examples don't disable redirects.Affected usages
Passing
retries
onPoolManager
instantiation to disable redirects or restrict their number.By default, requests and botocore users are not affected.
Impact
Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.
Remediation
You can remediate this vulnerability with the following steps:
request()
level instead of thePoolManager()
level.CVE-2025-50182
urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects.
However, the
retries
andredirect
parameters are ignored with Pyodide; the runtime itself determines redirect behavior.Affected usages
Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.
Impact
Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.
Remediation
If you use urllib3 in Node.js, upgrade to a patched version of urllib3.
Unfortunately, browsers provide no suitable way which urllib3 can use:
XMLHttpRequest
provides no control over redirects, the Fetch API returnsopaqueredirect
responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.Release Notes
urllib3/urllib3 (urllib3)
v2.5.0
Compare Source
==================
Features
compression.zstd
module that is new in Python 3.14.See
PEP 784 <https://peps.python.org/pep-0784/>
_ for more information. (#​3610 <https://github.com/urllib3/urllib3/issues/3610>
__)hatch-vcs
(#​3612 <https://github.com/urllib3/urllib3/issues/3612>
__)Bugfixes
redirects at the
urllib3.PoolManager
level via theretries
parameterdid not work.
retries
and
redirects
.HTTPResponse.shutdown
on a connection already released to the pool. (#​3581 <https://github.com/urllib3/urllib3/issues/3581>
__)CONNECT
statement when using an IPv6 proxy withconnection_from_host
. Previously would not be wrapped in[]
. (#​3615 <https://github.com/urllib3/urllib3/issues/3615>
__)v2.4.0
Compare Source
==================
Features
#​3522 <https://github.com/urllib3/urllib3/issues/3522>
__)#​3567 <https://github.com/urllib3/urllib3/issues/3567>
__)verify_flags
option tocreate_urllib3_context
with a default ofVERIFY_X509_PARTIAL_CHAIN
andVERIFY_X509_STRICT
for Python 3.13+. (#​3571 <https://github.com/urllib3/urllib3/issues/3571>
__)Bugfixes
#​3555 <https://github.com/urllib3/urllib3/issues/3555>
__)Misc
#​3550 <https://github.com/urllib3/urllib3/issues/3550>
__)multiple.intoto.jsonl
asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#​3566 <https://github.com/urllib3/urllib3/issues/3566>
__)v2.3.0
Compare Source
==================
Features
HTTPResponse.shutdown()
to stop any ongoing or future reads for a specific response. It callsshutdown(SHUT_RD)
on the underlying socket. This feature wassponsored by LaunchDarkly <https://opencollective.com/urllib3/contributions/815307>
. (#​2868 <https://github.com/urllib3/urllib3/issues/2868>
)requests and streaming, and makes it possible to use in Node.js if you launch it as
node --experimental-wasm-stack-switching
. (#​3400 <https://github.com/urllib3/urllib3/issues/3400>
__)proxy_is_tunneling
property toHTTPConnection
andHTTPSConnection
. (#​3285 <https://github.com/urllib3/urllib3/issues/3285>
__)NewConnectionError
andNameResolutionError
. (#​3480 <https://github.com/urllib3/urllib3/issues/3480>
__)Bugfixes
#​3489 <https://github.com/urllib3/urllib3/issues/3489>
__)Deprecations and Removals
#​3492 <https://github.com/urllib3/urllib3/issues/3492>
__)v2.2.3
Compare Source
==================
Features
#​3473 <https://github.com/urllib3/urllib3/issues/3473>
__)Bugfixes
All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. (
#​3053 <https://github.com/urllib3/urllib3/issues/3053>
__)#​3252 <https://github.com/urllib3/urllib3/issues/3252>
__)#​3413 <https://github.com/urllib3/urllib3/issues/3413>
__)#​3432 <https://github.com/urllib3/urllib3/issues/3432>
__)HTTPConnection.default_socket_options
. (#​3448 <https://github.com/urllib3/urllib3/issues/3448>
__)HTTP/2 (experimental)
HTTP/2 support is still in early development.
Excluded Transfer-Encoding: chunked from HTTP/2 request body (
#​3425 <https://github.com/urllib3/urllib3/issues/3425>
__)Added version checking for
h2
(https://pypi.org/project/h2/) usage.Now only accepting supported h2 major version 4.x.x. (
#​3290 <https://github.com/urllib3/urllib3/issues/3290>
__)Added a probing mechanism for determining whether a given target origin
supports HTTP/2 via ALPN. (
#​3301 <https://github.com/urllib3/urllib3/issues/3301>
__)Add support for sending a request body with HTTP/2 (
#​3302 <https://github.com/urllib3/urllib3/issues/3302>
__)Deprecations and Removals
_version.py
file has been removed and is now created at build time by hatch-vcs. (#​3412 <https://github.com/urllib3/urllib3/issues/3412>
__)#​3475 <https://github.com/urllib3/urllib3/issues/3475>
__)v2.2.2
Compare Source
==================
Proxy-Authorization
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
.amt
to read methods ofhttp.client.HTTPResponse
as an alternative toNone
. (#​3122 <https://github.com/urllib3/urllib3/issues/3122>
__)typing.Self
. (#​3363 <https://github.com/urllib3/urllib3/issues/3363>
__)v2.2.1
Compare Source
==================
InsecureRequestWarning
was emitted for HTTPS connections when using Emscripten. (#​3331 <https://github.com/urllib3/urllib3/issues/3331>
__)HTTPConnectionPool.urlopen
to stop automatically casting non-proxy headers toHTTPHeaderDict
. This change was premature as it did not apply to proxy headers andHTTPHeaderDict
does not handle byte header values correctly yet. (#​3343 <https://github.com/urllib3/urllib3/issues/3343>
__)InvalidChunkLength
toProtocolError
when response terminates before the chunk length is sent. (#​2860 <https://github.com/urllib3/urllib3/issues/2860>
__)ProtocolError
to be more verbose on incomplete reads with excess content. (#​3261 <https://github.com/urllib3/urllib3/issues/3261>
__)v2.2.0
Compare Source
==================
Emscripten and Pyodide <https://urllib3.readthedocs.io/en/latest/reference/contrib/emscripten.html>
, including streaming support in cross-origin isolated browser environments where threading is enabled. (#​2951 <https://github.com/urllib3/urllib3/issues/2951>
)HTTPResponse.read1()
method. (#​3186 <https://github.com/urllib3/urllib3/issues/3186>
__)#​3284 <https://github.com/urllib3/urllib3/issues/3284>
__)when using proxy. (
#​2244 <https://github.com/urllib3/urllib3/issues/2244>
__)HTTPConnection.proxy_is_verified
andHTTPSConnection.proxy_is_verified
to be always set to a boolean after connecting to a proxy. It could be
None
in some cases previously. (#​3130 <https://github.com/urllib3/urllib3/issues/3130>
__)headers
passed in a request withjson=
would be mutated (#​3203 <https://github.com/urllib3/urllib3/issues/3203>
__)HTTPSConnection.is_verified
to be set toFalse
when connectingfrom a HTTPS proxy to an HTTP target. It was set to
True
previously. (#​3267 <https://github.com/urllib3/urllib3/issues/3267>
__)#​3268 <https://github.com/urllib3/urllib3/issues/3268>
__)#​3325 <https://github.com/urllib3/urllib3/issues/3325>
__)time with the
--integration
pytest flag. (#​3181 <https://github.com/urllib3/urllib3/issues/3181>
__)v2.1.0
Compare Source
==================
#​2680 <https://github.com/urllib3/urllib3/issues/2680>
__)#​2681 <https://github.com/urllib3/urllib3/issues/2681>
__)#​3143 <https://github.com/urllib3/urllib3/issues/3143>
__)#​3065 <https://github.com/urllib3/urllib3/issues/3065>
__)x-gzip
content-encoding. (#​3174 <https://github.com/urllib3/urllib3/issues/3174>
__)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.