Skip to content

[Snyk] Security upgrade urllib3 from 2.0.7 to 2.6.3 #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Dustin4444 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade urllib3 from 2.0.7 to 2.6.3 #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ tblib>=1.7.0 # So that the django test runner provides tracebacks
tlds>=2022042700 # Used to teach bleach about which TLDs currently exist
tqdm>=4.64.0
Unidecode>=1.3.4
urllib3>=1.26,<2
urllib3>=2.6.3
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jan 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The upgrade of urllib3 to version 2.x introduces breaking changes that will affect this project.

  1. Dependency Conflict with selenium: The selenium package, which is a dependency in this project (selenium>=4.0), requires urllib3~=1.26. This version constraint is not compatible with urllib3 v2.x. The latest versions of selenium still have this requirement, so upgrading urllib3 will cause a dependency conflict and break tests that rely on selenium. You can track the selenium upgrade issue here: SeleniumHQ/selenium#12011.

  2. Incompatible API Usage: The file ietf/utils/test_runner.py uses an API from urllib3 that has been removed in version 2.0. On line 128, urllib3.Retry is called with a redirect keyword argument:

    http = urllib3.PoolManager(retries=urllib3.Retry(99, redirect=False))

    This argument is no longer supported in urllib3 v2.0 and will cause a TypeError at runtime.

Given these critical issues, this pull request cannot be merged as is. It is recommended to wait until selenium supports urllib3 v2.x before proceeding with this upgrade.

weasyprint>=64.1
xml2rfc>=3.23.0
xym>=0.6,<1.0
Loading