Skip to content

Bump urllib3 from 2.6.0 to 2.6.3 in /tests/ci#2932

Merged
skmcgrail merged 1 commit intomainfrom
dependabot/pip/tests/ci/urllib3-2.6.3
Jan 22, 2026
Merged

Bump urllib3 from 2.6.0 to 2.6.3 in /tests/ci#2932
skmcgrail merged 1 commit intomainfrom
dependabot/pip/tests/ci/urllib3-2.6.3

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 8, 2026

Bumps urllib3 from 2.6.0 to 2.6.3.

Release notes

Sourced from urllib3's releases.

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

2.6.2

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. (urllib3/urllib3#3734)

2.6.1

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. (#3731)
Changelog

Sourced from urllib3's changelog.

2.6.3 (2026-01-07)

  • Fixed a high-severity security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>__)
  • Started treating Retry-After times greater than 6 hours as 6 hours by default. ([#3743](https://github.com/urllib3/urllib3/issues/3743) <https://github.com/urllib3/urllib3/issues/3743>__)
  • Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten. ([#3752](https://github.com/urllib3/urllib3/issues/3752) <https://github.com/urllib3/urllib3/issues/3752>__)

2.6.2 (2025-12-11)

  • Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. ([#3734](https://github.com/urllib3/urllib3/issues/3734) <https://github.com/urllib3/urllib3/issues/3734>__)

2.6.1 (2025-12-08)

  • Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. ([#3731](https://github.com/urllib3/urllib3/issues/3731) <https://github.com/urllib3/urllib3/issues/3731>__)
Commits
  • 0248277 Release 2.6.3
  • 8864ac4 Merge commit from fork
  • 70cecb2 Fix Scorecard issues related to vulnerable dev dependencies (#3755)
  • 41f249a Move "v2.0 Migration Guide" to the end of the table of contents (#3747)
  • fd4dffd Patch VerifiedHTTPSConnection for Emscripten (#3752)
  • 13f0bfd Handle massive values in Retry-After when calculating time to sleep for (#3743)
  • 8c480bf Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#3748)
  • 4b40616 Bump actions/cache from 4.3.0 to 5.0.1 (#3750)
  • 82b8479 Bump actions/download-artifact from 6.0.0 to 7.0.0 (#3749)
  • 34284cb Mention experimental features in the security policy (#3746)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump urllib3 from 2.6.0 to 2.6.3 in /tests/ci
4812869 
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jan 8, 2026
@dependabot dependabot bot requested a review from a team as a code owner January 8, 2026 06:34
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jan 8, 2026
@skmcgrail skmcgrail requested a review from justsmth January 21, 2026 22:38
@skmcgrail skmcgrail merged commit dd88f68 into main Jan 22, 2026
390 of 401 checks passed
@dependabot dependabot bot deleted the dependabot/pip/tests/ci/urllib3-2.6.3 branch January 22, 2026 22:00
@justsmth justsmth mentioned this pull request Feb 20, 2026
Merged
justsmth added a commit that referenced this pull request Feb 20, 2026
@justsmth
Prepare v1.68.0 (#3022)
0628190 
### Description of changes: 
* Bump urllib3 from 2.6.0 to 2.6.3 in /tests/ci by @dependabot[bot] in
#2932
* Add weekly automated check for outdated third-party test vectors by
@sgmenda in #2933
* Enable Hybrid PQ KeyShares by default by @alexw91 in
#2531
* Remove AVX conditional from cmake script by @torben-hansen in
#2958
* openssl-ca command implementation for self-sign certificates by
@skmcgrail in #2937
* Initial Framework for Using Doxygen to Document Public Header Files by
@m271828 in #2908
* Move md4 out of FIPS module by @torben-hansen in
#2956
* Fix image-build-windows workflow to only push on workflow_call and
workflow_dispatch by @skmcgrail in
#2961
* Remove FIPS counter framework and other tidying up by @torben-hansen
in #2947
* Model Device Farm CI Resources in CDK by @skmcgrail in
#2965
* Adds a new randomness generation API by @torben-hansen in
#2963
* Migrate Android Testing to GitHub Actions by @skmcgrail in
#2969
* Ensure pkcs7 checks ASN1_TYPE->type by @skmcgrail in
#2968
* Fix checkout logic for android-omnibus by @skmcgrail in
#2970
* Add missing env vars to check-vectors workflow step by @sgmenda in
#2962
* Shorten Windows Build Directory Path by @skmcgrail in
#2974
* Bump mysql cluster version by @WillChilds-Klein in
#2967
* Integrate Wycheproof ML-DSA test vectors by @sgmenda in
#2973
* Simplify FIPS conditional in top-level build script by @torben-hansen
in #2976
* Fix aws-lc-rs CI job by @justsmth in
#2966
* Add method to get type of ML-DSA instance configured under EVP PKEY by
@torben-hansen in #2980
* Nmap build needs liblinear by @justsmth in
#2985
* Disable SLP vectorizer for FIPS shared library builds on GCC 14+ by
@geedo0 in #2977
* Update Wycheproof ECDSA test vectors and fix workflow typo by @sgmenda
in #2972
* Address some CMake findings by @skmcgrail in
#2979
* Bump bytes from 1.7.1 to 1.11.1 in /tests/ci/lambda by
@dependabot[bot] in #2983
* Support GCC 4.8 for aarch64 by @justsmth in
#2964
* Free potential memory before assigning new pointer by @torben-hansen
in #2989
* Add PyOpenSSL integration test by @WillChilds-Klein in
#2992
* Ensure index argument is not negative in ASN1_BIT_STRING_set_bit by
@torben-hansen in #2987
* Ensure no overflow in signed output length in do_buf by @torben-hansen
in #2988
* Remove redundant CPython 3.9 integration test by @WillChilds-Klein in
#2996
* Ensure public key is set before verifying through ML-DSA verify by
@torben-hansen in #2990
* Correct CCM nids in object definition by @torben-hansen in
#2991
* Address Reported Bug Findings by @skmcgrail in
#3000
* Fix CI: gcc-4.8 by @justsmth in
#3011
* Fix Windows CI: use `cd /d` in run_windows_tests.bat to handle
cross-drive paths by @justsmth in
#3012
* Fix OPENSSL_memchr per C23 by @justsmth in
#3008
* Fix argument order in `hmac_copy` by @justsmth in
#3014
* Miscellaneous CI improvements by @skmcgrail in
#2978
* Fix CI: mariadb by @justsmth in
#3015
* Update Ubuntu 24:04 image compiler verification by @skmcgrail in
#3017
* Support WASM/Emscripten by @justsmth in
#2959
* Generate Rust Bindings by @justsmth in
#2999

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@skmcgrail skmcgrail skmcgrail approved these changes

@WillChilds-Klein WillChilds-Klein WillChilds-Klein approved these changes

@justsmth justsmth Awaiting requested review from justsmth

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@skmcgrail @WillChilds-Klein