fix(deps): bump urllib3 to 2.7.0 (VULN-88814)

[shuningc]

Summary

• Remediate VULN-88814: redirect bodies decompressed on streaming API despite preload_content=False (fixed in 2.6.3).
• poetry.lock: urllib3 2.5.0 → 2.7.0 (CPython; no pyproject change).
• Example pins → urllib3==2.6.3; langgraph example lock → 2.7.0.

Notes

• urllib3 1.26.20 remains in lock for PyPy-only marker (vcrpy<2 constraint); CI uses CPython.

Test plan

• poetry check
• Installed urllib3 2.7.0; poetry run pytest tests/ (1995 passed, 4 skipped)

Jira

VULN-88814

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal security bump (5 files, dependency pins only). One item to confirm before merging, two optional nits below.

---

P2 — urllib3 2.7.0 raises Python floor to >=3.10 (Claude Code)

File/Section: poetry.lock (urllib3 entry)
Issue: urllib3 2.7.0 drops Python 3.9 support — python-versions moves from >=3.9 to >=3.10. The example requirements files stay on 2.6.3 (which still supports 3.9), but the main lockfile jumps to 2.7.0. If the project still supports Python 3.9, the resolver would fail or behave unexpectedly on 3.9 environments.
Evidence: Diff shows -python-versions = ">=3.9" → +python-versions = ">=3.10" in the urllib3 lock entry.
Recommended fix: Confirmed non-blocking — project requires python = "^3.11,<3.15" which already satisfies the new floor. No action needed, but worth noting in the PR description.

---

P3 — Version drift between lockfile (2.7.0) and example pins (2.6.3) (Claude Code)

File/Section: poetry.lock vs examples/*/requirements.txt
Issue: Main lockfile resolves urllib3 to 2.7.0, but four example requirements files pin to 2.6.3. Both are past the VULN-88814 fix boundary, so no security concern — but the split could cause confusion during future audits or reproducibility investigations.
Evidence: poetry.lock: version = "2.7.0"; four example requirements.txt files: urllib3==2.6.3.
Recommended fix: Optional — align all example pins to 2.7.0, or add a brief PR note explaining the intentional split.

---

P3 — zstd extra switches backing library from zstandard to backports-zstd (Claude Code)

File/Section: poetry.lock (urllib3 extras)
Issue: urllib3's zstd extra now uses backports-zstd (>=1.0.0) instead of zstandard (>=0.18.0) for Python <3.14. Anyone using urllib3[zstd] will pull a different library. Low-risk if this project doesn't use that extra.
Evidence: Diff: -zstd = ["zstandard (>=0.18.0)"] → +zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""].
Recommended fix: Grep for urllib3[zstd] usage; if unused, no action needed.

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Python floor change, version drift, zstd extra backing-library swap