From feb070a5edca38f76be3215f38c80131193dcb03 Mon Sep 17 00:00:00 2001 From: shuningc Date: Fri, 24 Jul 2026 13:09:33 -0700 Subject: [PATCH] fix(deps): bump urllib3 to 2.7.0 for VULN-88814 Remediate redirect-response decompression bomb when preload_content=False (fixed in 2.6.3). Lock-only bump; example pins set to 2.6.3. Co-authored-by: Cursor --- .../agent/minimal-agent-example/requirements.txt | 2 +- .../agent/startup-simulator-3000/requirements.txt | 2 +- examples/rag/cli-rag-demo/requirements.txt | 2 +- .../rag/elastic-chatbot-rag-app/requirements.txt | 2 +- poetry.lock | 12 ++++++------ 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/examples/agent/minimal-agent-example/requirements.txt b/examples/agent/minimal-agent-example/requirements.txt index 96a3cb3e..71d0c6ee 100644 --- a/examples/agent/minimal-agent-example/requirements.txt +++ b/examples/agent/minimal-agent-example/requirements.txt @@ -15,6 +15,6 @@ propcache==0.2.1 python-dateutil==2.9.0.post0 six==1.17.0 typing_extensions==4.12.2 -urllib3==2.3.0 +urllib3==2.6.3 yarl==1.18.3 python-dotenv>=1.0.0 diff --git a/examples/agent/startup-simulator-3000/requirements.txt b/examples/agent/startup-simulator-3000/requirements.txt index 1e42c2df..e0021f1a 100644 --- a/examples/agent/startup-simulator-3000/requirements.txt +++ b/examples/agent/startup-simulator-3000/requirements.txt @@ -47,7 +47,7 @@ tiktoken==0.9.0 tqdm==4.67.1 typing-extensions==4.14.0 typing-inspection==0.4.1 -urllib3==2.4.0 +urllib3==2.6.3 wrapt==1.17.2 xxhash==3.5.0 zstandard==0.23.0 diff --git a/examples/rag/cli-rag-demo/requirements.txt b/examples/rag/cli-rag-demo/requirements.txt index 7391207f..e4cfe82e 100644 --- a/examples/rag/cli-rag-demo/requirements.txt +++ b/examples/rag/cli-rag-demo/requirements.txt @@ -17,7 +17,7 @@ propcache==0.2.1 python-dateutil==2.9.0.post0 six==1.17.0 typing_extensions==4.12.2 -urllib3==2.3.0 +urllib3==2.6.3 yarl==1.18.3 faiss-cpu>=1.7.4 sentence-transformers>=2.5.1 diff --git a/examples/rag/elastic-chatbot-rag-app/requirements.txt b/examples/rag/elastic-chatbot-rag-app/requirements.txt index 2ca66798..87067c45 100644 --- a/examples/rag/elastic-chatbot-rag-app/requirements.txt +++ b/examples/rag/elastic-chatbot-rag-app/requirements.txt @@ -482,7 +482,7 @@ typing-inspect==0.9.0 # via dataclasses-json ujson==5.10.0 # via langtrace-python-sdk -urllib3==2.3.0 +urllib3==2.6.3 # via # botocore # elastic-transport diff --git a/poetry.lock b/poetry.lock index 84e8d17b..f348cac9 100644 --- a/poetry.lock +++ b/poetry.lock @@ -5583,22 +5583,22 @@ socks = ["PySocks (>=1.5.6,!=1.5.7,<2.0)"] [[package]] name = "urllib3" -version = "2.5.0" +version = "2.7.0" description = "HTTP library with thread-safe connection pooling, file post, and more." optional = false -python-versions = ">=3.9" +python-versions = ">=3.10" groups = ["main", "test"] markers = "platform_python_implementation != \"PyPy\"" files = [ - {file = "urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc"}, - {file = "urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760"}, + {file = "urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897"}, + {file = "urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c"}, ] [package.extras] -brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""] +brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""] h2 = ["h2 (>=4,<5)"] socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"] -zstd = ["zstandard (>=0.18.0)"] +zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [[package]] name = "uuid-utils"