Title: build(deps): bump urllib3 from 1.26.18 to 2.6.0 in /examples/bzlmod by dependabot[bot] · Pull Request #8 · JetBrains/rules_python · GitHub
Open Graph Title: build(deps): bump urllib3 from 1.26.18 to 2.6.0 in /examples/bzlmod by dependabot[bot] · Pull Request #8 · JetBrains/rules_python
X Title: build(deps): bump urllib3 from 1.26.18 to 2.6.0 in /examples/bzlmod by dependabot[bot] · Pull Request #8 · JetBrains/rules_python
Description: Bumps urllib3 from 1.26.18 to 2.6.0.
Release notes
Sourced from urllib3's releases.
2.6.0
🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security
Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471 reported by @Cycloctane, 8.9 High, GHSA-2xpw-w6gg-jr37)
Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the Content-Encoding header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418 reported by @illia-v, 8.9 High, GHSA-gm62-xv2j-4w53)
[!IMPORTANT]
If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using urllib3[brotli] to install a compatible Brotli package automatically.
If you use custom decompressors, please make sure to update them to respect the changed API of urllib3.response.ContentDecoder.
Features
Enabled retrieval, deletion, and membership testing in HTTPHeaderDict using bytes keys. (#3653)
Added host and port information to string representations of HTTPConnection. (#3666)
Added support for Python 3.14 free-threading builds explicitly. (#3696)
Removals
Removed the HTTPResponse.getheaders() method in favor of HTTPResponse.headers. Removed the HTTPResponse.getheader(name, default) method in favor of HTTPResponse.headers.get(name, default). (#3622)
Bugfixes
Fixed redirect handling in urllib3.PoolManager when an integer is passed for the retries parameter. (#3649)
Fixed HTTPConnectionPool when used in Emscripten with no explicit port. (#3664)
Fixed handling of SSLKEYLOGFILE with expandable variables. (#3700)
Misc
Changed the zstd extra to install backports.zstd instead of zstandard on Python 3.13 and before. (#3693)
Improved the performance of content decoding by optimizing BytesQueueBuffer class. (#3710)
Allowed building the urllib3 package with newer setuptools-scm v9.x. (#3652)
Ensured successful urllib3 builds by setting Hatchling requirement to ≥ 1.27.0. (#3638)
2.5.0
🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
... (truncated)
Changelog
Sourced from urllib3's changelog.
2.6.0 (2025-12-05)
Security
Fixed a security issue where streaming API could improperly handle highly
compressed HTTP content ("decompression bombs") leading to excessive resource
consumption even when a small amount of data was requested. Reading small
chunks of compressed data is safer and much more efficient now.
(GHSA-2xpw-w6gg-jr37
Open Graph Description: Bumps urllib3 from 1.26.18 to 2.6.0. Release notes Sourced from urllib3's releases. 2.6.0 🚀 urllib3 is fundraising for HTTP/2 support urllib3 is raising ~$40,000 USD to release HTTP/2 support...
X Description: Bumps urllib3 from 1.26.18 to 2.6.0. Release notes Sourced from urllib3's releases. 2.6.0 🚀 urllib3 is fundraising for HTTP/2 support urllib3 is raising ~$40,000 USD to release HTTP/2 sup...
Opengraph URL: https://github.com/JetBrains/rules_python/pull/8
X: @github
Domain: patch-diff.githubusercontent.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:e45746ff-2759-94d2-3896-eb4cbadc9e45 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 8DD2:89F46:F366D0:13AF9C9:69929C2D |
| html-safe-nonce | 39aa18c96d49174a51f5ad88eda8162fb59a17c41900660868c81f6d33b8d983 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI4REQyOjg5RjQ2OkYzNjZEMDoxM0FGOUM5OjY5OTI5QzJEIiwidmlzaXRvcl9pZCI6IjI0ODU0MjA2NDQ1MTIyMDk5NjUiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 9750179aaca1153fb6974d3090e0f23343cc8de5549052bbf6f0a1409b42e7d4 |
| hovercard-subject-tag | pull_request:3076540298 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/JetBrains/rules_python/pull/8/files |
| twitter:image | https://avatars.githubusercontent.com/in/29110?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/in/29110?s=400&v=4 |
| og:image:alt | Bumps urllib3 from 1.26.18 to 2.6.0. Release notes Sourced from urllib3's releases. 2.6.0 🚀 urllib3 is fundraising for HTTP/2 support urllib3 is raising ~$40,000 USD to release HTTP/2 support... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 42c603b9d642c4a9065a51770f75e5e27132fef0e858607f5c9cb7e422831a7b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/JetBrains/rules_python git https://github.com/JetBrains/rules_python.git |
| octolytics-dimension-user_id | 878437 |
| octolytics-dimension-user_login | JetBrains |
| octolytics-dimension-repository_id | 1011875810 |
| octolytics-dimension-repository_nwo | JetBrains/rules_python |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | true |
| octolytics-dimension-repository_parent_id | 101780532 |
| octolytics-dimension-repository_parent_nwo | bazel-contrib/rules_python |
| octolytics-dimension-repository_network_root_id | 101780532 |
| octolytics-dimension-repository_network_root_nwo | bazel-contrib/rules_python |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 848bc6032dcc93a9a7301dcc3f379a72ba13b96e |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width