From f9432c4ad07e825d095f4fc0f5982a9eb1edd782 Mon Sep 17 00:00:00 2001 From: katsugtgz Date: Tue, 29 Sep 2026 00:16:07 +0700 Subject: [PATCH 1/2] Update urllib3 to 2.7.0 to address security advisories urllib3 2.2.2 is affected by 12 OSV advisories (GHSA-pq67-6m6q-mj2v, GHSA-qccp-gfcp-xxvc, GHSA-gm62-xv2j-4w53, GHSA-48p4-8xcf-vxj5, GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, PYSEC-2026-141, PYSEC-2026-1994/1996/1997/1998/1999). 2.7.0 is the lowest version with zero OSV advisories. Scope: requirements.txt pin only. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 336ef541256..fa5055f2176 100644 --- a/requirements.txt +++ b/requirements.txt @@ -40,7 +40,7 @@ requests==2.32.3 setuptools==75.6.0 six==1.16.0 soupsieve==2.6 -urllib3==2.2.2 +urllib3==2.7.0 virtualenv==20.26.3 watchdog==4.0.2 markdown-grid-tables==0.4.0 From 29c56b38e7304ceadbbbf46a7b24405cf063d1b1 Mon Sep 17 00:00:00 2001 From: katsugtgz Date: Thu, 1 Oct 2026 13:31:49 +0700 Subject: [PATCH 2/2] Update urllib3 to 2.8.0 2.7.0 is affected by GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g, and GHSA-vxq7-64xx-v4gw, published after the original bump. 2.8.0 clears all three per OSV. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index fa5055f2176..dfd7608421f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -40,7 +40,7 @@ requests==2.32.3 setuptools==75.6.0 six==1.16.0 soupsieve==2.6 -urllib3==2.7.0 +urllib3==2.8.0 virtualenv==20.26.3 watchdog==4.0.2 markdown-grid-tables==0.4.0