Bump urllib3 to 2.6.3 to fix CVE-2026-21441

claude · claude · commit 7c304eb777c3 · 2026-04-30T08:58:03.000Z
Vulnerable range: &gt;= 1.22, &lt; 2.6.3. Minimum patched version is 2.6.3.
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -37,7 +37,7 @@ requests = ">2.32.4"
 pyyaml = "6.0.1"
 typing-extensions = "4.6.0"
 idna = "3.7"
-urllib3 = "^2.6.2"
+urllib3 = "^2.6.3"
 setuptools = "^80.9.0"
 zipp = "^3.19.1"
 tenacity = "^9.0.0"
diff --git a/requirements.txt b/requirements.txt
@@ -50,7 +50,7 @@ typer==0.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
 typing-extensions==4.6.0 ; python_version >= "3.10" and python_full_version < "3.13"
 tzdata==2024.1 ; python_version >= "3.10" and python_full_version < "3.13"
 tzlocal==5.2 ; python_version >= "3.10" and python_full_version < "3.13"
-urllib3==2.6.2 ; python_version >= "3.10" and python_full_version < "3.13"
+urllib3==2.6.3 ; python_version >= "3.10" and python_full_version < "3.13"
 websocket-client==1.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
 zipp==3.20.2 ; python_version >= "3.10" and python_full_version < "3.13"
 # required for tests
