Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 2, 2025

Bumps urllib3 from 2.2.3 to 2.5.0.

Release notes

Sourced from urllib3's releases.

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security issues

urllib3 2.5.0 fixes two moderate security issues:

Features

  • Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 for more information. (#3610)
  • Added support for version 0.5 of hatch-vcs (#3612)

Bugfixes

  • Raised exception for HTTPResponse.shutdown on a connection already released to the pool. (#3581)
  • Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. (#3615)

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

  • Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)
  • Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)
  • Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571)

Bugfixes

  • Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

Misc

  • Switched to uv for installing development dependecies. (#3550)
  • Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

2.3.0

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.5.0 (2025-06-18)

Features

  • Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 <https://peps.python.org/pep-0784/>_ for more information. ([#3610](https://github.com/urllib3/urllib3/issues/3610) <https://github.com/urllib3/urllib3/issues/3610>__)
  • Added support for version 0.5 of hatch-vcs ([#3612](https://github.com/urllib3/urllib3/issues/3612) <https://github.com/urllib3/urllib3/issues/3612>__)

Bugfixes

  • Fixed a security issue where restricting the maximum number of followed redirects at the urllib3.PoolManager level via the retries parameter did not work.
  • Made the Node.js runtime respect redirect parameters such as retries and redirects.
  • Raised exception for HTTPResponse.shutdown on a connection already released to the pool. ([#3581](https://github.com/urllib3/urllib3/issues/3581) <https://github.com/urllib3/urllib3/issues/3581>__)
  • Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. ([#3615](https://github.com/urllib3/urllib3/issues/3615) <https://github.com/urllib3/urllib3/issues/3615>__)

2.4.0 (2025-04-10)

Features

  • Applied PEP 639 by specifying the license fields in pyproject.toml. ([#3522](https://github.com/urllib3/urllib3/issues/3522) <https://github.com/urllib3/urllib3/issues/3522>__)
  • Updated exceptions to save and restore more properties during the pickle/serialization process. ([#3567](https://github.com/urllib3/urllib3/issues/3567) <https://github.com/urllib3/urllib3/issues/3567>__)
  • Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. ([#3571](https://github.com/urllib3/urllib3/issues/3571) <https://github.com/urllib3/urllib3/issues/3571>__)

Bugfixes

  • Fixed a bug with partial reads of streaming data in Emscripten. ([#3555](https://github.com/urllib3/urllib3/issues/3555) <https://github.com/urllib3/urllib3/issues/3555>__)

Misc

  • Switched to uv for installing development dependecies. ([#3550](https://github.com/urllib3/urllib3/issues/3550) <https://github.com/urllib3/urllib3/issues/3550>__)
  • Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. ([#3566](https://github.com/urllib3/urllib3/issues/3566) <https://github.com/urllib3/urllib3/issues/3566>__)

2.3.0 (2024-12-22)

... (truncated)

Commits
  • aaab4ec Release 2.5.0
  • 7eb4a2a Merge commit from fork
  • f05b132 Merge commit from fork
  • d03fe32 Fix HTTP tunneling with IPv6 in older Python versions
  • 11661e9 Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624)
  • 6a0ecc6 Update v2 migration guide to 2.4.0 (#3621)
  • 8e32e60 Raise exception for shutdown on a connection already released to the pool (#3...
  • 9996e0f Fix emscripten CI for Chrome 137+ (#3599)
  • 4fd1a99 Bump RECENT_DATE (#3617)
  • c4b5917 Add support for the new compression.zstd module in Python 3.14 (#3611)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.2.3 to 2.5.0.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.2.3...2.5.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.5.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 2, 2025
okorach and others added 24 commits October 20, 2025 12:25
* Exclude ruff rule D401

* Fix ruff report conversion to external issues format

* Fix conversion ruff to external issues

* Improvement

* Exclude silly ruff rules

* Fix close for loop

* Create fresh TESTSYNC before each tests

* Format shellcheck native JSON report

* Quality pass

* Exclude useless ruff rules

* Quality pass

* Fix ruff rule exclusions

* Quality pass

* Exclude shell from coverage calculation

* Quality pass

* Shell quality pass

* Quality pass

* Quality pass

* Quality pass

* Quality pass

* Quality pass

* Quality pass

* Quality pass

* Quality pass

* Quality pass

* Fix typo

* Quality pass

* Quality pass

* Update lock

* Quality pass
* Fix bug never encoutered yet

* Fix bug
* Fix bug

* Fix bug

* Fix TD

* Fix bug due to refactoring

* Disable rule R0913 covered by ruff

* Fix type hint

* Tune ruff analysis to not report type hints in python 3.10+ format

* Fix

* Quality pass

* Fix issue changelog count

* Remove unused import

* Add release date test

* Formatting

* fix exit code of sonar-tools-help

* Fix minimum version

* Fix migration build with toml file

* Add migration in package

* Fix pack (migration vs cli)

* Adjust issue counts after intro of ruff

* Fix sync export test

* Fix tests

* Fix tests

* Fix test now that no warning on sonar-tools
* Fixes #1991

* Quality pass

* Fix reset on 2025.2 and higher for autodetect ai

* Return false when setting an unsettable setting

* Add tests for custom settings

* Refactoring

* Add more test for standard settings

* Add docstring
* Adjust tests to CB

* Fixes #1996

* Add parameter format v1 or v2 to generate external issues report

* Fix issue type (always vuln)

* Adjust tests to 9.9

* Automatically detect 9.9 and set external issues format and scanner token param

* Fix search by severity problem when severities are different between MQR and Std

* Fix problem on filters on type of issues

* Move env is separate file

* unify scripts

* rename scan.sh

* Added env.sh

* Remove useless file

* Add determination of URL is 9.x

* Make linters to run configurable

* Fix python coverage and test paths that have to be relative

* Use class to update web hooks

* Quality pass

* Add Web hook create delete test

* Add one more test on refresh() after delete

* Update with test data

* Quality pass

* Quality pass
* Fixes #1989

* Quality pass
* Use run_scanner instead of scan

* Run linters before creating projects
* Remove requirements.txt

* Add build migration

* Fix docker build sonar-migration (add cli package)

* Remove setup files (replaced by poetry)

* Remove setup.py
* Add run_all everywhere

* Quality pass
* Fix bug

* Convert exceptions at the root

* Adjust to exceptions in platform

* Make gitlab groups a list setting

* Remove au lowercasing for API errors

* Adjust to exceptions in platform

* Allow new param as multi-valued

* Adjust to QG not found message

* Separate exception for HTTP and Connection Error

* Simplify import_zip excepton handling

* Disallowed to remove admin permission to the admin user

* Adjust exception handling

* Add illegal issue transition

* Add illegal issue transition

* Fix

* Raise IllegalIssueTransition

* Remove Illegal Issue Transition Exception

* Remove illegal issue err code

* Remove nolint option from the run_scanner call

* Formatting

* Fix key callection for object not found

* Handle ObjectNotFound for import_zip

* Remove exception handling in delete()

* Fixes on WebHook corner cases

* Add auto gen of unsupported operation for bad parameter value

* Remove ConnectionError, it's a type of RequestException

* Remove useless CLI parameters process

* Raise UnsupportedOperationw hen passing a wrong severity

* Verify exception when passing incorrect parameters

* Verify exception when import non existing project key

* Verify exception when webhook with too small secret string

* Handle update when reference portfolio already exists

* Remove exception handling (handled in Platform)

* Add exception handling for incorretc API param value

* Quality pass

* Add type hints

* Quality pass

* Quality pass

* Fix key retrieval in case of exception

* Add message to detect not found

* Refactoring

* Adjust to 9.9

* Adjust to 9.9

* Use poetry to install dependencies

* Fix run_linters

* Find ruff from python

* Remove python to ruff ruff

* Install deps before running linters

* Remove install before runninng linters

* Try to run linters in same env
* 2nd pass of exceptions refactoring

* Remove useless parens for walrus ops

* Formatting

* Remove unused imports and vars due to centralized exception handling

* Refactor

* New tests for branches

* Remove unused imports

* Clear cache when object not found

* More robust clear when object not found

* Better tests

* Use platform exception handling

* More centralized exception handling

* Quality pass

* Add docstring

* Quality pass

* Add more tests

* Add more tests

* Move Levenshtein distance calc in utilities

* Fix docstrings

* add test_exists()

* Formatting

* Small refactoring

* Fix get_findings()

* Add get_findings()

* Adjust test_exists() for CB

* Adjust test_rename() for variable main branch name

* Adjust test_request_error() for connection error

* Detect unsupported operation from unknown URL

* Adjust to variable main branch name

* Adjust to 9.9 that can't set main branch

* Remove non class get_object()

* Remove non class rule get_object()

* Remove noisy log

* Add cache class

* Add cache class

* Temporarily remove portfolio export test

* Clear caches after corrupting branches or projects

* Quality pass

* Change max issues in sonar-tools

* Add more tests

* Fix bug

* Fix test

* Fix tests sync

* Add branches to test project

* Formatting

---------

Co-authored-by: Olivier Korach <[email protected]>
@sonarqubecloud
Copy link

@okorach okorach merged commit f56211e into master Oct 20, 2025
3 checks passed
@okorach okorach deleted the dependabot/pip/urllib3-2.5.0 branch October 20, 2025 10:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants