#3281 Bump urllib3 from 2.0.7 to 2.5.0 in /plugins/flytekit-onnx-pytorch Pull request opened by dependabot[bot] Bumps urllib3 from 2.0.7 to 2.5.0. Release notes Sourced from urllib3's releases.

## 2.5.0

## 🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

# Security issues

urllib3 2.5.0 fixes two moderate security issues:

• Pool managers now properly control redirects when

retries

is passed — CVE-2025-50181 reported by `@​sandumjacob` (5.3 Medium, GHSA-pq67-6m6q-mj2v)

• Redirects are now controlled by urllib3 in the Node.js runtime — CVE-2025-50182 (5.3 Medium, GHSA-48p4-8xcf-vxj5)

# Features

• Added support for the

compression.zstd

module that is new in Python 3.14. See PEP 784 for more information. (#3610)

• Added support for version 0.5 of

hatch-vcs

(#3612)

# Bugfixes

• Raised exception for

HTTPResponse.shutdown

on a connection already released to the pool. (#3581)

• Fixed incorrect

CONNECT

statement when using an IPv6 proxy with

connection_from_host

. Previously would not be wrapped in

[]

. (#3615)

## 2.4.0

## 🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

# Features

• Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)

• Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)

• Added

verify_flags

option to

create_urllib3_context

with a default of

VERIFY_X509_PARTIAL_CHAIN

and

VERIFY_X509_STRICT

for Python 3.13+. (#3571)

# Bugfixes

• Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

# Misc

• Switched to uv for installing development dependecies. (#3550)

• Removed the

multiple.intoto.jsonl

asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

## 2.3.0

... (truncated) Changelog Sourced from urllib3's changelog.

# 2.5.0 (2025-06-18)

## Features

• Added support for the

compression.zstd

module that is new in Python 3.14. See `PEP 784 https://peps.python.org/pep-0784/`_ for more information. (`[#3610](https://github.com/urllib3/urllib3/issues/3610) https://github.com/urllib3/urllib3/issues/3610`__)

• Added support for version 0.5 of

hatch-vcs

(`[#3612](https://github.com/urllib3/urllib3/issues/3612) https://github.com/urllib3/urllib3/issues/3612`__)

## Bugfixes

• Fixed a security issue where restricting the maximum number of followed redirects at the

urllib3.PoolManager

level via the

retries

parameter did not work.

• Made the Node.js runtime respect redirect parameters such as `retries`and

redirects

.

• Raised exception for

HTTPResponse.shutdown

on a connection already released to the pool. (`[#3581](https://github.com/urllib3/urllib3/issues/3581) https://github.com/urllib3/urllib3/issues/3581`__)

• Fixed incorrect

CONNECT

statement when using an IPv6 proxy with

connection_from_host

. Previously would not be wrapped in

[]

. (`[#3615](https://github.com/urllib3/urllib3/issues/3615) https://github.com/urllib3/urllib3/issues/3615`__)

# 2.4.0 (2025-04-10)

## Features

• Applied PEP 639 by specifying the license fields in pyproject.toml. (`[#3522](https://github.com/urllib3/urllib3/issues/3522) https://github.com/urllib3/urllib3/issues/3522`__)

• Updated exceptions to save and restore more properties during the pickle/serialization process. (`[#3567](https://github.com/urllib3/urllib3/issues/3567) https://github.com/urllib3/urllib3/issues/3567`__)

• Added

verify_flags

option to

create_urllib3_context

with a default of

VERIFY_X509_PARTIAL_CHAIN

and

VERIFY_X509_STRICT

for Python 3.13+. (`[#3571](https://github.com/urllib3/urllib3/issues/3571) https://github.com/urllib3/urllib3/issues/3571`__)

## Bugfixes

• Fixed a bug with partial reads of streaming data in Emscripten. (`[#3555](https://github.com/urllib3/urllib3/issues/3555) https://github.com/urllib3/urllib3/issues/3555`__)

## Misc

• Switched to uv for installing development dependecies. (`[#3550](https://github.com/urllib3/urllib3/issues/3550) https://github.com/urllib3/urllib3/issues/3550`__)

• Removed the

multiple.intoto.jsonl

asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (`[#3566](https://github.com/urllib3/urllib3/issues/3566) https://github.com/urllib3/urllib3/issues/3566`__)

# 2.3.0 (2024-12-22)

... (truncated) Commits • `aaab4ec` Release 2.5.0 • `7eb4a2a` Merge commit from fork • `f05b132` Merge commit from fork • `d03fe32` Fix HTTP tunneling with IPv6 in older Python versions • `11661e9` Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624) • `6a0ecc6` Update v2 migration guide to 2.4.0 (#3621) • `8e32e60` Raise exception for shutdown on a connection already released to the pool (<https://redirect.github.com/urllib3/urllib3/issu… flyteorg/flytekit