#3355 Bump urllib3 from 2.2.3 to 2.6.0 in /plugins/flytekit-airflow Pull request opened by dependabot[bot] Bumps urllib3 from 2.2.3 to 2.6.0. Release notes Sourced from urllib3's releases.

## 2.6.0

## 🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

## Security

• Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471 reported by `@​Cycloctane`, 8.9 High, GHSA-2xpw-w6gg-jr37)

• Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the

Content-Encoding

header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418 reported by `@​illia-v`, 8.9 High, GHSA-gm62-xv2j-4w53)

> [!IMPORTANT]

>

> • If urllib3 is not installed with the optional

urllib3[brotli]

extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using

urllib3[brotli]

to install a compatible Brotli package automatically.

> • If you use custom decompressors, please make sure to update them to respect the changed API of

urllib3.response.ContentDecoder

.

## Features

• Enabled retrieval, deletion, and membership testing in

HTTPHeaderDict

using bytes keys. (#3653)

• Added host and port information to string representations of

HTTPConnection

. (#3666)

• Added support for Python 3.14 free-threading builds explicitly. (#3696)

## Removals

• Removed the

HTTPResponse.getheaders()

method in favor of

HTTPResponse.headers

. Removed the

HTTPResponse.getheader(name, default)

method in favor of

HTTPResponse.headers.get(name, default)

. (#3622)

## Bugfixes

• Fixed redirect handling in

urllib3.PoolManager

when an integer is passed for the retries parameter. (#3649)

• Fixed

HTTPConnectionPool

when used in Emscripten with no explicit port. (#3664)

• Fixed handling of

SSLKEYLOGFILE

with expandable variables. (#3700)

## Misc

• Changed the

zstd

extra to install

backports.zstd

instead of

zstandard

on Python 3.13 and before. (#3693)

• Improved the performance of content decoding by optimizing

BytesQueueBuffer

class. (#3710)

• Allowed building the urllib3 package with newer setuptools-scm v9.x. (#3652)

• Ensured successful urllib3 builds by setting Hatchling requirement to ≥ 1.27.0. (#3638)

## 2.5.0

## 🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

... (truncated) Changelog Sourced from urllib3's changelog.

# 2.6.0 (2025-12-05)

## Security

• Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (`GHSA-2xpw-w6gg-jr37 https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37`__)

• Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the

Content-Encoding

header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (`GHSA-gm62-xv2j-4w53 https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53`__)

.. caution::

• If urllib3 is not installed with the optional

urllib3[brotli]

extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using`urllib3[brotli]` to install a compatible Brotli package automatically.

• If you use custom decompressors, please make sure to update them to respect the changed API of

urllib3.response.ContentDecoder

.

## Features

• Enabled retrieval, deletion, and membership testing in

HTTPHeaderDict

using bytes keys. (`[#3653](https://github.com/urllib3/urllib3/issues/3653) https://github.com/urllib3/urllib3/issues/3653`__)

• Added host and port information to string representations of

HTTPConnection

. (`[#3666](https://github.com/urllib3/urllib3/issues/3666) https://github.com/urllib3/urllib3/issues/3666`__)

• Added support for Python 3.14 free-threading builds explicitly. (`[#3696](https://github.com/urllib3/urllib3/issues/3696) https://github.com/urllib3/urllib3/issues/3696`__)

## Removals

• Removed the

HTTPResponse.getheaders()

method in favor of

HTTPResponse.headers

. Removed the

HTTPResponse.getheader(name, default)

method in favor of

HTTPResponse.headers.get(name, default)

. (`[#3622](https://github.com/urllib3/urllib3/issues/3622) https://github.com/urllib3/urllib3/issues/3622`__)

## Bugfixes

• Fixed redirect handling in

urllib3.PoolManager

when an integer is passed for the retries parameter. (`[#3649](https://github.com/urllib3/urllib3/issues/3649) https://github.com/urllib3/urllib3/issues/3649`__)

• Fixed

HTTPConnectionPool

when used in Emscripten with no explicit port. (`[#3664](https://github.com/urllib3/urllib3/issues/3664) <https://github.c…

flyteorg/flytekit