Constrain urllib3 to urllib3>=2.6.0 to address two CVEs

[lawrence-u10d]

Constrain urllib3 to urllib3>=2.6.0 to address CVE-2025-66471 and CVE-2025-66418

---

Note

Addresses security vulnerabilities and updates packaging metadata.

• Constrains urllib3 to >=2.6.0 (resolved to 2.6.2) via new requirements/constraints.in; updates base.txt, dev.txt, and test.txt accordingly
• Bumps package version to 1.1.4 and updates CHANGELOG.md with CVE references (CVE-2025-66471, CVE-2025-66418)
• Raises supported Python to >=3.10 in setup.py and updates classifiers; regen requirements with uv ... --python-version 3.10

^{Written by Cursor Bugbot for commit 95f7faa. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​urllib3@​2.5.0 ⏵ 2.6.2	+1	+22
	pypi/​zipp@​3.23.0
	pypi/​importlib-metadata@​8.7.1

View full report