Skip to content

[Snyk] Security upgrade urllib3 from 1.26.20 to 2.6.3 #526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
madisonmay wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade urllib3 from 1.26.20 to 2.6.3 #526

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions smoketests/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,4 @@ arnparse==0.0.2
slack_sdk==3.22.0
python-hcl2==4.3.1
pre-commit>=3.5.0
urllib3>=2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid urllib3 pin that conflicts with botocore

In smoketests/requirements.txt you now require urllib3>=2.6.3, but botocore==1.31.67 (and thus boto3==1.28.57) declares urllib3<2.0, so this makes the dependency set unsatisfiable and pip install -r requirements.txt (run during the smoketests image build in smoketests/Dockerfile) will fail with a resolver error. This only occurs in environments that build the smoketests container or install these requirements, but it will block those workflows unless you also bump botocore/boto3 to versions compatible with urllib3 2.x or relax the urllib3 floor.

Useful? React with 👍 / 👎.

Copy link

@cursor cursor bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

urllib3 2.6.3 incompatible with pinned botocore version

High Severity

The pinned botocore==1.31.67 has version constraints on urllib3 that likely don't allow version 2.6.3. Older botocore versions from late 2023 typically required urllib3<2.1 or similar upper bounds. The Snyk warning in the PR description confirms this conflict: "botocore 1.31.67 requires urllib3, which is not installed." This creates a dependency conflict that would cause pip installation failures or runtime issues with the AWS SDK (boto3/botocore). Either botocore needs to be upgraded to a version that supports urllib3 2.x, or this urllib3 upgrade cannot be applied.

Additional Locations (1)

Fix in Cursor Fix in Web

Loading