From 888beb6c4493cb9d23958a8c1fb8b80e87d899aa Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Mon, 19 Jan 2026 11:38:08 +0100 Subject: [PATCH] package/python-urllib3: security bump to version 2.6.3 Release notes: https://github.com/urllib3/urllib3/releases/tag/2.6.3 Fixes the following vulnerability: CVE-2026-21441: Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99 Signed-off-by: Peter Korsgaard [Julien: add link to release notes] Signed-off-by: Julien Olivain --- package/python-urllib3/python-urllib3.hash | 4 ++-- package/python-urllib3/python-urllib3.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-urllib3/python-urllib3.hash b/package/python-urllib3/python-urllib3.hash index 76fe4e5fc9..858b8ca3a3 100644 --- a/package/python-urllib3/python-urllib3.hash +++ b/package/python-urllib3/python-urllib3.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/urllib3/json -md5 838e0ffee00ec870a3ba6727a7832ab8 urllib3-2.6.2.tar.gz -sha256 016f9c98bb7e98085cb2b4b17b87d2c702975664e4f060c6532e64d1c1a5e797 urllib3-2.6.2.tar.gz +md5 2c381874816fe551f50a2551abae62b3 urllib3-2.6.3.tar.gz +sha256 1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed urllib3-2.6.3.tar.gz # Locally computed sha256 checksums sha256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686 LICENSE.txt diff --git a/package/python-urllib3/python-urllib3.mk b/package/python-urllib3/python-urllib3.mk index d57473566b..7f7f0b03d2 100644 --- a/package/python-urllib3/python-urllib3.mk +++ b/package/python-urllib3/python-urllib3.mk @@ -4,9 +4,9 @@ # ################################################################################ -PYTHON_URLLIB3_VERSION = 2.6.2 +PYTHON_URLLIB3_VERSION = 2.6.3 PYTHON_URLLIB3_SOURCE = urllib3-$(PYTHON_URLLIB3_VERSION).tar.gz -PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/1e/24/a2a2ed9addd907787d7aa0355ba36a6cadf1768b934c652ea78acbd59dcd +PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3 PYTHON_URLLIB3_LICENSE = MIT PYTHON_URLLIB3_LICENSE_FILES = LICENSE.txt PYTHON_URLLIB3_CPE_ID_VENDOR = python