From 8b606d9074fff980fd1e73786531503b30fb14da Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Tue, 26 May 2026 15:28:26 +0200 Subject: [PATCH] package/python-urllib3: security bump to version 2.7.0 Fixes the following security issues: CVE-2026-44431: Sensitive headers forwarded across origins in proxied low-level redirects https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc CVE-2026-44432: Decompression-bomb safeguards bypassed in parts of the streaming API https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j For more details, see the release notes: https://urllib3.readthedocs.io/en/stable/changelog.html#id1 Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- package/python-urllib3/python-urllib3.hash | 4 ++-- package/python-urllib3/python-urllib3.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-urllib3/python-urllib3.hash b/package/python-urllib3/python-urllib3.hash index 858b8ca3a3..92425d125b 100644 --- a/package/python-urllib3/python-urllib3.hash +++ b/package/python-urllib3/python-urllib3.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/urllib3/json -md5 2c381874816fe551f50a2551abae62b3 urllib3-2.6.3.tar.gz -sha256 1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed urllib3-2.6.3.tar.gz +md5 e79707b798a66c8165c9c441440f4e80 urllib3-2.7.0.tar.gz +sha256 231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c urllib3-2.7.0.tar.gz # Locally computed sha256 checksums sha256 130e3a64d5fdd5d096a752694634a7d9df284469de86e5732100268041e3d686 LICENSE.txt diff --git a/package/python-urllib3/python-urllib3.mk b/package/python-urllib3/python-urllib3.mk index 7f7f0b03d2..8e598818a1 100644 --- a/package/python-urllib3/python-urllib3.mk +++ b/package/python-urllib3/python-urllib3.mk @@ -4,9 +4,9 @@ # ################################################################################ -PYTHON_URLLIB3_VERSION = 2.6.3 +PYTHON_URLLIB3_VERSION = 2.7.0 PYTHON_URLLIB3_SOURCE = urllib3-$(PYTHON_URLLIB3_VERSION).tar.gz -PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3 +PYTHON_URLLIB3_SITE = https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953 PYTHON_URLLIB3_LICENSE = MIT PYTHON_URLLIB3_LICENSE_FILES = LICENSE.txt PYTHON_URLLIB3_CPE_ID_VENDOR = python