Skip to content

LCORE-1082: Bump-up urllib3 to 2.5.0 #883

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tisnik merged 2 commits into from
Dec 9, 2025
Merged

LCORE-1082: Bump-up urllib3 to 2.5.0 #883

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
be2efb0
LCORE-1082: Bump-up urllib3 to 2.5.0
tisnik Dec 9, 2025
0d447d1
Updated deplist
tisnik Dec 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ dependencies = [
"jsonpath-ng>=1.6.1",
"psycopg2-binary>=2.9.10",
"litellm>=1.75.5.post1",
"urllib3==2.5.0",
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

urllib3 2.5.0 release security vulnerabilities

💡 Result:

Short answer: urllib3 2.5.0 fixed two moderate redirect-related issues (CVE-2025-50181 and CVE-2025-50182) but versions <2.6.0 (including 2.5.0) remain affected by an excessive-resource / chained Content-Encoding vulnerability (CVE-2025-66418). Upgrade guidance: upgrade to >=2.5.0 to get the redirect fixes, and to >=2.6.0 (or a version that lists CVE-2025-66418 as fixed) to remediate the compression chain resource issue.

Sources:

  • urllib3 2.5.0 release notes (lists the two security fixes). [1]
  • NVD / security advisories for CVE-2025-50181 / CVE-2025-50182 (redirect/SSR F / Pyodide issues). [2][3]
  • CVE-2025-66418 (excessive resource consumption via chained Content-Encoding; affects >=1.24, <2.6.0). [4]

References:
[1] GitHub — urllib3 releases: 2.5.0.
[2] NVD — CVE-2025-50181 / CVE-2025-50182.
[3] Snyk advisory (CVE-2025-50181).
[4] ResolvedSecurity / CVE-2025-66418 entry.

Upgrade urllib3 to 2.6.0 or later to close open CVE.

Version 2.5.0 fixes CVE-2025-50181 and CVE-2025-50182 (redirect-related issues), but remains vulnerable to CVE-2025-66418 (excessive resource consumption via chained Content-Encoding, affecting all versions <2.6.0). For a CVE-fix PR, pin to 2.6.0 or a newer version that fully remediates all known vulnerabilities, or explicitly document why the intermediate version is chosen despite the unpatched CVE.

🤖 Prompt for AI Agents 
In pyproject.toml around line 55, the urllib3 pin is set to 2.5.0 which remains
vulnerable to CVE-2025-66418; update the dependency spec to pin urllib3 to 2.6.0
or later (for example "urllib3>=2.6.0,<3.0") in the dependencies section to
ensure the CVE is remediated, and if you intentionally keep 2.5.0 for
compatibility, add a clear comment in the file explaining the rationale and an
action to upgrade as soon as compatibility is resolved.

]


Expand Down
17 changes: 10 additions & 7 deletions requirements.aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1381,9 +1381,9 @@ kiwisolver==1.4.9 \
--hash=sha256:fb940820c63a9590d31d88b815e7a3aa5915cad3ce735ab45f0c730b39547de1 \
--hash=sha256:fc1795ac5cd0510207482c3d1d3ed781143383b8cfd36f5c645f3897ce066220
# via matplotlib
kubernetes==34.1.0 \
--hash=sha256:8fe8edb0b5d290a2f3ac06596b23f87c658977d46b5f8df9d0f4ea83d0003912 \
--hash=sha256:bffba2272534e224e6a7a74d582deb0b545b7c9879d2cd9e4aae9481d1f2cc2a
kubernetes==33.1.0 \
--hash=sha256:544de42b24b64287f7e0aa9513c93cb503f7f40eea39b20f66810011a86eabc5 \
--hash=sha256:f64d829843a54c251061a8e7a14523b521f2dc5c896cf6d65ccf348648a88993
# via lightspeed-stack (pyproject.toml)
langdetect==1.0.9 \
--hash=sha256:7cbc0746252f19e76f77c0b1690aadf01963be835ef0cd4b56dddf2a8f1dfc2a \
Expand Down Expand Up @@ -1959,7 +1959,9 @@ numpy==2.2.6 \
oauthlib==3.3.1 \
--hash=sha256:0f0f8aa759826a193cf66c12ea1af1637f87b9b4622d46e866952bb022e538c9 \
--hash=sha256:88119c938d2b8fb88561af5f6ee0eec8cc8d552b7bb1f712743136eb7523b7a1
# via requests-oauthlib
# via
# kubernetes
# requests-oauthlib
openai==2.9.0 \
--hash=sha256:0d168a490fbb45630ad508a6f3022013c155a68fd708069b6a1a01a5e8f0ffad \
--hash=sha256:b52ec65727fc8f1eed2fbc86c8eac0998900c7ef63aa2eb5c24b69717c56fa5f
Expand Down Expand Up @@ -3569,10 +3571,11 @@ tzdata==2025.2 \
--hash=sha256:1a403fada01ff9221ca8044d701868fa132215d84beb92242d9acd2147f667a8 \
--hash=sha256:b60a638fcc0daffadf82fe0f57e53d06bdec2f36c4df66280ae79bce6bd6f2b9
# via pandas
urllib3==2.3.0 \
--hash=sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df \
--hash=sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d
urllib3==2.5.0 \
--hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
--hash=sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc
Comment on lines +3574 to +3576
Copy link
Contributor

@coderabbitai coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, check the current state of the codebase for pyproject.toml and requirements files
git ls-files | grep -E "(pyproject\.toml|requirements|setup\.py)" | head -20

Repository: lightspeed-core/lightspeed-stack

Length of output: 208

🏁 Script executed:

# Search for existing urllib3 version constraints in the repo
rg "urllib3" --type-list
rg "urllib3" -t py -t txt -t toml -t yaml -t ini | head -30

Repository: lightspeed-core/lightspeed-stack

Length of output: 208

🏁 Script executed:

# Check if there are any comments or discussions about urllib3 2.6.0 in the codebase
rg "2\.6\.0|2\.6|get_headers" -t py -t txt -t md

Repository: lightspeed-core/lightspeed-stack

Length of output: 208

🌐 Web query:

urllib3 2.6.0 breaking changes API removals what deprecated in 2.0

💡 Result:

Short summary.

  • urllib3 2.6.0 (breaking/removal): HTTPResponse.getheaders() and HTTPResponse.getheader(name, default) were removed (use HTTPResponse.headers / HTTPResponse.headers.get()). Security fixes limit chained content-encodings and harden compressed-stream handling; custom ContentDecoder API changed (update custom decompressors). Other small features/behavior fixes listed in the 2.6.0 changelog. [1]

  • What was deprecated in the 2.0 series (and intended for removal in later 2.x releases): HTTPResponse.getheaders()/getheader(); urllib3.contrib.pyopenssl and urllib3.contrib.securetransport modules; the urllib3[secure] extra; ssl_version option (use ssl_minimum_version); PoolManager.connection_from_context(strict) parameter; NewConnectionError.pool attribute; format_header_param_html5/format_header_param (use format_multipart_header_param); RequestField.header_formatter; HTTPSConnection.set_cert(); HTTPConnection.request_chunked(); plus other compatibility removals (Python ≤3.6, non‑OpenSSL TLS libs, fallback commonName hostname checks, default cipher list, etc.). See the v2.0 migration notes for the full list. [2]

Sources:
[1] urllib3 2.6.0 changelog.
[2] urllib3 v2.0 migration / changelog (deprecations & removals).

🌐 Web query:

kubernetes-client urllib3 compatibility 2.5.0 2.6.0

💡 Result:

Short answer: The official kubernetes-client (python) has historically been pinned to urllib3 <2.4.0 and there are open/recent issues showing incompatibilities with urllib3 2.4+ (so 2.5.0 / 2.6.0 are not yet universally supported). See the repo issues reporting breakage with urllib3 v2.4.0 and ongoing vulnerability/packaging discussions. [1][2][3]

What to do:

  • If you need stability, keep urllib3 at a version the kubernetes package currently accepts (i.e., <2.4.0) until the client releases an update. [1][2]
  • If you must run urllib3 2.5.0/2.6.0, test thoroughly (SSL/EKS edge-cases were reported) and watch the kubernetes-client PRs/issues for an official update. [2][3]

Sources:

  • kubernetes-client/python issue: urllib3 v2.4.0 on Python 3.13 doesn't work with EKS. [1]
  • kubernetes-client/python issues about urllib3 pinning and packaging. [2]
  • urllib3 changelog (2.5.0 & 2.6.0 releases). [3]

urllib3 → 2.5.0: incompatible with the pinned kubernetes-client; requires thorough testing.

  • urllib3 2.5.0 is compatible with Requests 2.32.5 (Requests has supported urllib3 2.x since 2.30.0).
  • Critical issue: kubernetes-client is historically pinned to urllib3 <2.4.0 and has reported incompatibilities with urllib3 2.4.0+ (including 2.5.0), particularly with EKS integrations. Before merging, verify that kubernetes and related integrations actually work with 2.5.0 or update the kubernetes-client version to one that officially supports it.
  • If this change has been tested with the full kubernetes client, confirm findings in the PR description. If not tested, run a quick import and EKS smoke test before merging.
🤖 Prompt for AI Agents 
In requirements.aarch64.txt around lines 3574-3576, urllib3 was pinned to 2.5.0
which is known to be incompatible with many kubernetes-client versions (they
require urllib3 <2.4.0); either change the urllib3 pin to a compatible <2.4.0
version or upgrade the kubernetes-client dependency to a release that explicitly
supports urllib3 2.5.0, then run a quick verification (import the kubernetes
client, run an EKS smoke test and CI dependency tests) and document the test
results in the PR description so we know this change is safe to merge.

# via
# lightspeed-stack (pyproject.toml)
# blobfile
# kubernetes
# requests
Expand Down
17 changes: 10 additions & 7 deletions requirements.x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1381,9 +1381,9 @@ kiwisolver==1.4.9 \
--hash=sha256:fb940820c63a9590d31d88b815e7a3aa5915cad3ce735ab45f0c730b39547de1 \
--hash=sha256:fc1795ac5cd0510207482c3d1d3ed781143383b8cfd36f5c645f3897ce066220
# via matplotlib
kubernetes==34.1.0 \
--hash=sha256:8fe8edb0b5d290a2f3ac06596b23f87c658977d46b5f8df9d0f4ea83d0003912 \
--hash=sha256:bffba2272534e224e6a7a74d582deb0b545b7c9879d2cd9e4aae9481d1f2cc2a
kubernetes==33.1.0 \
--hash=sha256:544de42b24b64287f7e0aa9513c93cb503f7f40eea39b20f66810011a86eabc5 \
--hash=sha256:f64d829843a54c251061a8e7a14523b521f2dc5c896cf6d65ccf348648a88993
# via lightspeed-stack (pyproject.toml)
langdetect==1.0.9 \
--hash=sha256:7cbc0746252f19e76f77c0b1690aadf01963be835ef0cd4b56dddf2a8f1dfc2a \
Expand Down Expand Up @@ -1959,7 +1959,9 @@ numpy==2.2.6 \
oauthlib==3.3.1 \
--hash=sha256:0f0f8aa759826a193cf66c12ea1af1637f87b9b4622d46e866952bb022e538c9 \
--hash=sha256:88119c938d2b8fb88561af5f6ee0eec8cc8d552b7bb1f712743136eb7523b7a1
# via requests-oauthlib
# via
# kubernetes
# requests-oauthlib
openai==2.9.0 \
--hash=sha256:0d168a490fbb45630ad508a6f3022013c155a68fd708069b6a1a01a5e8f0ffad \
--hash=sha256:b52ec65727fc8f1eed2fbc86c8eac0998900c7ef63aa2eb5c24b69717c56fa5f
Expand Down Expand Up @@ -3569,10 +3571,11 @@ tzdata==2025.2 \
--hash=sha256:1a403fada01ff9221ca8044d701868fa132215d84beb92242d9acd2147f667a8 \
--hash=sha256:b60a638fcc0daffadf82fe0f57e53d06bdec2f36c4df66280ae79bce6bd6f2b9
# via pandas
urllib3==2.3.0 \
--hash=sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df \
--hash=sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d
urllib3==2.5.0 \
--hash=sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760 \
--hash=sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc
# via
# lightspeed-stack (pyproject.toml)
# blobfile
# kubernetes
# requests
Expand Down
15 changes: 9 additions & 6 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading