GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Bump urllib3 from 2.6.3 to 2.7.0 in the uv group across 1 directory by dependabot[bot] · Pull Request #2723 · pythonnet/pythonnet

Conversation

dependabot Bot commented on behalf of github May 11, 2026

Copy link

Copy Markdown

Contributor

Bumps the uv group with 1 update in the / directory: urllib3.

Updates urllib3 from 2.6.3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

dependabot Bot added dependencies

Pull requests that update a dependency file

python:uv Pull requests that update python:uv code labels

May 11, 2026


          Bump urllib3 from 2.6.3 to 2.7.0 in the uv group across 1 directory

050c831

Bumps the uv group with 1 update in the / directory: [urllib3](https://github.com/urllib3/urllib3).


Updates `urllib3` from 2.6.3 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.7.0)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <[email protected]>

filmor force-pushed the dependabot/uv/uv-c30c77f42d branch from 44c4fa2 to 050c831 Compare

May 12, 2026 20:04

filmor merged commit 34f3bc3 into master

May 12, 2026

3 of 30 checks passed

Uh oh!

There was an error while loading. Please reload this page.

filmor deleted the dependabot/uv/uv-c30c77f42d branch

May 12, 2026 20:04

This was referenced May 24, 2026

Bump pythonnet from 3.0.5 to 3.1.0 zcsizmadia/PyDotNet#12

Merged

chore: Bump pythonnet from 3.0.5 to 3.1.0 apache/arrow-dotnet#364

Merged

CurtHagenlocher pushed a commit to apache/arrow-dotnet that referenced this pull request

May 25, 2026


          chore: Bump pythonnet from 3.0.5 to 3.1.0 (#364)

5c6a0c9

Updated [pythonnet](https://github.com/pythonnet/pythonnet) from 3.0.5
to 3.1.0.

<details>
<summary>Release notes</summary>

_Sourced from [pythonnet's
releases](https://github.com/pythonnet/pythonnet/releases)._

## 3.1.0

## What's Changed
* ci: properly exclude job by @RobPasMue in
pythonnet/pythonnet#2542
* `__delitem__` for `IList<T>` and `IDictionary<K,V>` by @lostmsu in
pythonnet/pythonnet#2533
* Fix docs workflow by @filmor in
pythonnet/pythonnet#2584
* Drop EOLd Python versions by @filmor in
pythonnet/pythonnet#2632
* Bump setuptools and adjust license information by @filmor in
pythonnet/pythonnet#2633
* Minimal .NET 8 usage changes by @filmor in
pythonnet/pythonnet#2634
* Drop performance tests by @filmor in
pythonnet/pythonnet#2636
* Properly detect availability of BinaryFormatter by @filmor in
pythonnet/pythonnet#2639
* Use last compiler toolset version that support .NET 8 by @filmor in
pythonnet/pythonnet#2640
* Add dependabot file by @filmor in
pythonnet/pythonnet#2642
* Use official ARM runners by @filmor in
pythonnet/pythonnet#2641
* Bump actions/upload-pages-artifact from 3 to 4 by @dependabot[bot] in
pythonnet/pythonnet#2644
* Bump actions/setup-python from 2 to 6 by @dependabot[bot] in
pythonnet/pythonnet#2646
* Bump actions/checkout from 2 to 5 by @dependabot[bot] in
pythonnet/pythonnet#2648
* Bump actions/setup-dotnet from 1 to 5 by @dependabot[bot] in
pythonnet/pythonnet#2645
* Use uv and derive as much as possible from the environment, if
available by @filmor in
pythonnet/pythonnet#2652
* Fixes for the uv CI by @filmor in
pythonnet/pythonnet#2654
* Bump astral-sh/setup-uv from 6 to 7 by @dependabot[bot] in
pythonnet/pythonnet#2656
* Bump actions/checkout from 5 to 6 by @dependabot[bot] in
pythonnet/pythonnet#2663
* Ensure that the tests work even if BinaryFormatter is not available by
@filmor in pythonnet/pythonnet#2638
* Bump NUnit3TestAdapter from 5.2.0 to 6.0.0 by @dependabot[bot] in
pythonnet/pythonnet#2667
* Fix line endings by @filmor in
pythonnet/pythonnet#2668
* Switch to .NET SDK 10 by @lostmsu in
pythonnet/pythonnet#2684
* Python 3.14 by @filmor in
pythonnet/pythonnet#2611
* CI Improvements by @filmor in
pythonnet/pythonnet#2669
* Bump System.Reflection.Emit from 4.3.0 to 4.7.0 by @dependabot[bot]
in pythonnet/pythonnet#2694
* Bump pytest from 9.0.2 to 9.0.3 in the uv group across 1 directory by
@dependabot[bot] in pythonnet/pythonnet#2705
* CI Improvements by @filmor in
pythonnet/pythonnet#2707
* Fix method memleak test by @filmor in
pythonnet/pythonnet#2708
* Bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in
pythonnet/pythonnet#2709
* Update furo requirement from >=2022.9.15 to >=2025.12.19 by
@dependabot[bot] in pythonnet/pythonnet#2711
* Move documentation deps to pyproject.toml by @filmor in
pythonnet/pythonnet#2714
* Support .NET Framework 4.6.1 by @Metadorius in
pythonnet/pythonnet#2701
* Fix wheel tags by @filmor in
pythonnet/pythonnet#2716
* Name missing from __all__ on re-import by @filmor in
pythonnet/pythonnet#2717
* Add context manager protocol for .NET IDisposable types by
@den-run-ai in pythonnet/pythonnet#2568
* Fix MethodBinding/OverloadMapper memory leak (#691) by
@greateggsgreg in pythonnet/pythonnet#2719
* Bump urllib3 from 2.6.3 to 2.7.0 in the uv group across 1 directory by
@dependabot[bot] in pythonnet/pythonnet#2723
* Update NUnit by @filmor in
pythonnet/pythonnet#2724
* Silence compile-time warnings by @filmor in
pythonnet/pythonnet#2725
* Implement support for DLR get/set by @filmor in
pythonnet/pythonnet#2706
* Bump idna from 3.13 to 3.15 in the uv group across 1 directory by
@dependabot[bot] in pythonnet/pythonnet#2726

## New Contributors
* @RobPasMue made their first contribution in
pythonnet/pythonnet#2542
* @dependabot[bot] made their first contribution in
pythonnet/pythonnet#2644
* @Metadorius made their first contribution in
pythonnet/pythonnet#2701

**Full Changelog**:
pythonnet/pythonnet@v3.0.5...v3.1.0

## 3.1.0-rc1

## What's Changed
* CI Improvements by @filmor in
pythonnet/pythonnet#2669
* Bump System.Reflection.Emit from 4.3.0 to 4.7.0 by @dependabot[bot]
in pythonnet/pythonnet#2694
* Bump pytest from 9.0.2 to 9.0.3 in the uv group across 1 directory by
@dependabot[bot] in pythonnet/pythonnet#2705
* CI Improvements by @filmor in
pythonnet/pythonnet#2707
* Fix method memleak test by @filmor in
pythonnet/pythonnet#2708
* Bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in
pythonnet/pythonnet#2709
* Update furo requirement from >=2022.9.15 to >=2025.12.19 by
@dependabot[bot] in pythonnet/pythonnet#2711
* Move documentation deps to pyproject.toml by @filmor in
pythonnet/pythonnet#2714
* Support .NET Framework 4.6.1 by @Metadorius in
pythonnet/pythonnet#2701
* Fix wheel tags by @filmor in
pythonnet/pythonnet#2716
* Name missing from __all__ on re-import by @filmor in
pythonnet/pythonnet#2717
* Add context manager protocol for .NET IDisposable types by
@den-run-ai in pythonnet/pythonnet#2568
* Fix MethodBinding/OverloadMapper memory leak (#691) by
@greateggsgreg in pythonnet/pythonnet#2719
* Bump urllib3 from 2.6.3 to 2.7.0 in the uv group across 1 directory by
@dependabot[bot] in pythonnet/pythonnet#2723
* Update NUnit by @filmor in
pythonnet/pythonnet#2724
* Silence compile-time warnings by @filmor in
pythonnet/pythonnet#2725
* Implement support for DLR get/set by @filmor in
pythonnet/pythonnet#2706

## New Contributors
* @Metadorius made their first contribution in
pythonnet/pythonnet#2701

**Full Changelog**:
pythonnet/pythonnet@v3.1.0-rc0...v3.1.0-rc1

## 3.1.0-rc0

## What's Changed
* ci: properly exclude job by @RobPasMue in
pythonnet/pythonnet#2542
* `__delitem__` for `IList<T>` and `IDictionary<K,V>` by @lostmsu in
pythonnet/pythonnet#2533
* Fix docs workflow by @filmor in
pythonnet/pythonnet#2584
* Drop EOLd Python versions by @filmor in
pythonnet/pythonnet#2632
* Bump setuptools and adjust license information by @filmor in
pythonnet/pythonnet#2633
* Minimal .NET 8 usage changes by @filmor in
pythonnet/pythonnet#2634
* Drop performance tests by @filmor in
pythonnet/pythonnet#2636
* Properly detect availability of BinaryFormatter by @filmor in
pythonnet/pythonnet#2639
* Use last compiler toolset version that support .NET 8 by @filmor in
pythonnet/pythonnet#2640
* Add dependabot file by @filmor in
pythonnet/pythonnet#2642
* Use official ARM runners by @filmor in
pythonnet/pythonnet#2641
* Use uv and derive as much as possible from the environment, if
available by @filmor in
pythonnet/pythonnet#2652
* Fixes for the uv CI by @filmor in
pythonnet/pythonnet#2654
* Ensure that the tests work even if BinaryFormatter is not available by
@filmor in pythonnet/pythonnet#2638
* Fix line endings by @filmor in
pythonnet/pythonnet#2668
* Switch to .NET SDK 10 by @lostmsu in
pythonnet/pythonnet#2684
* Python 3.14 by @filmor in
pythonnet/pythonnet#2611

## New Contributors
* @RobPasMue made their first contribution in
pythonnet/pythonnet#2542
* @dependabot[bot] made their first contribution in
pythonnet/pythonnet#2644

**Full Changelog**:
pythonnet/pythonnet@v3.0.5...v3.1.0-rc0

Commits viewable in [compare
view](pythonnet/pythonnet@v3.0.5...v3.1.0).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pythonnet&package-manager=nuget&previous-version=3.0.5&new-version=3.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot Bot mentioned this pull request

May 25, 2026

🔼 NuGet: Bump pythonnet from 3.0.5 to 3.1.0 Kestrun/Kestrun#411

Open

dependabot Bot mentioned this pull request

Oct 10, 2026

Bump pythonnet from 3.0.5 to 3.2.1 baleti/revit-ballet#3

Open

dependabot Bot mentioned this pull request

Oct 28, 2026

build: Bump pythonnet from 3.0.5 to 3.2.1 akuro17/StockAnalyzer-OSS#89

Open

dependabot Bot mentioned this pull request

Nov 10, 2026

MINOR: [C#] Bump pythonnet from 3.0.4 to 3.2.1 sg-scale/arrow--apache-arrow-18.1.0#10

Open

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

dependencies

Pull requests that update a dependency file

python:uv

Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.