Fixed a high-severity security issue where decompression-bomb safeguards of
the streaming API were bypassed when HTTP redirects were followed.
(GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>__)
Started treating Retry-After times greater than 6 hours as 6 hours by
default. (#​3743 <https://github.com/urllib3/urllib3/issues/3743>__)
Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten.
(#​3752 <https://github.com/urllib3/urllib3/issues/3752>__)
Configuration
📅Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [urllib3](https://github.com/urllib3/urllib3) ([changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)) | `==2.6.2` → `==2.6.3` |  |  |
---
### Release Notes
<details>
<summary>urllib3/urllib3 (urllib3)</summary>
### [`v2.6.3`](https://github.com/urllib3/urllib3/blob/HEAD/CHANGES.rst#263-2026-01-07)
[Compare Source](https://github.com/urllib3/urllib3/compare/2.6.2...2.6.3)
\==================
- Fixed a high-severity security issue where decompression-bomb safeguards of
the streaming API were bypassed when HTTP redirects were followed.
(`GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>`\_\_)
- Started treating `Retry-After` times greater than 6 hours as 6 hours by
default. (`#​3743 <https://github.com/urllib3/urllib3/issues/3743>`\_\_)
- Fixed `urllib3.connection.VerifiedHTTPSConnection` on Emscripten.
(`#​3752 <https://github.com/urllib3/urllib3/issues/3752>`\_\_)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi43Mi4wIiwidXBkYXRlZEluVmVyIjoiNDIuNzQuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
argoyle
changed target branch from master to main2026-01-08 15:07:00 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
==2.6.2→==2.6.3Release Notes
urllib3/urllib3 (urllib3)
v2.6.3Compare Source
==================
the streaming API were bypassed when HTTP redirects were followed.
(
GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>__)Retry-Aftertimes greater than 6 hours as 6 hours bydefault. (
#​3743 <https://github.com/urllib3/urllib3/issues/3743>__)urllib3.connection.VerifiedHTTPSConnectionon Emscripten.(
#​3752 <https://github.com/urllib3/urllib3/issues/3752>__)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
ef0170bbddtoc2cd1d2d92