Bring compatibility with urllib3 v2.0.0+ #207
Conversation
- Constrain urllib3 dependency to versions between 2.0.0 and 3.0.0 - Ensures compatibility with urllib3 v2.x while preventing breaking changes from v3.x
There was a problem hiding this comment.
Pull request overview
This PR updates the urllib3 dependency from >= 1.15 to >= 2.0.0, < 3.0.0 and migrates the code to use urllib3 v2.x API patterns by replacing deprecated response methods with direct header attribute access.
Key changes:
- Updated urllib3 version constraint to require v2.0.0+ and prevent v3.x
- Modified RESTResponse wrapper methods to use urllib3 v2.x API (direct
headersaccess instead ofgetheaders()/getheader()methods) - Updated README documentation to reflect new minimum version requirement
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| setup.py | Updated urllib3 dependency constraint from >= 1.15 to >= 2.0.0, < 3.0.0 |
| docusign_esign/client/api_response.py | Updated RESTResponse methods to use urllib3 v2.x API: replaced getheaders() with direct headers access and getheader(name, default) with headers.get(name, default) |
| README.md | Updated documentation to reflect new minimum urllib3 version (v2.0.0+) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # http://pypi.python.org/pypi/setuptools | ||
|
|
||
| REQUIRES = ["urllib3 >= 1.15", "six >= 1.8.0", "certifi >= 14.05.14", "python-dateutil >= 2.5.3", "setuptools >= 21.0.0", "PyJWT>=2.0.0", "cryptography>=2.5"] | ||
| REQUIRES = ["urllib3 >= 2.0.0, < 3.0.0", "six >= 1.8.0", "certifi >= 14.05.14", "python-dateutil >= 2.5.3", "setuptools >= 21.0.0", "PyJWT>=2.0.0", "cryptography>=2.5"] |
There was a problem hiding this comment.
The version constraint in the code (>= 2.0.0) does not match what is described in the PR description. The PR description states "Setting a minimum of v2.6.0 ensures users get a mature, stable release" and claims the change ensures "Minimum version is 2.0.0 (stable v2.x release with bug fixes)", but the actual minimum version specified here is 2.0.0, not 2.6.0 as mentioned in the description. If the intent is to require v2.6.0 as the minimum for stability reasons, the constraint should be "urllib3 >= 2.6.0, < 3.0.0" instead.
| REQUIRES = ["urllib3 >= 2.0.0, < 3.0.0", "six >= 1.8.0", "certifi >= 14.05.14", "python-dateutil >= 2.5.3", "setuptools >= 21.0.0", "PyJWT>=2.0.0", "cryptography>=2.5"] | |
| REQUIRES = ["urllib3 >= 2.6.0, < 3.0.0", "six >= 1.8.0", "certifi >= 14.05.14", "python-dateutil >= 2.5.3", "setuptools >= 21.0.0", "PyJWT>=2.0.0", "cryptography>=2.5"] |
There was a problem hiding this comment.
@VDigitall Shouldn't we move to 2.6.0 as minimum version to mitigate CVE-2025-66471
There was a problem hiding this comment.
@garg-mudit
It could be an option, but I added v2.0.0 as it is minimum version that has new methods and it gives other users time to migrate to urllib3 v2.6.0.
To mitigate vulnerability, better would be set minimum version to 2.6.0
But its up to you.
|
This PR addresses a critical security vulnerability in urllib3 that affects this package. Please prioritize review and merge. Critical Vulnerability AddressedCVE-2025-66471Vulnerability in urllib3 < 2.6.0
ReferencesRequestPlease review and merge this PR urgently to protect users from this critical vulnerability. Thank you! 🙏 |
VDigitall
changed the title
3 participants
Update urllib3 Dependency Version Constraints
Summary
This PR updates the urllib3 dependency constraint to
>= 2.0.0, < 3.0.0to address compatibility issues with deprecated features in urllib3 v2.0.0 and ensure stable operation while preventing breaking changes from the upcoming v3.x release.Root Cause
urllib3 v2.0.0 introduced significant breaking changes and removed several deprecated features that were present in v1.x:
The previous constraint (
>= 2.0.0) was too broad and could allow installation of early v2.x versions that still had stability issues. Setting a minimum of v2.0.0 ensures users get a mature, stable release from the v2.x series.Changes Made
setup.py: Changed urllib3 constraint from>= 1.15.1to>= 2.0.0, < 3.0.0Impact
References
Solves the issue #208