Skip to content

deps: bump urllib3 to 2.7.0 and requests to 2.33.0 in examples/server - #14772

Open
katsugtgz wants to merge 1 commit into
huggingface:mainfrom
katsugtgz:deps-bump-urllib3-requests
Open

katsugtgz wants to merge 1 commit into
huggingface:mainfrom
katsugtgz:deps-bump-urllib3-requests

Conversation

@katsugtgz

Copy link
Copy Markdown

Updates urllib3 and requests in examples/server to address reported advisories.

Evidence:

  • examples/server/requirements.txt referenced urllib3@2.5.0 and requests@2.32.3
  • osv-scanner reported PYSEC-2026-1994, PYSEC-2026-1996, PYSEC-2026-1998, PYSEC-2026-141 (urllib3 2.5.0) and PYSEC-2026-1872, PYSEC-2026-2275 (requests 2.32.3) before the update
  • updated versions: urllib3 2.7.0, requests 2.33.0

Validation:

  • osv-scanner no longer reports any advisory for urllib3 or requests after the update
  • uv pip compile resolves the updated pins with Python 3.12

Note: osv-scanner still reports separate advisories for other pinned packages in this file, including starlette 0.41.0 (GHSA-7f5h-v6xp-fcq8, GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3 and others; a clean starlette line starts at 1.4.0, a major bump) and transformers 4.46.1. This patch only clears the urllib3 and requests findings.

Scope: examples/server/requirements.txt only.

@github-actions github-actions Bot added examples size/S PR with diff < 50 LOC labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

examples size/S PR with diff < 50 LOC

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant