[RitaChen609]

MLE-29961
[HIGH] BDSA-2026-9851 / CVE-2026-44432 in urllib3 v2.6.3

MLE-29963
[HIGH] BDSA-2026-9855 / CVE-2026-44431 in urllib3 v2.6.3

MLE-34125
[HIGH] BDSA-2026-15853 in urllib3 v2.6.3

[Copilot]

🟢 Approval recommended

The urllib3 2.8.0 dependency update has no active review issues.

No open issues 🎉

What changed in this PR

Updates urllib3 to 2.8.0 to address the security vulnerabilities tracked by MLE-29961, MLE-29963, and MLE-34125.

Changes:

• Replaces the ^2.6.3 constraint with an exact 2.8.0 pin.
• Updates the lockfile’s urllib3 version, artifact hashes, and minimum Python requirement to 3.10, matching the project’s declared Python range.

File	Description
pyproject.toml	Pins urllib3 to version 2.8.0.
poetry.lock	Records urllib3 2.8.0 and refreshes package and lockfile metadata.

_{Review effort: Balanced}

[rjrudin]

I would first bump requests to the latest release - the develop branch is depending on 2.32.5, and 2.34.2 is available. That might remove the need for forcing some transitive dependencies.

[RitaChen609]

I would first bump requests to the latest release - the develop branch is depending on 2.32.5, and 2.34.2 is available. That might remove the need for forcing some transitive dependencies.

I removed urllib3 forcing version, updated requests to 2.34.2, and resolved requests' dependencies to their latest available version.