chore(deps): bump urllib3 from 2.6.0 to 2.6.3

[dependabot]

Greptile Overview

Greptile Summary

This dependency update upgrades urllib3 from version 2.6.0 to 2.6.3, addressing a high-severity security vulnerability and several bug fixes. urllib3 is a transitive dependency through the requests library.

Key changes:

• Security fix (CVE-2026-21441, 8.9 High): Patches a vulnerability where decompression-bomb safeguards were bypassed during HTTP redirects in the streaming API
• Improved Retry-After header handling by capping values at 6 hours
• Fixed HTTPResponse.read_chunked() for compressed chunked responses
• Restored previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods
• Fixed VerifiedHTTPSConnection on Emscripten

Impact assessment:

• No breaking changes identified - all changes are backward-compatible fixes
• The codebase uses httpx and requests but does not directly import or use urllib3 APIs
• The security fix is critical and should be applied promptly

Confidence Score: 5/5

• This PR is safe to merge - it's a security patch with backward-compatible fixes
• This is a standard dependency version bump from Dependabot that patches a high-severity security vulnerability (CVE-2026-21441). All changes in urllib3 2.6.1-2.6.3 are bug fixes and security patches with no breaking changes. The library is only used transitively through requests and does not affect the codebase's direct functionality.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
poetry.lock	5/5	Updated urllib3 from 2.6.0 to 2.6.3 (patches CVE-2026-21441, high-severity security fix)

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant Dep as Dependabot
    participant Lock as poetry.lock
    participant Req as requests Library
    participant URL as urllib3 (2.6.0→2.6.3)
    
    Dev->>Dep: Monitors security advisories
    Dep->>Dep: Detects CVE-2026-21441 in urllib3 2.6.0
    Dep->>Lock: Updates urllib3 dependency
    Lock->>Lock: Changes hash for urllib3 2.6.3
    Note over URL: Security Fix: Decompression-bomb<br/>safeguard bypass patched<br/>(CVE-2026-21441, 8.9 High)
    Note over URL: Bug Fixes: Retry-After capping,<br/>read_chunked() fixes,<br/>restored getheaders() methods
    Req->>URL: Uses urllib3 as dependency
    Dev->>Lock: Reviews and approves change
    Dev->>Dev: Merges security patch

Loading

[greptile-apps]

_{No files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}