Update urllib3 to 2.6.0 due to CVE-2025-66418#4260
Conversation
Signed-off-by: Matt Liberty <mliberty@precisioninno.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the urllib3 dependency version in tools/AutoTuner/requirements.txt from >=1.26.17 to >=2.6.0. However, the specified version 2.6.0 does not exist on PyPI, which will cause pip install to fail. It is recommended to use a valid, existing version such as >=2.3.0 instead.
| protobuf>=5.26.1 | ||
| SQLAlchemy==1.4.17 | ||
| urllib3>=1.26.17 | ||
| urllib3>=2.6.0 |
There was a problem hiding this comment.
The version 2.6.0 for urllib3 does not exist on PyPI (the latest version is 2.3.0). Specifying urllib3>=2.6.0 will cause pip install to fail because the package manager cannot find a matching version. Please use a valid, existing version of urllib3 (such as 2.3.0).
urllib3>=2.3.0
There was a problem hiding this comment.
Weird, there is a version 2.7.0 at https://pypi.org/project/urllib3/#history
1 participant
No description provided.