[aikido-autofix]

Description

Upgrade urllib3 to fix critical vulnerabilities: HTTPS proxy TLS bypass (certificate verification bypass), unbounded memory allocation in chunked transfer encoding (DoS), decompression bomb attacks (CPU/memory exhaustion), and redirect bypass enabling SSRF/open redirect attacks.

Motivation and Context

Fixes #(issue)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test update

How Has This Been Tested?

Test Commands:

uv run pytest  # or specific test command

Test Configuration:

• OS: [e.g., macOS 14.0, Ubuntu 22.04]
• Python version(s): [e.g., 3.8, 3.11, 3.13]
• easylimit version: [e.g., 0.3.2 + changes]

Security Impact — CVE vulnerabilities fixed by this PR:

✅ 6 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-97687	HIGH	[urllib3] Target-server TLS settings are incorrectly applied to HTTPS proxy connections, allowing attackers to intercept proxied traffic by impersonating the proxy after certificate verification is disabled. This enables traffic observation, modification, or theft of client certificates.
CVE-2026-97689	HIGH	[urllib3] Unbounded memory allocation vulnerability in chunked transfer encoding parser allows remote attackers to cause denial of service by sending unterminated chunk-size lines, exhausting client process memory.
CVE-2025-66471	HIGH	[urllib3] The Streaming API improperly handles highly compressed data, allowing attackers to cause excessive CPU usage and memory allocation through decompression of small compressed payloads. This results in a denial-of-service vulnerability via resource exhaustion.
CVE-2025-66418	HIGH	[urllib3] Unbounded decompression chain allows malicious servers to insert unlimited compression steps, causing excessive CPU usage and memory allocation. This leads to denial of service through resource exhaustion.
CVE-2025-50181	MEDIUM	[urllib3] A vulnerability allows disabling redirects for all requests through improper PoolManager instantiation with retries configuration, potentially bypassing SSRF and open redirect mitigations that rely on redirect disabling. Applications attempting to prevent SSRF or open redirect attacks through redirect disabling remain vulnerable to these attacks.
CVE-2025-50182	MEDIUM	[urllib3] A vulnerability allows uncontrolled HTTP redirects in browser and Node.js environments when using Pyodide, as redirect parameters are ignored and the runtime determines redirect behavior instead, potentially enabling open redirect attacks or information disclosure.

Fix Details / Technical Implementation (detailed write-up of what was changed and why):

🤖 Remediation details

Fix urllib3 high/medium severity CVEs by narrowing Python floor and bumping requests

This PR remediates six CVEs in urllib3 (the only vulnerable package in scope). The urllib3 package appears as a transitive dependency via requests in the dev optional-dependency group of the root pyproject.toml, and the fix is reflected in uv.lock.

urllib3

urllib3 2.8.0 (the minimum patched release covering all six advisories) requires Python ≥ 3.10. Because requires-python was set to >=3.8, the resolver created Python 3.8 and 3.9 marker forks that could not satisfy urllib3>=2.8.0, leaving two old copies (2.2.3 and 2.4.0) in the lockfile. The fix narrows requires-python from >=3.8 to >=3.10, eliminating those forks. Additionally, the direct dev dependency requests was raised from >=2.25.0 to >=2.32.3 so the resolver selects a requests release (2.34.2) that itself requires urllib3>=2.8.0, ensuring the patched transitive version is pulled in. After these two edits, uv lock resolves urllib3 to exactly 2.8.0 with a single lockfile instance.

Version changes

Package	From	To	Why updated
urllib3	2.2.3 / 2.4.0 (marker forks)	2.8.0	Direct CVE fix (all six advisories patched at 2.8.0)
requests	>=2.25.0 (resolved 2.32.3)	>=2.32.3 (resolved 2.34.2)	Parent bump required to pull urllib3≥2.8.0 transitively
pytest	8.3.5 / 8.4.0 (marker forks)	8.4.0	Lockfile refresh after requires-python narrowed to ≥3.10
pytest-asyncio	0.24.0 / 1.1.0 (marker forks)	1.1.0	Lockfile refresh after requires-python narrowed to ≥3.10
pytest-cov	5.0.0 / 6.1.1 (marker forks)	6.1.1	Lockfile refresh after requires-python narrowed to ≥3.10
coverage	7.6.1 / 7.8.2 (marker forks)	7.8.2	Lockfile refresh after requires-python narrowed to ≥3.10
mypy	1.14.1 / 1.16.0 (marker forks)	1.16.0	Lockfile refresh after requires-python narrowed to ≥3.10
pluggy	1.5.0 / 1.6.0 (marker forks)	1.6.0	Lockfile refresh after requires-python narrowed to ≥3.10
typing-extensions	4.13.2 / 4.14.0 (marker forks)	4.14.0	Lockfile refresh after requires-python narrowed to ≥3.10

Checklist

• My code follows the project's code style (checked with ruff check and ruff format --check)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My commit messages follow Conventional Commits specification
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes (uv run pytest)
• I have checked my code passes type checking (uv run mypy src/)
• I have updated the CHANGELOG.md (if applicable)
• I have updated version number if this is a release PR (src/easylimit/init.py only)
• My changes maintain backwards compatibility OR I've documented breaking changes
• I have tested on multiple Python versions (if applicable)

Additional Notes

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1e2ba9c0-edfe-4633-ac6d-3b771e07a7b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn