fix(deps): vuln minor upgrades — 5 packages (minor: 4 · patch: 1) [pyproject.toml]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 5 packages upgraded (MINOR changes included)

Manifests changed:

• pyproject.toml (poetry)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
urllib3	2.3.0	2.8.0	minor	Transitive	18 HIGH, 6 MEDIUM
filelock	3.16.1	3.32.7	minor	Transitive	6 MEDIUM
requests	2.32.3	2.34.2	minor	Direct	6 MEDIUM
pytest	8.3.4	8.3.5	patch	Direct	3 MEDIUM
idna	3.10	3.20	minor	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (18 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
urllib3	CVE-2025-66471	HIGH	urllib3 Streaming API improperly handles highly compressed data	2.3.0	-	-
urllib3	PYSEC-2026-1996	high	Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)	2.3.0	2.6.3	-
urllib3	GHSA-8988-9cw3-xx77	HIGH	urllib3: HTTPS proxy TLS configuration may be ignored or overridden	2.3.0	2.8.0	-
urllib3	CVE-2026-97687	high	urllib3: HTTPS proxy TLS configuration may be ignored or overridden	2.3.0	-	-
urllib3	PYSEC-2026-141	high	-	2.3.0	2.7.0	-
urllib3	CVE-2026-44431	high	urllib3: Sensitive headers forwarded across origins in proxied low-level redirects	2.3.0	-	-
urllib3	GHSA-qccp-gfcp-xxvc	HIGH	urllib3: Sensitive headers forwarded across origins in proxied low-level redirects	2.3.0	2.7.0	-
urllib3	GHSA-vxq7-64xx-v4gw	HIGH	urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory	2.3.0	2.8.0	-
urllib3	CVE-2026-97689	HIGH	urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory	2.3.0	-	-
urllib3	PYSEC-2026-4177	HIGH	urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory	2.3.0	2.8.0	-
urllib3	PYSEC-2026-4175	high	urllib3: HTTPS proxy TLS configuration may be ignored or overridden	2.3.0	2.8.0	-
urllib3	GHSA-38jv-5279-wg99	HIGH	Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)	2.3.0	2.6.3	-
urllib3	CVE-2026-21441	high	urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)	2.3.0	-	-
urllib3	PYSEC-2026-1994	HIGH	urllib3 streaming API improperly handles highly compressed data	2.3.0	2.6.0	-
urllib3	GHSA-2xpw-w6gg-jr37	HIGH	urllib3 streaming API improperly handles highly compressed data	2.3.0	2.6.0	-
urllib3	PYSEC-2026-1998	HIGH	urllib3 allows an unbounded number of links in the decompression chain	2.3.0	2.6.0	-
urllib3	GHSA-gm62-xv2j-4w53	HIGH	urllib3 allows an unbounded number of links in the decompression chain	2.3.0	2.6.0	-
urllib3	CVE-2025-66418	HIGH	urllib3 allows an unbounded number of links in the decompression chain	2.3.0	-	-

ℹ️ Other Vulnerabilities (23)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
filelock	CVE-2026-22701	medium	filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock	3.16.1	-	-
filelock	PYSEC-2026-1374	medium	filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock	3.16.1	3.20.3	-
filelock	PYSEC-2026-1375	medium	filelock has a TOCTOU race condition which allows symlink attacks during lock file creation	3.16.1	3.20.1	-
filelock	CVE-2025-68146	medium	filelock has TOCTOU race condition that allows symlink attacks during lock file creation	3.16.1	-	-
requests	PYSEC-2026-2275	medium	-	2.32.3	2.33.0	-
requests	CVE-2026-25645	medium	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.32.3	-	-
urllib3	PYSEC-2026-1999	medium	urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation	2.3.0	2.5.0	-
urllib3	CVE-2025-50182	medium	urllib3 does not control redirects in browsers and Node.js	2.3.0	-	-
urllib3	PYSEC-2026-1997	medium	urllib3 does not control redirects in browsers and Node.js	2.3.0	2.5.0	-
urllib3	CVE-2025-50181	medium	urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation	2.3.0	-	-
filelock	GHSA-qmgc-5h2g-mvrw	MODERATE	filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock	3.16.1	3.20.3	-
filelock	GHSA-w853-jp5j-5j7f	MODERATE	filelock has a TOCTOU race condition which allows symlink attacks during lock file creation	3.16.1	3.20.1	-
idna	GHSA-65pc-fj4g-8rjx	MODERATE	Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix	3.10	3.15	-
idna	PYSEC-2026-215	MODERATE	-	3.10	3.15	-
pytest	GHSA-6w46-j5rx-g56g	MODERATE	pytest has vulnerable tmpdir handling	8.3.4	9.0.3	-
pytest	PYSEC-2026-1845	MODERATE	pytest has vulnerable tmpdir handling	8.3.4	9.0.3	-
pytest	CVE-2025-71176	MODERATE	-	8.3.4	-	-
requests	GHSA-9hjg-9r4m-mvj7	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.32.3	2.32.4	-
requests	GHSA-gc5v-m9x4-r6x2	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.32.3	2.33.0	-
requests	PYSEC-2026-1872	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.32.3	2.32.4	-
requests	CVE-2024-47081	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.32.3	-	-
urllib3	GHSA-pq67-6m6q-mj2v	MODERATE	urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation	2.3.0	2.5.0	-
urllib3	GHSA-48p4-8xcf-vxj5	MODERATE	urllib3 does not control redirects in browsers and Node.js	2.3.0	2.5.0	-

⚠️ Dependencies that have Reached EOL (1)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
requests	2.32.3	-	2.34.2	pyproject.toml	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System