[Snyk] Security upgrade urllib3 from 2.0.7 to 2.6.0

[sestinj]

Snyk has created this PR to fix 2 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• packages/continue-sdk/python/api/requirements.txt

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

---

Summary by cubic

Upgrade urllib3 to >=2.6.0 in packages/continue-sdk/python/api/requirements.txt to fix two vulnerabilities (SNYK-PYTHON-URLLIB3-14192442, -14192443). Removes the <3.0.0 cap to standardize on a secure baseline.

^{Written for commit df86ba8. Summary will update automatically on new commits.}

[continue]

Keep this PR in a mergeable state →

Learn more

---

All Green is an AI agent that automatically:

✅ Addresses code review comments

✅ Fixes failing CI checks

✅ Resolves merge conflicts

[github-actions]

⚠️ PR Title Format

Your PR title doesn't follow the conventional commit format, but this won't block your PR from being merged. We recommend using this format for better project organization.

Expected Format:

<type>[optional scope]: <description>

Examples:

• feat: add changelog generation support
• fix: resolve login redirect issue
• docs: update README with new instructions
• chore: update dependencies

Valid Types:

feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert

This helps with:

• 📝 Automatic changelog generation
• 🚀 Automated semantic versioning
• 📊 Better project history tracking

This is a non-blocking warning - your PR can still be merged without fixing this.

[github-actions]

✅ Review Complete

Review of PR #9062: Security upgrade urllib3 from 2.0.7 to 2.6.0

Overall Assessment: ✅ This is a straightforward security upgrade that should be approved and merged.

Positive Aspects:

• Addresses 2 security vulnerabilities (SNYK-PYTHON-URLLIB3-14192442, SNYK-PYTHON-URLLIB3-14192443) with high priority scores (731 each)
• urllib3 2.6.0 is a stable, well-tested version
• The change is minimal and focused

Potential Concerns:

1. Breaking Change Risk - Minor Upper Bound Removal

   • Line 1: Removing the < 3.0.0 upper bound could potentially allow future automatic upgrades to urllib3 3.x, which would be a major version bump with breaking changes
   • Recommendation: Consider urllib3>=2.6.0,<3.0.0 to maintain explicit major version control while fixing the vulnerabilities

2. Testing Coverage

   • No test changes included - ensure existing tests pass, especially any that make HTTP requests
   • Consider manual testing of any functionality that uses urllib3 (likely through the requests library or similar)

3. Dependency Compatibility

   • Verify that other dependencies (especially requests if used) are compatible with urllib3 2.6.0
   • The jump from potentially 2.0.7 to 2.6.0 spans several minor versions

Recommendation:

APPROVE with the suggestion to consider restoring the <3.0.0 upper bound. The security fix is important and should be merged promptly. If CI passes, this is safe to merge.

---

[cubic-dev-ai]

No issues found across 1 file

[continue]

CI Failure Analysis

The CI failure in test (macos-latest, 24) appears to be a flaky test, not related to this PR's changes:

Evidence:

• 11 out of 12 test matrix combinations passed (all Ubuntu and Windows variants with Node 18/20/22/24, plus macOS with Node 18/20/22)
• Only test (macos-latest, 24) failed
• This PR only modifies Python dependencies (urllib3 in packages/continue-sdk/python/api/requirements.txt)
• The failing tests are Node.js/TypeScript tests in the CLI, completely unrelated to Python dependencies

Recommendation:

Re-run the failed workflow. The urllib3 security upgrade is safe and doesn't affect the CLI test suite.

Context:

This is a Snyk security fix upgrading urllib3 from >=1.25.3, <3.0.0 to >=2.6.0 to address vulnerabilities SNYK-PYTHON-URLLIB3-14192442 and SNYK-PYTHON-URLLIB3-14192443.

[continue]

CI Failure Analysis

The CI failure in test (macos-latest, 24) appears to be a flaky test, not related to this PR's changes:

Evidence:

• 11 out of 12 test matrix combinations passed (all Ubuntu and Windows variants with Node 18/20/22/24, plus macOS with Node 18/20/22)
• Only test (macos-latest, 24) failed
• This PR only modifies Python dependencies (urllib3 in packages/continue-sdk/python/api/requirements.txt)
• The failing tests are Node.js/TypeScript tests in the CLI, completely unrelated to Python dependencies

Recommendation:

Re-run the failed workflow. The urllib3 security upgrade is safe and doesn't affect the CLI test suite.

Context:

This is a Snyk security fix upgrading urllib3 from >=1.25.3, <3.0.0 to >=2.6.0 to address vulnerabilities SNYK-PYTHON-URLLIB3-14192442 and SNYK-PYTHON-URLLIB3-14192443.

[continue]

@sestinj @Patrick-Erichsen Could you please re-run the failed test (macos-latest, 24) workflow? This appears to be a flaky test unrelated to the Python dependency upgrade in this PR.

[continue]

@sestinj @Patrick-Erichsen Could you please re-run the failed test (macos-latest, 24) workflow? This appears to be a flaky test unrelated to the Python dependency upgrade in this PR.

[continue]

@sestinj @Patrick-Erichsen Could you please re-run the failed test (macos-latest, 24) workflow? This appears to be a flaky test unrelated to the Python dependency upgrade in this PR.

[sestinj]

🎉 This PR is included in version 1.36.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[sestinj]

🎉 This PR is included in version 1.38.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[sestinj]

🎉 This PR is included in version 1.8.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀