888beb6c44
Release notes: https://github.com/urllib3/urllib3/releases/tag/2.6.3 Fixes the following vulnerability: CVE-2026-21441: Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Julien: add link to release notes] Signed-off-by: Julien Olivain <ju.o@free.fr>