chore(deps): bump urllib3 from 2.6.3 to 2.7.0 by dependabot[bot] · Pull Request #3704 · testcontainers/testcontainers-go

dependabot · 2026-05-11T17:24:52Z

Bumps urllib3 from 2.6.3 to 2.7.0.

Release notes

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.3...2.7.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

netlify · 2026-05-11T17:24:59Z

✅ Deploy Preview for testcontainers-go ready!

Name	Link
🔨 Latest commit	`c72eb05`
🔍 Latest deploy log	https://app.netlify.com/projects/testcontainers-go/deploys/6a0210e8054fd70008db886c
😎 Deploy Preview	https://deploy-preview-3704--testcontainers-go.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

* main: (24 commits) feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll. (testcontainers#3719) chore(wait)!: change url callback in wait.ForSQL to accept network.Port (testcontainers#3650) chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 (testcontainers#3713) chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (testcontainers#3712) chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 (testcontainers#3711) chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.3 (testcontainers#3677) chore(deps): bump idna from 3.11 to 3.15 (testcontainers#3708) chore(deps): bump github.com/containerd/containerd/v2 (testcontainers#3709) feat(eventhubs): add WithAzuriteContainer and functional-options config builder (testcontainers#3722) fix(security): remove debug code that leaks Docker credentials (testcontainers#3721) fix(ollama): update test log (testcontainers#3715) chore(metrics): update usage metrics (2026-06-08) (testcontainers#3714) feat!: add PullImageWithPlatform to DockerProvider (testcontainers#3710) chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (testcontainers#3704) chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.3 to 4.26.4 (testcontainers#3667) chore(deps): bump github.com/moby/moby/api from 1.54.1 to 1.54.2 (testcontainers#3676) chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.51.0 (testcontainers#3689) chore(deps): bump google.golang.org/grpc in /modules/gcloud (testcontainers#3690) chore(deps): bump google.golang.org/grpc in /modules/dex (testcontainers#3686) feat(modules/dex): add Dex OIDC provider module (testcontainers#3659) ...

… (v0.42.0 → v0.43.0) (#9) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `v0.42.0` → `v0.43.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2ftestcontainers%2ftestcontainers-go/v0.43.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2ftestcontainers%2ftestcontainers-go/v0.42.0/v0.43.0?slim=true) | --- ### Release Notes <details> <summary>testcontainers/testcontainers-go (github.com/testcontainers/testcontainers-go)</summary> ### [`v0.43.0`](https://github.com/testcontainers/testcontainers-go/releases/tag/v0.43.0) [Compare Source](testcontainers/testcontainers-go@v0.42.0...v0.43.0) ### What's Changed #### ⚠️ Breaking Changes - chore(wait)!: change url callback in wait.ForSQL to accept network.Port ([#3650](testcontainers/testcontainers-go#3650)) [@thaJeztah](https://github.com/thaJeztah) > Users of `wait.ForSQL` need to follow the new API contract, using Moby's `network.Port` instead of `string` when building the callback function to check the URL. Please see <https://golang.testcontainers.org/features/wait/sql/> - feat!: add PullImageWithPlatform to DockerProvider ([#3710](testcontainers/testcontainers-go#3710)) [@blueprismo](https://github.com/blueprismo) > Users implementing their own `testcontainers.ImageProvider` need to implement the new `PullImageWithPlatform` method introduced by this PR. #### 🚀 Features - feat(k3s): pull image opts ([#3716](testcontainers/testcontainers-go#3716)) [@blueprismo](https://github.com/blueprismo) - feat(wait): implement AnyMultiStrategy: ForAny equivalent to ForAll. ([#3719](testcontainers/testcontainers-go#3719)) [@jeanbza](https://github.com/jeanbza) - feat(eventhubs): add WithAzuriteContainer and functional-options config builder ([#3722](testcontainers/testcontainers-go#3722)) [@mdelapenya](https://github.com/mdelapenya) - feat!: add PullImageWithPlatform to DockerProvider ([#3710](testcontainers/testcontainers-go#3710)) [@blueprismo](https://github.com/blueprismo) - feat(modules/dex): add Dex OIDC provider module ([#3659](testcontainers/testcontainers-go#3659)) [@guilycst](https://github.com/guilycst) #### 🐛 Bug Fixes - fix(security): remove debug code that leaks Docker credentials ([#3721](testcontainers/testcontainers-go#3721)) [@mdelapenya](https://github.com/mdelapenya) - fix(ollama): align local exec test with Ollama 0.30.6 log format ([#3715](testcontainers/testcontainers-go#3715)) [@mdelapenya](https://github.com/mdelapenya) - fix: close temp file handle before removal ([#3672](testcontainers/testcontainers-go#3672)) [@acouvreur](https://github.com/acouvreur) - fix(compose): close docker clients to prevent goroutine leaks ([#3661](testcontainers/testcontainers-go#3661)) [@mdelapenya](https://github.com/mdelapenya) - fix: wait for log production goroutine to drain on stop ([#3660](testcontainers/testcontainers-go#3660)) [@mdelapenya](https://github.com/mdelapenya) #### 📖 Documentation - chore: update usage metrics (2026-06) ([#3714](testcontainers/testcontainers-go#3714)) @[github-actions\[bot\]](https://github.com/apps/github-actions) #### 🧹 Housekeeping - chore(wait)!: change url callback in wait.ForSQL to accept network.Port ([#3650](testcontainers/testcontainers-go#3650)) [@thaJeztah](https://github.com/thaJeztah) - chore: update usage metrics (2026-05) ([#3670](testcontainers/testcontainers-go#3670)) @[github-actions\[bot\]](https://github.com/apps/github-actions) - chore: remove cgroupnsMode setting from K3s container configuration ([#3653](testcontainers/testcontainers-go#3653)) [@lixin9311](https://github.com/lixin9311) #### 📦 Dependency updates - chore(deps): update dependencies to latest versions in go.mod and go.sum ([#3729](testcontainers/testcontainers-go#3729)) [@Steven-Harris](https://github.com/Steven-Harris) - chore: bump sshd-docker image to 1.4.0 ([#3727](testcontainers/testcontainers-go#3727)) [@mdelapenya](https://github.com/mdelapenya) - chore(deps): bump Ryuk to v0.14.0 ([#3313](testcontainers/testcontainers-go#3313)) [@mdelapenya](https://github.com/mdelapenya) - chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 ([#3713](testcontainers/testcontainers-go#3713)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 ([#3712](testcontainers/testcontainers-go#3712)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump mkdocs-include-markdown-plugin from 7.2.2 to 7.3.0 ([#3711](testcontainers/testcontainers-go#3711)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.3 ([#3677](testcontainers/testcontainers-go#3677)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump idna from 3.11 to 3.15 ([#3708](testcontainers/testcontainers-go#3708)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to 2.2.4 in /modules/compose ([#3709](testcontainers/testcontainers-go#3709)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump urllib3 from 2.6.3 to 2.7.0 ([#3704](testcontainers/testcontainers-go#3704)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/shirou/gopsutil/v4 from 4.26.3 to 4.26.4 ([#3667](testcontainers/testcontainers-go#3667)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/moby/moby/api from 1.54.1 to 1.54.2 ([#3676](testcontainers/testcontainers-go#3676)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.51.0 ([#3689](testcontainers/testcontainers-go#3689)) [@mdelapenya](https://github.com/mdelapenya) - chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.81.0 in /modules/gcloud ([#3690](testcontainers/testcontainers-go#3690)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump google.golang.org/grpc from 1.75.0 to 1.81.0 in /modules/dex ([#3686](testcontainers/testcontainers-go#3686)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /modules/compose ([#3674](testcontainers/testcontainers-go#3674)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump docker/setup-docker-action from 4.5.0 to 5.1.0 ([#3664](testcontainers/testcontainers-go#3664)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump mkdocs-include-markdown-plugin from 7.2.1 to 7.2.2 ([#3665](testcontainers/testcontainers-go#3665)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/apache/thrift from 0.21.0 to 0.23.0 in /modules/nebulagraph ([#3673](testcontainers/testcontainers-go#3673)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 in /modules/openldap ([#3658](testcontainers/testcontainers-go#3658)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 in /modules/postgres ([#3657](testcontainers/testcontainers-go#3657)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/jackc/pgx/v5 from 5.5.4 to 5.9.2 in /modules/cockroachdb ([#3656](testcontainers/testcontainers-go#3656)) @[dependabot\[bot\]](https://github.com/apps/dependabot) - chore(deps): bump github.com/jackc/pgx/v5 from 5.5.4 to 5.9.0 in /modules/postgres ([#3652](testcontainers/testcontainers-go#3652)) @[dependabot\[bot\]](https://github.com/apps/dependabot) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://forgejo.hayden.moe/hayden/containers/pulls/9

dependabot Bot added dependencies Dependencies or external services python Pull requests that update python code labels May 11, 2026

dependabot Bot requested a review from a team as a code owner May 11, 2026 17:24

dependabot Bot added dependencies Dependencies or external services python Pull requests that update python code labels May 11, 2026

github-actions Bot added the chore Changes that do not impact the existing functionality label May 11, 2026

mdelapenya removed the chore Changes that do not impact the existing functionality label May 13, 2026

mdelapenya merged commit 982fb09 into main May 13, 2026
15 checks passed

mdelapenya deleted the dependabot/pip/urllib3-2.7.0 branch May 13, 2026 20:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): bump urllib3 from 2.6.3 to 2.7.0#3704

chore(deps): bump urllib3 from 2.6.3 to 2.7.0#3704
mdelapenya merged 1 commit into
mainfrom
dependabot/pip/urllib3-2.7.0

dependabot Bot commented on behalf of github May 11, 2026

Uh oh!

netlify Bot commented May 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 11, 2026

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes

Uh oh!

netlify Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for testcontainers-go ready!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented May 11, 2026 •

edited

Loading