Bump urllib3 from 1.26.19 to 2.5.0 in /__tests__/data and document breaking changes in v6 by dependabot[bot] · Pull Request #1139 · actions/setup-python

dependabot · 2025-06-18T22:02:26Z

Bumps urllib3 from 1.26.19 to 2.5.0 and added documentation covering the breaking changes introduced in the latest major release (v6).

Release notes

Sourced from urllib3's releases.

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security issues

urllib3 2.5.0 fixes two moderate security issues:

Pool managers now properly control redirects when retries is passed — CVE-2025-50181 reported by @sandumjacob (5.3 Medium, GHSA-pq67-6m6q-mj2v)

Redirects are now controlled by urllib3 in the Node.js runtime — CVE-2025-50182 (5.3 Medium, GHSA-48p4-8xcf-vxj5)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 for more information. (#3610)

Added support for version 0.5 of hatch-vcs (#3612)

Bugfixes

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. (#3581)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. (#3615)

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)

Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

Misc

Switched to uv for installing development dependecies. (#3550)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

2.3.0

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.5.0 (2025-06-18)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 <https://peps.python.org/pep-0784/>_ for more information. ([#3610](https://github.com/urllib3/urllib3/issues/3610) <https://github.com/urllib3/urllib3/issues/3610>__)

Added support for version 0.5 of hatch-vcs ([#3612](https://github.com/urllib3/urllib3/issues/3612) <https://github.com/urllib3/urllib3/issues/3612>__)

Bugfixes

Fixed a security issue where restricting the maximum number of followed redirects at the urllib3.PoolManager level via the retries parameter did not work.

Made the Node.js runtime respect redirect parameters such as retries and redirects.

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. ([#3581](https://github.com/urllib3/urllib3/issues/3581) <https://github.com/urllib3/urllib3/issues/3581>__)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. ([#3615](https://github.com/urllib3/urllib3/issues/3615) <https://github.com/urllib3/urllib3/issues/3615>__)

2.4.0 (2025-04-10)

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. ([#3522](https://github.com/urllib3/urllib3/issues/3522) <https://github.com/urllib3/urllib3/issues/3522>__)

Updated exceptions to save and restore more properties during the pickle/serialization process. ([#3567](https://github.com/urllib3/urllib3/issues/3567) <https://github.com/urllib3/urllib3/issues/3567>__)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. ([#3571](https://github.com/urllib3/urllib3/issues/3571) <https://github.com/urllib3/urllib3/issues/3571>__)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. ([#3555](https://github.com/urllib3/urllib3/issues/3555) <https://github.com/urllib3/urllib3/issues/3555>__)

Misc

Switched to uv for installing development dependecies. ([#3550](https://github.com/urllib3/urllib3/issues/3550) <https://github.com/urllib3/urllib3/issues/3550>__)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. ([#3566](https://github.com/urllib3/urllib3/issues/3566) <https://github.com/urllib3/urllib3/issues/3566>__)

2.3.0 (2024-12-22)

... (truncated)

Commits

aaab4ec Release 2.5.0
7eb4a2a Merge commit from fork
f05b132 Merge commit from fork
d03fe32 Fix HTTP tunneling with IPv6 in older Python versions
11661e9 Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624)
6a0ecc6 Update v2 migration guide to 2.4.0 (#3621)
8e32e60 Raise exception for shutdown on a connection already released to the pool (#3...
9996e0f Fix emscripten CI for Chrome 137+ (#3599)
4fd1a99 Bump RECENT_DATE (#3617)
c4b5917 Add support for the new compression.zstd module in Python 3.14 (#3611)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

aparnajyothi-y · 2025-09-05T11:47:14Z

@dependabot recreate

Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.19 to 2.5.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.19...2.5.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.5.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.0.0 to 6.1.0. Release notes *Sourced from [actions/setup-python's releases](https://github.com/actions/setup-python/releases).* > v6.1.0 > ------ > > What's Changed > -------------- > > ### Enhancements: > > * Add support for `pip-install` input by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-python#1201](https://redirect.github.com/actions/setup-python/pull/1201) > * Add graalpy early-access and windows builds by [`@timfel`](https://github.com/timfel) in [actions/setup-python#880](https://redirect.github.com/actions/setup-python/pull/880) > > ### Dependency and Documentation updates: > > * Enhanced wording and updated example usage for `allow-prereleases` by [`@yarikoptic`](https://github.com/yarikoptic) in [actions/setup-python#979](https://redirect.github.com/actions/setup-python/pull/979) > * Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1139](https://redirect.github.com/actions/setup-python/pull/1139) > * Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1094](https://redirect.github.com/actions/setup-python/pull/1094) > * Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1199](https://redirect.github.com/actions/setup-python/pull/1199) > * Upgrade requests from 2.32.2 to 2.32.4 by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1130](https://redirect.github.com/actions/setup-python/pull/1130) > * Upgrade prettier from 3.5.3 to 3.6.2 by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1234](https://redirect.github.com/actions/setup-python/pull/1234) > * Upgrade `@types/node` from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1235](https://redirect.github.com/actions/setup-python/pull/1235) > > New Contributors > ---------------- > > * [`@yarikoptic`](https://github.com/yarikoptic) made their first contribution in [actions/setup-python#979](https://redirect.github.com/actions/setup-python/pull/979) > > **Full Changelog**: <actions/setup-python@v6...v6.1.0> Commits * [`83679a8`](actions/setup-python@83679a8) Bump `@types/node` from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ... * [`bfc4944`](actions/setup-python@bfc4944) Bump prettier from 3.5.3 to 3.6.2 ([#1234](https://redirect.github.com/actions/setup-python/issues/1234)) * [`97aeb3e`](actions/setup-python@97aeb3e) Bump requests from 2.32.2 to 2.32.4 in /**tests**/data ([#1130](https://redirect.github.com/actions/setup-python/issues/1130)) * [`443da59`](actions/setup-python@443da59) Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi... * [`cfd55ca`](actions/setup-python@cfd55ca) graalpy: add graalpy early-access and windows builds ([#880](https://redirect.github.com/actions/setup-python/issues/880)) * [`bba65e5`](actions/setup-python@bba65e5) Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md ([#1094](https://redirect.github.com/actions/setup-python/issues/1094)) * [`18566f8`](actions/setup-python@18566f8) Improve wording and "fix example" (remove 3.13) on testing against pre-releas... * [`2e3e4b1`](actions/setup-python@2e3e4b1) Add support for pip-install input ([#1201](https://redirect.github.com/actions/setup-python/issues/1201)) * [`4267e28`](actions/setup-python@4267e28) Bump urllib3 from 1.26.19 to 2.5.0 in /**tests**/data and document breaking c... * See full diff in [compare view](actions/setup-python@e797f83...83679a8) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-python&package-manager=github\_actions&previous-version=6.0.0&new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Add support for pip-install input by @gowridurgad in actions/setup-python#1201 Add graalpy early-access and windows builds by @timfel in actions/setup-python#880 Dependency and Documentation updates: Enhanced wording and updated example usage for allow-prereleases by @yarikoptic in actions/setup-python#979 Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by @dependabot in actions/setup-python#1139 Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by @dependabot in actions/setup-python#1094 Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by @dependabot in actions/setup-python#1199 Upgrade requests from 2.32.2 to 2.32.4 by @dependabot in actions/setup-python#1130 Upgrade prettier from 3.5.3 to 3.6.2 by @dependabot in actions/setup-python#1234 Upgrade @types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by @dependabot in actions/setup-python#1235

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0. Release notes *Sourced from [actions/setup-python's releases](https://github.com/actions/setup-python/releases).* > v6.2.0 > ------ > > What's Changed > -------------- > > ### Dependency Upgrades > > * Upgrade dependencies to Node 24 compatible versions by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/setup-python#1259](https://redirect.github.com/actions/setup-python/pull/1259) > * Upgrade urllib3 from 2.5.0 to 2.6.3 in `/__tests__/data` by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1253](https://redirect.github.com/actions/setup-python/pull/1253) and [actions/setup-python#1264](https://redirect.github.com/actions/setup-python/pull/1264) > > **Full Changelog**: <actions/setup-python@v6...v6.2.0> > > v6.1.0 > ------ > > What's Changed > -------------- > > ### Enhancements: > > * Add support for `pip-install` input by [`@gowridurgad`](https://github.com/gowridurgad) in [actions/setup-python#1201](https://redirect.github.com/actions/setup-python/pull/1201) > * Add graalpy early-access and windows builds by [`@timfel`](https://github.com/timfel) in [actions/setup-python#880](https://redirect.github.com/actions/setup-python/pull/880) > > ### Dependency and Documentation updates: > > * Enhanced wording and updated example usage for `allow-prereleases` by [`@yarikoptic`](https://github.com/yarikoptic) in [actions/setup-python#979](https://redirect.github.com/actions/setup-python/pull/979) > * Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1139](https://redirect.github.com/actions/setup-python/pull/1139) > * Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1094](https://redirect.github.com/actions/setup-python/pull/1094) > * Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1199](https://redirect.github.com/actions/setup-python/pull/1199) > * Upgrade requests from 2.32.2 to 2.32.4 by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1130](https://redirect.github.com/actions/setup-python/pull/1130) > * Upgrade prettier from 3.5.3 to 3.6.2 by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1234](https://redirect.github.com/actions/setup-python/pull/1234) > * Upgrade `@types/node` from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by [`@dependabot`](https://github.com/dependabot) in [actions/setup-python#1235](https://redirect.github.com/actions/setup-python/pull/1235) > > New Contributors > ---------------- > > * [`@yarikoptic`](https://github.com/yarikoptic) made their first contribution in [actions/setup-python#979](https://redirect.github.com/actions/setup-python/pull/979) > > **Full Changelog**: <actions/setup-python@v6...v6.1.0> > > v6.0.0 > ------ > > What's Changed > -------------- > > ### Breaking Changes > > * Upgrade to node 24 by [`@salmanmkc`](https://github.com/salmanmkc) in [actions/setup-python#1164](https://redirect.github.com/actions/setup-python/pull/1164) > > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1) > > ### Enhancements: > > * Add support for `pip-version` by [`@priyagupta108`](https://github.com/priyagupta108) in [actions/setup-python#1129](https://redirect.github.com/actions/setup-python/pull/1129) > * Enhance reading from .python-version by [`@krystof-k`](https://github.com/krystof-k) in [actions/setup-python#787](https://redirect.github.com/actions/setup-python/pull/787) > * Add version parsing from Pipfile by [`@aradkdj`](https://github.com/aradkdj) in [actions/setup-python#1067](https://redirect.github.com/actions/setup-python/pull/1067) > > ### Bug fixes: > > * Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by [`@aparnajyothi-y`](https://github.com/aparnajyothi-y) in [actions/setup-python#1183](https://redirect.github.com/actions/setup-python/pull/1183) > * Change missing cache directory error to warning by [`@aparnajyothi-y`](https://github.com/aparnajyothi-y) in [actions/setup-python#1182](https://redirect.github.com/actions/setup-python/pull/1182) > * Add Architecture-Specific PATH Management for Python with --user Flag on Windows by [`@aparnajyothi-y`](https://github.com/aparnajyothi-y) in [actions/setup-python#1122](https://redirect.github.com/actions/setup-python/pull/1122) > * Include python version in PyPy python-version output by [`@cdce8p`](https://github.com/cdce8p) in [actions/setup-python#1110](https://redirect.github.com/actions/setup-python/pull/1110) > * Update docs: clarification on pip authentication with setup-python by [`@priya-kinthali`](https://github.com/priya-kinthali) in [actions/setup-python#1156](https://redirect.github.com/actions/setup-python/pull/1156) > > ### Dependency updates: > > * Upgrade idna from 2.9 to 3.7 in /**tests**/data by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-python#843](https://redirect.github.com/actions/setup-python/pull/843) > * Upgrade form-data to fix critical vulnerabilities [#182](https://redirect.github.com/actions/setup-python/issues/182) & [#183](https://redirect.github.com/actions/setup-python/issues/183) by [`@aparnajyothi-y`](https://github.com/aparnajyothi-y) in [actions/setup-python#1163](https://redirect.github.com/actions/setup-python/pull/1163) > * Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by [`@aparnajyothi-y`](https://github.com/aparnajyothi-y) in [actions/setup-python#1165](https://redirect.github.com/actions/setup-python/pull/1165) > * Upgrade actions/checkout from 4 to 5 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-python#1181](https://redirect.github.com/actions/setup-python/pull/1181) > * Upgrade `@actions/tool-cache` from 2.0.1 to 2.0.2 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-python#1095](https://redirect.github.com/actions/setup-python/pull/1095) ... (truncated) Commits * [`a309ff8`](actions/setup-python@a309ff8) Bump urllib3 from 2.6.0 to 2.6.3 in /**tests**/data ([#1264](https://redirect.github.com/actions/setup-python/issues/1264)) * [`bfe8cc5`](actions/setup-python@bfe8cc5) Upgrade [`@actions`](https://github.com/actions) dependencies to Node 24 compatible versions ([#1259](https://redirect.github.com/actions/setup-python/issues/1259)) * [`4f41a90`](actions/setup-python@4f41a90) Bump urllib3 from 2.5.0 to 2.6.0 in /**tests**/data ([#1253](https://redirect.github.com/actions/setup-python/issues/1253)) * [`83679a8`](actions/setup-python@83679a8) Bump `@types/node` from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ... * [`bfc4944`](actions/setup-python@bfc4944) Bump prettier from 3.5.3 to 3.6.2 ([#1234](https://redirect.github.com/actions/setup-python/issues/1234)) * [`97aeb3e`](actions/setup-python@97aeb3e) Bump requests from 2.32.2 to 2.32.4 in /**tests**/data ([#1130](https://redirect.github.com/actions/setup-python/issues/1130)) * [`443da59`](actions/setup-python@443da59) Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi... * [`cfd55ca`](actions/setup-python@cfd55ca) graalpy: add graalpy early-access and windows builds ([#880](https://redirect.github.com/actions/setup-python/issues/880)) * [`bba65e5`](actions/setup-python@bba65e5) Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md ([#1094](https://redirect.github.com/actions/setup-python/issues/1094)) * [`18566f8`](actions/setup-python@18566f8) Improve wording and "fix example" (remove 3.13) on testing against pre-releas... * Additional commits viewable in [compare view](actions/setup-python@a26af69...a309ff8) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-python&package-manager=github\_actions&previous-version=5.6.0&new-version=6.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-python](https://github.com/actions/setup-python) | action | major | `v4` → `v6` | --- ### Release Notes <details> <summary>actions/setup-python (actions/setup-python)</summary> ### [`v6.2.0`](https://github.com/actions/setup-python/releases/tag/v6.2.0) [Compare Source](actions/setup-python@v6.1.0...v6.2.0) #### What's Changed ##### Dependency Upgrades - Upgrade dependencies to Node 24 compatible versions by [@salmanmkc](https://github.com/salmanmkc) in [#1259](actions/setup-python#1259) - Upgrade urllib3 from 2.5.0 to 2.6.3 in `/__tests__/data` by [@dependabot](https://github.com/dependabot) in [#1253](actions/setup-python#1253) and [#1264](actions/setup-python#1264) **Full Changelog**: <actions/setup-python@v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-python/releases/tag/v6.1.0) [Compare Source](actions/setup-python@v6.0.0...v6.1.0) #### What's Changed ##### Enhancements: - Add support for `pip-install` input by [@gowridurgad](https://github.com/gowridurgad) in [#1201](actions/setup-python#1201) - Add graalpy early-access and windows builds by [@timfel](https://github.com/timfel) in [#880](actions/setup-python#880) ##### Dependency and Documentation updates: - Enhanced wording and updated example usage for `allow-prereleases` by [@yarikoptic](https://github.com/yarikoptic) in [#979](actions/setup-python#979) - Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by [@dependabot](https://github.com/dependabot) in [#1139](actions/setup-python#1139) - Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by [@dependabot](https://github.com/dependabot) in [#1094](actions/setup-python#1094) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by [@dependabot](https://github.com/dependabot) in [#1199](actions/setup-python#1199) - Upgrade requests from 2.32.2 to 2.32.4 by [@dependabot](https://github.com/dependabot) in [#1130](actions/setup-python#1130) - Upgrade prettier from 3.5.3 to 3.6.2 by [@dependabot](https://github.com/dependabot) in [#1234](actions/setup-python#1234) - Upgrade [@types/node](https://github.com/types/node) from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by [@dependabot](https://github.com/dependabot) in [#1235](actions/setup-python#1235) #### New Contributors - [@yarikoptic](https://github.com/yarikoptic) made their first contribution in [#979](actions/setup-python#979) **Full Changelog**: <actions/setup-python@v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/setup-python/releases/tag/v6.0.0) [Compare Source](actions/setup-python@v5.6.0...v6.0.0) #### What's Changed ##### Breaking Changes - Upgrade to node 24 by [@salmanmkc](https://github.com/salmanmkc) in [#1164](actions/setup-python#1164) Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1) ##### Enhancements: - Add support for `pip-version` by [@priyagupta108](https://github.com/priyagupta108) in [#1129](actions/setup-python#1129) - Enhance reading from .python-version by [@krystof-k](https://github.com/krystof-k) in [#787](actions/setup-python#787) - Add version parsing from Pipfile by [@aradkdj](https://github.com/aradkdj) in [#1067](actions/setup-python#1067) ##### Bug fixes: - Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1183](actions/setup-python#1183) - Change missing cache directory error to warning by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1182](actions/setup-python#1182) - Add Architecture-Specific PATH Management for Python with --user Flag on Windows by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1122](actions/setup-python#1122) - Include python version in PyPy python-version output by [@cdce8p](https://github.com/cdce8p) in [#1110](actions/setup-python#1110) - Update docs: clarification on pip authentication with setup-python by [@priya-kinthali](https://github.com/priya-kinthali) in [#1156](actions/setup-python#1156) ##### Dependency updates: - Upgrade idna from 2.9 to 3.7 in /**tests**/data by [@dependabot](https://github.com/dependabot)\[bot] in [#843](actions/setup-python#843) - Upgrade form-data to fix critical vulnerabilities [#182](actions/setup-python#182) & [#183](actions/setup-python#183) by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1163](actions/setup-python#1163) - Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1165](actions/setup-python#1165) - Upgrade actions/checkout from 4 to 5 by [@dependabot](https://github.com/dependabot)\[bot] in [#1181](actions/setup-python#1181) - Upgrade [@actions/tool-cache](https://github.com/actions/tool-cache) from 2.0.1 to 2.0.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#1095](actions/setup-python#1095) #### New Contributors - [@krystof-k](https://github.com/krystof-k) made their first contribution in [#787](actions/setup-python#787) - [@cdce8p](https://github.com/cdce8p) made their first contribution in [#1110](actions/setup-python#1110) - [@aradkdj](https://github.com/aradkdj) made their first contribution in [#1067](actions/setup-python#1067) **Full Changelog**: <actions/setup-python@v5...v6.0.0> ### [`v5.6.0`](https://github.com/actions/setup-python/releases/tag/v5.6.0) [Compare Source](actions/setup-python@v5.5.0...v5.6.0) #### What's Changed - Workflow updates related to Ubuntu 20.04 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1065](actions/setup-python#1065) - Fix for Candidate Not Iterable Error by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#1082](actions/setup-python#1082) - Upgrade semver and [@types/semver](https://github.com/types/semver) by [@dependabot](https://github.com/dependabot) in [#1091](actions/setup-python#1091) - Upgrade prettier from 2.8.8 to 3.5.3 by [@dependabot](https://github.com/dependabot) in [#1046](actions/setup-python#1046) - Upgrade ts-jest from 29.1.2 to 29.3.2 by [@dependabot](https://github.com/dependabot) in [#1081](actions/setup-python#1081) **Full Changelog**: <actions/setup-python@v5...v5.6.0> ### [`v5.5.0`](https://github.com/actions/setup-python/releases/tag/v5.5.0) [Compare Source](actions/setup-python@v5.4.0...v5.5.0) #### What's Changed ##### Enhancements: - Support free threaded Python versions like '3.13t' by [@colesbury](https://github.com/colesbury) in [#973](actions/setup-python#973) - Enhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade [@action/cache](https://github.com/action/cache) from 4.0.0 to 4.0.3 by [@priya-kinthali](https://github.com/priya-kinthali) in [#1056](actions/setup-python#1056) - Add support for .tool-versions file in setup-python by [@mahabaleshwars](https://github.com/mahabaleshwars) in [#1043](actions/setup-python#1043) ##### Bug fixes: - Fix architecture for pypy on Linux ARM64 by [@mayeut](https://github.com/mayeut) in [#1011](actions/setup-python#1011) This update maps arm64 to aarch64 for Linux ARM64 PyPy installations. ##### Dependency updates: - Upgrade [@vercel/ncc](https://github.com/vercel/ncc) from 0.38.1 to 0.38.3 by [@dependabot](https://github.com/dependabot) in [#1016](actions/setup-python#1016) - Upgrade [@actions/glob](https://github.com/actions/glob) from 0.4.0 to 0.5.0 by [@dependabot](https://github.com/dependabot) in [#1015](actions/setup-python#1015) #### New Contributors - [@colesbury](https://github.com/colesbury) made their first contribution in [#973](actions/setup-python#973) - [@mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#1043](actions/setup-python#1043) **Full Changelog**: <actions/setup-python@v5...v5.5.0> ### [`v5.4.0`](https://github.com/actions/setup-python/releases/tag/v5.4.0) [Compare Source](actions/setup-python@v5.3.0...v5.4.0) #### What's Changed ##### Enhancements: - Update cache error message by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#968](actions/setup-python#968) - Enhance Workflows: Add Ubuntu-24, Remove Python 3.8 by [@priya-kinthali](https://github.com/priya-kinthali) in [#985](actions/setup-python#985) - Configure Dependabot settings by [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#1008](actions/setup-python#1008) ##### Documentation changes: - Readme update - recommended permissions by [@benwells](https://github.com/benwells) in [#1009](actions/setup-python#1009) - Improve Advanced Usage examples by [@lrq3000](https://github.com/lrq3000) in [#645](actions/setup-python#645) ##### Dependency updates: - Upgrade `undici` from 5.28.4 to 5.28.5 by [@dependabot](https://github.com/dependabot) in [#1012](actions/setup-python#1012) - Upgrade `urllib3` from 1.25.9 to 1.26.19 in /**tests**/data by [@dependabot](https://github.com/dependabot) in [#895](actions/setup-python#895) - Upgrade `actions/publish-immutable-action` from 0.0.3 to 0.0.4 by [@dependabot](https://github.com/dependabot) in [#1014](actions/setup-python#1014) - Upgrade `@actions/http-client` from 2.2.1 to 2.2.3 by [@dependabot](https://github.com/dependabot) in [#1020](actions/setup-python#1020) - Upgrade `requests` from 2.24.0 to 2.32.2 in /**tests**/data by [@dependabot](https://github.com/dependabot) in [#1019](actions/setup-python#1019) - Upgrade `@actions/cache` to `^4.0.0` by [@priyagupta108](https://github.com/priyagupta108) in [#1007](actions/setup-python#1007) #### New Contributors - [@benwells](https://github.com/benwells) made their first contribution in [#1009](actions/setup-python#1009) - [@HarithaVattikuti](https://github.com/HarithaVattikuti) made their first contribution in [#1008](actions/setup-python#1008) - [@lrq3000](https://github.com/lrq3000) made their first contribution in [#645](actions/setup-python#645) **Full Changelog**: <actions/setup-python@v5...v5.4.0> ### [`v5.3.0`](https://github.com/actions/setup-python/releases/tag/v5.3.0) [Compare Source](actions/setup-python@v5.2.0...v5.3.0) #### What's Changed - Add workflow file for publishing releases to immutable action package by [@Jcambass](https://github.com/Jcambass) in [#941](actions/setup-python#941) - Upgrade IA publish by [@Jcambass](https://github.com/Jcambass) in [#943](actions/setup-python#943) ##### Bug Fixes: - Normalise Line Endings to Ensure Cross-Platform Consistency by [@priya-kinthali](https://github.com/priya-kinthali) in [#938](actions/setup-python#938) - Revise `isGhes` logic by [@jww3](https://github.com/jww3) in [#963](actions/setup-python#963) - Bump pillow from 7.2 to 10.2.0 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#956](actions/setup-python#956) ##### Enhancements: - Enhance workflows and documentation updates by [@priya-kinthali](https://github.com/priya-kinthali) in [#965](actions/setup-python#965) - Bump default versions to latest by [@jeffwidman](https://github.com/jeffwidman) in [#905](actions/setup-python#905) #### New Contributors - [@Jcambass](https://github.com/Jcambass) made their first contribution in [#941](actions/setup-python#941) - [@jww3](https://github.com/jww3) made their first contribution in [#963](actions/setup-python#963) **Full Changelog**: <actions/setup-python@v5...v5.3.0> ### [`v5.2.0`](https://github.com/actions/setup-python/releases/tag/v5.2.0) [Compare Source](actions/setup-python@v5.1.1...v5.2.0) #### What's Changed ##### Bug fixes: - Add `.zip` extension to Windows package downloads for `Expand-Archive` Compatibility by [@priyagupta108](https://github.com/priyagupta108) in [#916](actions/setup-python#916) This addresses compatibility issues on Windows self-hosted runners by ensuring that the filenames for Python and PyPy package downloads explicitly include the .zip extension, allowing the Expand-Archive command to function correctly. - Add arch to cache key by [@Zxilly](https://github.com/Zxilly) in [#896](actions/setup-python#896) This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts. Note: This change may break previous cache keys as they will no longer be compatible with the new format. ##### Documentation changes: - Fix display of emojis in contributors doc by [@sciencewhiz](https://github.com/sciencewhiz) in [#899](actions/setup-python#899) - Documentation update for caching poetry dependencies by [@gowridurgad](https://github.com/gowridurgad) in [#908](actions/setup-python#908) ##### Dependency updates: - Bump [@iarna/toml](https://github.com/iarna/toml) version from 2.2.5 to 3.0.0 by [@priya-kinthali](https://github.com/priya-kinthali) in [#912](actions/setup-python#912) - Bump pyinstaller from 3.6 to 5.13.1 by [@aparnajyothi-y](https://github.com/aparnajyothi-y) in [#923](actions/setup-python#923) #### New Contributors - [@sciencewhiz](https://github.com/sciencewhiz) made their first contribution in [#899](actions/setup-python#899) - [@priyagupta108](https://github.com/priyagupta108) made their first contribution in [#916](actions/setup-python#916) - [@Zxilly](https://github.com/Zxilly) made their first contribution in [#896](actions/setup-python#896) - [@aparnajyothi-y](https://github.com/aparnajyothi-y) made their first contribution in [#923](actions/setup-python#923) **Full Changelog**: <actions/setup-python@v5...v5.2.0> ### [`v5.1.1`](https://github.com/actions/setup-python/releases/tag/v5.1.1) [Compare Source](actions/setup-python@v5.1.0...v5.1.1) #### What's Changed ##### Bug fixes: - fix(ci): update all failing workflows by [@mayeut](https://github.com/mayeut) in [#863](actions/setup-python#863) This update ensures compatibility and optimal performance of workflows on the latest macOS version. ##### Documentation changes: - Documentation update for cache by [@gowridurgad](https://github.com/gowridurgad) in [#873](actions/setup-python#873) ##### Dependency updates: - Bump braces from 3.0.2 to 3.0.3 and undici from 5.28.3 to 5.28.4 by [@dependabot](https://github.com/dependabot) in [#893](actions/setup-python#893) #### New Contributors - [@gowridurgad](https://github.com/gowridurgad) made their first contribution in [#873](actions/setup-python#873) **Full Changelog**: <actions/setup-python@v5...v5.1.1> ### [`v5.1.0`](https://github.com/actions/setup-python/releases/tag/v5.1.0) [Compare Source](actions/setup-python@v5.0.0...v5.1.0) #### What's Changed - Leveraging the raw API to retrieve the version-manifest, as it does not impose a rate limit and hence facilitates unrestricted consumption without the need for a token for Github Enterprise Servers by [@Shegox](https://github.com/Shegox) in [#766](actions/setup-python#766). - Dependency updates by [@dependabot](https://github.com/dependabot) and [@HarithaVattikuti](https://github.com/HarithaVattikuti) in [#817](actions/setup-python#817) - Documentation changes for version in README by [@basnijholt](https://github.com/basnijholt) in [#776](actions/setup-python#776) - Documentation changes for link in README by [@ukd1](https://github.com/ukd1) in [#793](actions/setup-python#793) - Documentation changes for link in Advanced Usage by [@Jamim](https://github.com/Jamim) in [#782](actions/setup-python#782) - Documentation changes for avoiding rate limit issues on GHES by [@priya-kinthali](https://github.com/priya-kinthali) in [#835](actions/setup-python#835) #### New Contributors - [@basnijholt](https://github.com/basnijholt) made their first contribution in [#776](actions/setup-python#776) - [@ukd1](https://github.com/ukd1) made their first contribution in [#793](actions/setup-python#793) - [@Jamim](https://github.com/Jamim) made their first contribution in [#782](actions/setup-python#782) - [@Shegox](https://github.com/Shegox) made their first contribution in [#766](actions/setup-python#766) - [@priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#835](actions/setup-python#835) **Full Changelog**: <actions/setup-python@v5.0.0...v5.1.0> ### [`v5.0.0`](https://github.com/actions/setup-python/releases/tag/v5.0.0) [Compare Source](actions/setup-python@v4.9.1...v5.0.0) #### What's Changed In scope of this release, we update node version runtime from node16 to node20 ([#772](actions/setup-python#772)). Besides, we update dependencies to the latest versions. **Full Changelog**: <actions/setup-python@v4.8.0...v5.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate-bot@internal.local> Co-committed-by: Renovate Bot <renovate-bot@internal.local>

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 18, 2025

dependabot bot requested a review from a team as a code owner June 18, 2025 22:02

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 18, 2025

dependabot bot force-pushed the dependabot/pip/__tests__/data/urllib3-2.5.0 branch from 1409085 to 035afc5 Compare September 5, 2025 11:48

aparnajyothi-y added 3 commits September 5, 2025 18:04

documentation update

dfaa95a

doc update

ffb9ea3

doc update

5c825d2

gowridurgad previously approved these changes Sep 5, 2025

View reviewed changes

doc format update

0b5328a

aparnajyothi-y dismissed gowridurgad’s stale review via 0b5328a September 8, 2025 08:55

aparnajyothi-y added 3 commits September 8, 2025 15:57

doc update

00c2a66

doc update

03e3248

doc update

cfe4a52

aparnajyothi-y changed the title ~~Bump urllib3 from 1.26.19 to 2.5.0 in /__tests__/data~~ Bump urllib3 from 1.26.19 to 2.5.0 in /__tests__/data and document breaking changes in v6 Sep 10, 2025

fix check failures

fbdf08c

gowridurgad approved these changes Sep 17, 2025

View reviewed changes

aparnajyothi-y approved these changes Sep 17, 2025

View reviewed changes

HarithaVattikuti approved these changes Sep 18, 2025

View reviewed changes

HarithaVattikuti merged commit 4267e28 into main Sep 18, 2025
1297 checks passed

HarithaVattikuti deleted the dependabot/pip/__tests__/data/urllib3-2.5.0 branch September 18, 2025 03:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump urllib3 from 1.26.19 to 2.5.0 in /tests/data and document breaking changes in v6#1139

Bump urllib3 from 1.26.19 to 2.5.0 in /tests/data and document breaking changes in v6#1139
HarithaVattikuti merged 9 commits intomainfrom
dependabot/pip/tests/data/urllib3-2.5.0

dependabot bot commented on behalf of github Jun 18, 2025 •

edited by aparnajyothi-y

Loading

Uh oh!

aparnajyothi-y commented Sep 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot bot commented on behalf of github Jun 18, 2025 • edited by aparnajyothi-y Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

Security issues

Features

Bugfixes

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

Features

Bugfixes

Misc

2.3.0

2.5.0 (2025-06-18)

Features

Bugfixes

2.4.0 (2025-04-10)

Features

Bugfixes

Misc

2.3.0 (2024-12-22)

Uh oh!

aparnajyothi-y commented Sep 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github Jun 18, 2025 •

edited by aparnajyothi-y

Loading