urllib3 2.5.0 is in high risk in black duck

[RanAdler-Nice]

Describe the bug

when i use the last version boto3==1.40.23 i get
urllib3 2.5.0 is in high risk in black duck

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

i need urllib3 2.6.3

Current Behavior

urllib3 2.5.0

Reproduction Steps

when i use the last version boto3==1.40.23 i get
urllib3 2.5.0 is in high risk in black duck

Possible Solution

No response

Additional Information/Context

No response

SDK version used

python1.12

Environment details (OS name and version, etc.)

python1.12

[jonathan343]

Hey @RanAdler-Nice, thanks for reaching out!

The urllib3 version you end up with is not pinned to 2.5.0 by boto3 or botocore. For Python 3.10+, botocore's requirement is:

'urllib3>=1.25.4,!=2.2.0,<3 ; python_version >= "3.10"',

This means any urllib3 version from 1.25.4 up to (but not including) 3.0 is acceptable, excluding 2.2.0. There is nothing in boto3 or botocore preventing urllib3 2.6.3 from being installed.

If you're ending up with urllib3 2.5.0 instead of 2.6.3, it may be because another dependency in your environment is applying a separate constraint that caps or pins urllib3 to that version. To help identify which package is responsible, you can run:

pip install pipdeptree
pipdeptree --reverse --packages urllib3

This will show you every installed package that depends on urllib3 and what version constraints they impose. From there, you can determine which dependency is holding urllib3 at 2.5.0 and decide how to resolve it (e.g., upgrading that package).

To confirm, you can also install boto3 in a clean virtual environment and observe that urllib3 2.6.3 is pulled in without issue.

Example using Python 3.12:

$ uv venv -p 3.12
Using CPython 3.12.12
Creating virtual environment at: .venv
Activate with: source .venv/bin/activate
$ act
(dev) $ uv pip install boto3==1.40.23
Resolved 7 packages in 198ms
Prepared 2 packages in 41ms
Installed 7 packages in 798ms
 + boto3==1.40.23
 + botocore==1.40.76
 + jmespath==1.1.0
 + python-dateutil==2.9.0.post0
 + s3transfer==0.13.1
 + six==1.17.0
 + urllib3==2.6.3