Update urllib3 Python wheel to 2.7.0

CHANGELOG.md

@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - #1097: The Test resource processor now supports nested tests
 
 ### Security
+- urllib Python wheel updated to 2.7.0
 - requests Python wheel updated to 2.33.0
 
 ## [0.10.6] - 2026-02-24

module.xml

@@ -45,7 +45,7 @@
       <PythonWheel Name="referencing-0.36.2-py3-none-any.whl" ExtraPipFlags="--no-deps" />
       <PythonWheel Name="requests-2.33.0-py3-none-any.whl" ExtraPipFlags="--no-deps" />
       <PythonWheel Name="typing_extensions-4.12.2-py3-none-any.whl" ExtraPipFlags="--no-deps" />
-      <PythonWheel Name="urllib3-2.6.3-py3-none-any.whl" ExtraPipFlags="--no-deps" />
+      <PythonWheel Name="urllib3-2.7.0-py3-none-any.whl" ExtraPipFlags="--no-deps" />
 
       <!-- Pure python implementation of rpds-py for offline installation or behind a
             firewall.

wheels/requirements.txt

@@ -11,6 +11,6 @@ oras==0.1.30
 referencing==0.36.2
 requests==2.33.0
 typing_extensions==4.12.2
-urllib3==2.6.3
+urllib3==2.7.0
 # When https://github.com/pypa/pip/pull/10837 is merged, we should specify per-requirement `--no-deps` in requirements.txt directly,
 # so that dependabot etc. don't pick up vulnerabilities in `rpds-py`, which we implement ourselves.