urllib3 upgrade

[MordaCap]

Could you please upgrade urllib3 to 2.7.0 ASAP?

https://security.snyk.io/package/pip/urllib3

[Newrelic-Boomi]

https://new-relic.atlassian.net/browse/NR-565340

[TimPansino]

Unfortunately the agent needs to support Python 3.9 per our SLAs until November, and urllib3==2.7.0 only supports Python 3.10+.

[TimPansino]

Leaving this issue open until these CVEs have been patched. In the meantime, if you have any input on the security analysis in PR #1736 feel free to leave a comment.

TL;DR: My findings were that the agent should not be vulnerable to CVE-2026-44431, but could be vulnerable to a DoS attack from a compromised HTTPS proxy through CVE-2026-44432. If you have a compromised HTTPS proxy, there are probably many much worse issues to worry about first.