From 05f32d008af1c4ead6fb805f26d33d6a6fd58b76 Mon Sep 17 00:00:00 2001
From: leo <260626284+cameledev@users.noreply.github.com>
Date: Tue, 12 May 2026 10:52:05 +0200
Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20(dependencies)=20Bump=20ur?=
 =?UTF-8?q?llib3=20from=202.6.3=20to=202.7.0=20[SECURITY]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix CVE-2026-44431 and CVE-2026-44432.
---
 CHANGELOG.md               | 1 +
 src/backend/pyproject.toml | 1 +
 src/backend/uv.lock        | 8 +++++---
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a10c6c3..f5e78259 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ and this project adheres to
 ### Changed
 
 - ♻️(summary) change tasks endpoint signature
+- ⬆️(dependencies) update urllib3 to v2.7.0 [SECURITY]
 
 ### Fixed
 
diff --git a/src/backend/pyproject.toml b/src/backend/pyproject.toml
index b6a73315..15ede45e 100644
--- a/src/backend/pyproject.toml
+++ b/src/backend/pyproject.toml
@@ -61,6 +61,7 @@ dependencies = [
     "mozilla-django-oidc==5.0.2",
     "livekit-api==1.1.0",
     "aiohttp==3.13.4",
+    "urllib3==2.7.0",
 ]
 
 [project.urls]
diff --git a/src/backend/uv.lock b/src/backend/uv.lock
index b2aa4762..44587bc7 100644
--- a/src/backend/uv.lock
+++ b/src/backend/uv.lock
@@ -1212,6 +1212,7 @@ dependencies = [
     { name = "redis" },
     { name = "requests" },
     { name = "sentry-sdk" },
+    { name = "urllib3" },
     { name = "whitenoise" },
 ]
 
@@ -1273,6 +1274,7 @@ requires-dist = [
     { name = "redis", specifier = "==5.2.1" },
     { name = "requests", specifier = "==2.33.0" },
     { name = "sentry-sdk", specifier = "==2.54.0" },
+    { name = "urllib3", specifier = "==2.7.0" },
     { name = "whitenoise", specifier = "==6.12.0" },
 ]
 
@@ -2260,11 +2262,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]