chore(deps): bump urllib3 from 2.5.0 to 2.6.3
What the developer wrote
Authored by dependabot[bot]
chore(deps): bump urllib3 from 2.5.0 to 2.6.3
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.3)
---
updated-dependencies:
- dependency-name: urllib3
dependency-version: 2.6.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is an automated dependency update by Dependabot that bumps the Python urllib3 library from version 2.5.0 to 2.6.3 in the project's lock file. urllib3 is a widely used HTTP client library, but it is an indirect dependency here, meaning it is pulled in by another package rather than being used directly by Trezor's firmware code. The commit itself only changes version numbers and download hashes; it does not modify Trezor's own code. Without knowing which known urllib3 vulnerabilities exist between these versions or how Trezor's tooling uses it, the direct security risk from this single commit is low.
Verify whether urllib3 2.5.0 has any known CVEs fixed in 2.6.3 by checking the urllib3 changelog and security advisories. Confirm that urllib3 is only used in non-production tooling (build, tests, CI) and not in any code path that handles secrets, firmware flashing, or device communication. If it is only an indirect dev/CI dependency, this update is routine maintenance and low risk. Continue to keep indirect dependencies updated.
Security signals we found
Dependency version bump of a networking library (urllib3)
Indirect dependency, not direct Trezor code
No vendor security disclosure or CVE referenced in commit
No code changes to firmware, wallet logic, or cryptography
Automated Dependabot update without human security annotation
Evidence from the diff
The commit updates the uv.lock file for the Trezor firmware repository, changing the pinned version of urllib3 from 2.5.0 to 2.6.3. urllib3 is an indirect dependency used by Python tooling (likely test, build, or CI infrastructure). The change updates the sdist and wheel URLs along with their SHA-256 hashes and file sizes. No Trezor source code, firmware logic, or cryptographic operations are modified. The security relevance depends entirely on whether urllib3 2.5.0 had known vulnerabilities fixed in 2.6.3, and whether those vulnerabilities are reachable through Trezor’s build/CI/test usage of the library. The commit message and diff provide no specific CVE or security claim.
Changed components
uv.lockPython build/CI/test tooling (indirect dependency: urllib3)Inspect captured patch +4 / −4
diff --git a/uv.lock b/uv.lock
index cb28f1b4..bb92a932 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
version = 1
-revision = 2
+revision = 3
requires-python = ">=3.9, <4"
resolution-markers = [
"python_full_version >= '3.13'",
@@ -2338,11 +2338,11 @@ sdist = { url = "https://files.pythonhosted.org/packages/3e/ff/87c166a4e1eb9a7fb
[[package]]
name = "urllib3"
-version = "2.5.0"
+version = "2.6.3"
source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/15/22/9ee70a2574a4f4599c47dd506532914ce044817c7752a79b6a51286319bc/urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760", size = 393185, upload-time = "2025-06-18T14:07:41.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/a7/c2/fe1e52489ae3122415c51f387e221dd0773709bad6c6cdaa599e8a2c5185/urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc", size = 129795, upload-time = "2025-06-18T14:07:40.39Z" },
+ { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
]
[[package]]
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.